April 30, 2009

Password Hashing: A Neat Idea That Can Help to Protect Your Online Accounts

Filed under: Security — bnsmith @ 8:41 pm

I’ve been re-evaluating my information security precautions lately, and while doing so, I discovered something interesting that I’d like to share. These days, most people have accounts at several different websites. For convenience, most people use the same password for some or all of their accounts, which opens up a potential security vulnerability. If a computer criminal manages to steal a list of usernames and passwords from a poorly-secured website, then they could try using each of these username/password pairs to log in to Paypal, for example. As you can imagine, compromising a few thousand Paypal accounts could be quite profitable.

There are other, less-obvious ways that your passwords could be compromised as well. As I learned from reading the EFF’s Surveillance Self Defence guide, the New York Times website doesn’t encrypt the username and password that you send them to access their articles. If you log into the website from the open WiFi provided at an airport, for example, then your username and password would be transmitted completely in the clear and could be stolen by anyone in range of the radio signal.

The recommended solution is to use a different password for each website that you use, so that the theft of one password will only give the computer criminal access to one online account and not all of them. If you commit every one of your passwords to memory, then this strategy is very secure; unfortunately, it also requires tremendous effort and discipline to memorize random strings of letters, numbers and punctuation.

One Option: Password Vaults

It is possible to store your passwords in an encrypted file on your hard drive, and then choose one “master password” that will allow you to fetch the password for a specific website out of the vault. The master password is the only one that you need to remember. Using this system, it will seem as though you’re using the same password for each website. Behind the scenes, however, each website will receive its own unique password.

This is a reasonable option, but it has some disadvantages. First, you must have a good backup strategy in place, because losing your vault file would mean losing access to all of your accounts. If you follow the advice of some security experts and set your password recovery questions to gibberish, the loss of your vault would be that much more difficult to recover from. Second, this system is a bit inconvenient for accessing your accounts when you are away from your main computer. If you go to an Internet cafe in some other country, perhaps you could bring your password vault on a USB thumb drive, but what if the cafe doesn’t allow users to plug in their own USB drives? Or perhaps the cafe’s computers run Mac OS X and you don’t have compatible decryption software on the thumb drive. I believe that it should be possible to develop a partially web-based password vault program that overcomes these problems, but no such program currently exists, as far as I know.

The Solution: Password Hashing

The basic idea behind password hashing is to take a master password of your choice and combine it with a value specific to the website that you wish to access. This combined value is then run through a “hash function” that creates a random-looking string of letters, numbers and punctuation. This random-looking string will be the password for that specific website. It’s pretty simple once you get the idea; perhaps an example would help. Suppose that you choose “123456” to be your master password, and you wish to access your Facebook account. The password hashing software will combine “123456” with a value representing the website; in this case, that would likely be “facebook”. The resulting password is “9bMxDooTmtwh7AX$”.
Nothing is stored on your hard-drive, so there’s nothing to backup. When you’re away from your main computer, it is possible to browse to a web-based version of the password hashing software. This online version shouldn’t need to transmit anything over the Internet in order to generate the password for any of your websites.

If an attacker manages to acquire one, or even all of your site-specific passwords, they will still be no closer to figuring out what your master password is, thanks to the special properties of the hash functions used for this purpose.

This system has one more great security benefit: protection against phishing attacks. Suppose that an attacker tricks you into visiting a fraudulent copy of eBay with the address “”. The website would look legitimate, but have a slightly different address than the real thing. If you then try to log in to this fraudulent web-site, the password hashing software would combine “123456” with “eboy” to create the hashed password “2dsOpJdTv$q9Aook”. This is completely different than your real eBay password, “c+qw5XtUrJyLF2wM”, created by combining “123456” with “ebay”. The password stolen by the computer criminals is useless!

Password Hashing Software

One of the most popular password hashing programs is Stanford PwdHash, and with good reason. It is simple, elegant and it just works. When you visit a website that you wish to log in to, you simply type “@@” followed by your master password into the website’s password field. PwdHash automatically substitutes the hashed password before transmitting the login information. Anyone watching over your shoulder wouldn’t even know you were doing anything special.

It is definitely my favorite password hashing program, and it pains me that I can’t use it. Sometimes a program can be too simple. PwdHash has no options or customizability of any kind. Any hashed password that is generated by PwdHash is always exactly two characters longer than the master password. As I was half-way through converting all of my accounts to PwdHash, I discovered that some of the websites that I use had restrictions on the length and composition of the passwords that they would accept. Specifically, it always seemed to be the websites for banks and financial institutions that would only accept weak passwords.

I know this isn’t really relevant here, but I have to ask: what is wrong with the banks? They make billions of dollars in profits but can’t spare enough hard drive space to store more than 8 characters for a password? Or maybe they just decided that 8 characters is good enough security for what they’re protecting, because of course my life savings is so much less valuable than my list of favorite movies on Facebook.

Ahem. Sorry about that. Anyway, when it comes to password hashing in the real world, the best option that I’ve found is the unimaginatively named “Password Hasher“. It’s basically the same as PwdHash, except that you can specify the length and characteristics of the passwords that are generated. There are a few small usability problems that prevent me from endorsing it wholeheartedly. Here’s how the program works. First, you visit the website, enter your username and tab down to the password field.


Then you activate the plugin through a keyboard shortcut, and a pop-up window appears into which you type your master password.


When you press “Enter”, the pop-up closes and the password field on the web page is populated with the generated password.


All well and good, but you must then press “Enter” again to actually submit the username and password and enter the website. Pressing “Enter” twice to log in is a bit annoying, but you get used to it.

Another problem is the bizarre default keyboard shortcut for activating the pop-up: CTRL-F6. I recommend immediately changing it to something a little more convenient. I use CTRL-semicolon (see the FAQ for directions on changing the shortcut).

Overall, despite these niggling issues, the program performs admirably. If you’re seriously thinking about implementing this security strategy, I recommend making a list of all of your online accounts (not an easy task, I assure you) and then figuring out which websites, if any, have annoying password restrictions that rule out the use of PwdHash. In all honesty, if you’re a serious Internet user, Password Hasher is probably your best option. Since you’ve read this far, I can assume that you’re pretty serious about securing your information, so why not give it a try? If you have any other questions, leave a comment and I’ll do my best to help.

Blog at