nnutter / hashed-for-safari Goto Github PK

The purpose of the PwdHash scheme is to enable easy entry of a master password that then generates complex passwords. The reason this is so valuable is so that you do not need to ever save your master password somewhere (where the data could be compromised).

By designing Hashed to save the master password, I believe this is defeating the very purpose and benefit that a PwdHash extension can provide.

I strongly believe the default behavior should be to never store any master password, but instead enable easy entry of that password and adjust it for transmittal using the PwdHash algorithm.

Currently the Hashed button remains usable and does not dim but if you click on it you do at least get an alert that you need to enter a master password.

It is very important that the website not be able to access the Hashed master password so any interaction with the user needs to be secure in that sense. If it is possible to do that within the Safari Extension API then multiple master passwords should be supported.

If you are on a on a blank page/tab then clicking the button does nothing. It should dim out and be unusable if a URL is not available.

It is impossible to generate a hashed password on a, say, German keyboard.

Neither \ nor ‘ can be reached without pressing Alt and/or Shift. The extension does not recognize the shortcut under these circumstances.

Cmd+# and Cmd+ä would be the equivalents on a German keyboard, they are on the same keys. Other implementations use @@ or F2 to activate, maybe this could be added?

It would be very useful to support migrating from one master password to another.