bwalex / bpasswd Goto Github PK

Alex, current implementation of Bpasswd2 for web is too bloated with dependencies. All thatjquery.js, backbone.js, lodash.js, polyfill.js, panel.js, options.js and various css make it heavy to carry.

Let's get rid of fat and merge the essentials into a single file like SecurePasswords or Plevyak's DPG?

Current mapping to chars based on conservative, base64, ascii85 schemes doesn't work as expected. First it sounds geeky and one has to visit your site (or WIkipedia) to understand difference which is about variety of special symbols. Then let's use frog jaguar as masterkey and [email protected] as salt with 20 chars password length:

qMz1XXiT6TLyCK3JLSw2 conservative
qMz1XXiT6TLyCK3JLSw2 base64
SlB{uC:4wE[^8wteI5!} z85

Conservative and base64 (default scheme) outputs are equal here. However at least one special symbol (+ or /) is expected with base64, but missing. Password policies of modern websites explicitly require using a special symbol. The only way to get it here is to expand mentioned password's length to 22.

Consider checking how mapping is done, for example, by Vault or Passwordgen, it's more flexible.

Dear Alex,
salt of current Chrome extension is too simple and does not cover cases like these

subdomain dogscommunity.livejournal.com, workblog.livejournal.com, diary.livejournal.com
current: livejournal
expected: dogscommunity.livejournal.com, workblog.livejournal.com, diary.livejournal.com

tld panasonic.ru/admin/, panasonic.eu/admin/
current: panasonic
expected: panasonic.ru, panasonic.eu

Could you be so kind and make salt more unique by adding subdomain (excluding www), tld, and dots?