kostyushkin / enigmapass

EnigmaPass Google Chrome Extension

EnigmaPass

EnigmaPass is a Chrome Extension that generates secure, repeatable, per-domain, passwords based on a single master password. You only have to remember one password, but you'll get a different password for every website you visit. It builds on the great work of SuperGenPass, but makes it more secure & easier to use.

When you're not able to use EnigmaPass, you can still use the tools available at SuperGenPass, they will generate the same passwords.

So why use EnigmaPass? Well, being a chrome extension, EnigmaPass benefits from the enhanced security between tab and browser in Google Chrome. A website would not be able to detect any information placed in EnigmaPass, which they may be able to with SuperGenPass.

enigmapass's Issues

Store password hash using bcrypt.

The password hash can be securely stored (for checking) by using bcrypt, rather than MD5. This is regardless of the actual passwords. Also, an option can be given where the bookmarklet will generate bcrypt hashes rather than md5 hashes, for a big boost in security. This will break compatibility with SuperGenPass, however, and backwards compatibility.

http://code.google.com/p/javascript-bcrypt/source/browse/bCrypt.js

Errors appear in console due to Enigmapass

The following errors appear on each page when Enigmapass is enabled.

extensions/miscellaneous_bindings.js:159Port error: Could not establish connection. Receiving end does not exist.
chromeHidden.Port.dispatchOnDisconnectextensions/miscellaneous_bindings.js:159
extensions/event.js:185Error in event handler for 'undefined': TypeError: Cannot read property 'notify' of undefined
    at chrome-extension://bgkipgfgpifliinhbnfoaafgdeemodoi/enigmapass.js:297:14
    at extensions/miscellaneous_bindings.js:275:13
    at [object Object].dispatch (extensions/event.js:183:28)
    at Object.<anonymous> (extensions/miscellaneous_bindings.js:162:27)
chrome.Event.dispatchextensions/event.js:185
extensions/miscellaneous_bindings.js:159Port error: Could not establish connection. Receiving end does not exist.
chromeHidden.Port.dispatchOnDisconnectextensions/miscellaneous_bindings.js:159

Is EnigmaPass vulnerable?

Is EnigmaPass vulnerable to this exploit? I would think not, since it renders the extension outside the DOM, but you might want to include the link above (and an explanation about how EnigmaPass isn't vulnerable to it) as endorsement/for users' peace of mind.

The focus is always on the "domain" field by default.

No matter what I do, the initial focus is on the domain text field. I forked the project and tried to change it by adding $("#password").focus(), but it still won't work, and I don't know why.

It's really annoying that the default focused field is the domain, does this happen for anyone else?

Button does not appear next to password fields

The P button that shows the inline password generator does not appear next to password fields. Furthermore, the bold letter P from that button is sometimes shown at the bottom of the page. It is not clickable.

LinkyPass v2.0.0

Just so you know, LinkyPass (aka old SuperChromePass) has been updated to v2.0.0 with a new design and new features. Check it out in the Chrome WebStore

Feel free to merge all the updates into enigmapass, or to keep it as is if you prefer the old style to the new; but suffice it to say that LinkyPass is alive again!