Hacker News new | ask | show | jobs
by aba_sababa 4423 days ago
Compromising one of these passwords does not at all mean that all the other passwords are compromised. You can't figure out the original master password from a hashed, compromised password.
1 comments

Yes, you can. To understand why, compare:

This:

  'facebook' + 'mypassword'
  'twitter' + 'mypassword'
  'foursquare' + 'mypassword'
Password manager with unique passwords:

  'mSX32ZyKZXptY3E'
  '33RiKbc3n6sA6IY'
  '4kGzFtWDd0rnti6'
All I have to do is figure out what you named the site that I compromised, then do exactly what I'd usually do to recover your password, and, voila, I can now access all sites you use it for. Compare this to the password manager example where each password has been generated at random--one password communicates no information whatsoever about the other.
Ok, so you know that "facebook" is part of the original hash. Not following how you can also derive "mypassword" from it. If you have a good strong master password, rainbow tables won't be able to crack the hash.