Author Topic: finding an old password program ... (Read 12520 times)

barney · « **on:** May 01, 2018, 05:40 PM »

Folk,
I'm trying to find a password program L used to have. Of course, the name eludes me. I've used it so long,it just became, "the password thingy."

Between hurricane Harvey, a house fire, and a recent theft from my place, I've lost all capability to replace it,unless I can find it online again.

Reason I want it is because of the way it worked. Enter text in a field, click,and it generates the same password, based upon that text, every time. As a result, I could enter text relevant to a aite and get my password to it w/o having to record the password anywhere. Ran resident, so I always had quick access to it.

It's several years old, so may not be available still, but I would dearly like to find it again. Any help appreciated.

Dormouse · « **Reply #1 on:** May 01, 2018, 07:43 PM »

Hash programs do that. Is it possible it simply hashed the text?

barney · « **Reply #2 on:** May 01, 2018, 08:16 PM »

Hash programs do that. Is it possible it simply hashed the text?
-Dormouse (May 01, 2018, 07:43 PM)

Don't Think so, but I have been known to be wrong a time or three.

Deozaan · « **Reply #3 on:** May 01, 2018, 09:19 PM »

I know something like that has been discussed on this site before. I just can't seem to remember where.

I did find this: https://www.donation....msg276252#msg276252

But that thread is really old and I'm pretty sure I remember having a conversation about it more recently than that. I'd guess you might have better luck in one of the LastPass (breach/vulnerability) threads.

wraith808 · « **Reply #4 on:** May 01, 2018, 10:14 PM »

Hash programs do that. Is it possible it simply hashed the text?
-Dormouse (May 01, 2018, 07:43 PM)

Chec

Hash programs do that. Is it possible it simply hashed the text?
-Dormouse (May 01, 2018, 07:43 PM)
Don't Think so, but I have been known to be wrong a time or three.
-barney (May 01, 2018, 08:16 PM)

Check at https://www.md5hashgenerator.com/ with a phrase that you know you used. If it matches the 'password' then that might be what it's doing. Of course, that's only MD5, so it might not match and that still be what it was doing.

* wraith808 shrugs

mwb1100 · « **Reply #5 on:** May 02, 2018, 02:07 AM »

There's a chrome browser extension called hashpass: https://github.com/stepchowfun/hashpass

That repository has links to some other implementations (Android, python, etc) in case you were using this or some variation on it.

wraith808 · « **Reply #6 on:** May 02, 2018, 08:13 AM »

There's a chrome browser extension called hashpass: https://github.com/stepchowfun/hashpass

That repository has links to some other implementations (Android, python, etc) in case you were using this or some variation on it.
-mwb1100 (May 02, 2018, 02:07 AM)

Nice! Of note from the repo:

Suppose your secret key is bananas, and you're signing up for Facebook. Hashpass combines the current domain name and your secret key with a / as follows: www.facebook.com/bananas. It then computes the SHA-256 hash of that string. Then it hashes it again and again, 2^16 times in total. Finally, it outputs the first 96 bits of the result, encoded as 16 characters in Base64. In this example, the final output is sWwtmA9uA6X9SyXD. This result can be reproduced using the Python script near the bottom of this document.

Looks pretty nice. Might start using that instead of the LastPass extension. A bit more work, but worth it, I think.

A couple of warnings from them:

If an adversary has your secret key, they have access to all of your accounts. Hashpass never reveals your secret key. But we must make sure that an adversary can't determine it from the generated passwords.

-snip-

A common defense against these attacks is to add random bits to your key. This is called a salt, and it ensures you don't use the same key as anyone else. Most security software will automatically add a salt to your key and store it. Since Hashpass doesn't store anything, it cannot add a salt for you. It is up to you to pick a key with enough entropy to defend against dictionary attacks. Longer is better. More random is better. Don't use a single word. Definitely don't use bananas. Hashpass doesn't limit the size of your secret key—take advantage of this.

Deozaan · « **Reply #7 on:** May 02, 2018, 09:45 AM »

Is it LessPass?

Keep in mind that, as f0dder mentioned in that thread (well, he linked to something written by someone else), these kinds of password generators have drawbacks that may not be readily apparent. So if you can find the one you used to generate your passwords, you may want to consider moving to a different password system.

If that's not the one, then as I said, perhaps you should check out the LastPass Alternatives thread.

Good luck!

cranioscopical · « **Reply #8 on:** May 02, 2018, 01:24 PM »

Any of these?

link to list

wraith808 · « **Reply #9 on:** May 02, 2018, 01:30 PM »

Is it LessPass?

Keep in mind that, as f0dder mentioned in that thread (well, he linked to something written by someone else), these kinds of password generators have drawbacks that may not be readily apparent. So if you can find the one you used to generate your passwords, you may want to consider moving to a different password system.

If that's not the one, then as I said, perhaps you should check out the LastPass Alternatives thread.

Good luck!
-Deozaan (May 02, 2018, 09:45 AM)

I'd forgotten about that one, and I'm the OP. I think the concerns there are expressed in the blocks I quoted above, i.e. the lack of the salt, as it's not stored. Been trying to find an alternative; xmarks' deprecation was more of a reason for me to find something rather than LastPass breaches. Tried sticky password on recommendation from here; even bought a lifetime license. But performance issues already have me regretting that decision.

wraith808 · « **Reply #10 on:** May 02, 2018, 01:32 PM »

Any of these?

link to list
-cranioscopical (May 02, 2018, 01:24 PM)

Or these... https://alternativet...t/software/lastpass/

rjbull · « **Reply #11 on:** May 02, 2018, 04:08 PM »

A DuckDuckGo search for "windows program generate password text" turned up quite a few password-oriented hash programs and web sites, some with Android (or iStuff) apps as well. E.g.:

PWGen
hashapass
HashPass (not sure if this is the same one as mentioned above)

wraith808 · « **Reply #12 on:** May 02, 2018, 06:12 PM »

A DuckDuckGo search for "windows program generate password text" turned up quite a few password-oriented hash programs and web sites, some with Android (or iStuff) apps as well. E.g.:

PWGen
hashapass
HashPass (not sure if this is the same one as mentioned above)

-rjbull (May 02, 2018, 04:08 PM)

The last two have the same link. Was that intentional or was one missed?

4wd · « **Reply #13 on:** May 02, 2018, 08:46 PM »

There's also vPass, web based hashed password generator, there are extensions and bookmarklet available, you can also self host.

I had one on my phone I was looking at that did the same thing, (it had a computer based version also but I can't think of it), decided that if I had to enter a master password to use any of these I might as well use a decent program that allowed me to store/do a lot more than just passwords, (ie. KeePass).

rjbull · « **Reply #14 on:** May 03, 2018, 04:14 PM »

[...]
HashPass
-rjbull (May 02, 2018, 04:08 PM)

The last two have the same link. Was that intentional or was one missed?
-wraith808 (May 02, 2018, 06:12 PM)

It was a slip-up

Corrected above and in the earlier post. Thanks for checking.

There appear to be numerous programs/services called "HashPass;" I haven't researched the relationships between them, if any. As I said, quite a few are available for mobile devices, so if the OP finds his missing program and can find a mobile one that uses the same hash, he would have a convenient "backup."

Ancucu · « **Reply #15 on:** May 10, 2018, 05:55 AM »

I recommend you to try HashPass

4wd · « **Reply #16 on:** May 10, 2018, 09:49 PM »

And one more: MultiHasher

Not a password program but it will show text hashes using multiple algorithms at once which you try:

2018-05-11 12_48_04-Hash Text String.png

2018-05-11 12_48_04-Hash Text String.png

marisaga · « **Reply #17 on:** February 23, 2019, 10:56 AM »

This is what I do. Surely it's nonsense, but I can't find the flaw. Maybe because I don't know much. I have a file in my PC with just a link to a file in a USB that I carry in my purse which, in turn, has only a link to another file in my PC. I figure that way in case my PC were hacked, nothing would happen since they have not the USB. And in case my purse were stolen, it would do no good, either. When I'm sitting at the PC I always have the USB connected, so it's no problem. Of course this would be burdensome to do for every page but with those that are important I think it's worth the trouble. Of course I'm not as knowledgeable as most people here and I'd be grateful if someone pointed out where the catch is

x16wda · « **Reply #18 on:** March 02, 2019, 05:07 PM »

Hey Barney, can you say what the password looked like? Was it just a string of numbers/letters/symbols, were all the passwords it generated the same length? Can you say how long they were?

Assuming your "text relevant to the site" isn't the URL (or isn't just the URL), then probably some kind of hashing program would work fine for you. Shouldn't be that hard to write one. The whole point of a hash is when you feed it the same thing, it always spits out the same result. Now, there might be some other text that could generate the same result, but if the text is something from your mind then that might not be an issue. Depends where on the scale from CRC to MD5 you want to be. :-)

barney · « **Reply #19 on:** March 02, 2019, 05:58 PM »

Assuming your "text relevant to the site" isn't the URL (or isn't just the URL), then probably some kind of hashing program would work fine for you
-x16wda (March 02, 2019, 05:07 PM)

Probably moot by now. Had foot surgery a little over a year ago a year ago, still in rehab. Sister managing things financial, but didn't check email stuff, so I've lost most Web subscriptions. Laptop that had the software and data file got kinda, sorta mangled during the storage process.

(surgery was removal of all five (5) toes on right foot - can't you just imagine a 75 year old cripple learning to walk again

?)

NigelH · « **Reply #20 on:** March 02, 2019, 08:39 PM »

Barney ..

Key Maker
https://www.donation....msg237010#msg237010

I went to Archive.org.
https://web.archive....ownload/keymaker.htm

The keymaker_setup.exe download that eventually starts matches my download from 2012.
These are the hashes
MD5: 22ad64b4c87cffa6d31c9a87a65264b6
SHA-1: 00cbf457e05953606c91a0ae60930ef4abbe3261

x16wda · « **Reply #21 on:** March 03, 2019, 08:19 AM »

Great detective work NigelH!

barney · « **Reply #22 on:** March 03, 2019, 08:42 AM »

The keymaker_setup.exe download that eventually starts matches my download from 2012.
-NigelH (March 02, 2019, 08:39 PM)

That's the one I've been looking for! Many thanks! Now to find the backup floppy ...