{"action":"created","issue":{"url":"https://api.github.com/repos/chriszarate/supergenpass/issues/4","labels_url":"https://api.github.com/repos/chriszarate/supergenpass/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/chriszarate/supergenpass/issues/4/comments","events_url":"https://api.github.com/repos/chriszarate/supergenpass/issues/4/events","html_url":"https://github.com/chriszarate/supergenpass/issues/4","id":6104991,"number":4,"title":"support for symbols, bcrypt","user":{"login":"cmcnulty","id":638534,"avatar_url":"https://avatars.githubusercontent.com/u/638534?v=3","gravatar_id":"","url":"https://api.github.com/users/cmcnulty","html_url":"https://github.com/cmcnulty","followers_url":"https://api.github.com/users/cmcnulty/followers","following_url":"https://api.github.com/users/cmcnulty/following{/other_user}","gists_url":"https://api.github.com/users/cmcnulty/gists{/gist_id}","starred_url":"https://api.github.com/users/cmcnulty/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmcnulty/subscriptions","organizations_url":"https://api.github.com/users/cmcnulty/orgs","repos_url":"https://api.github.com/users/cmcnulty/repos","events_url":"https://api.github.com/users/cmcnulty/events{/privacy}","received_events_url":"https://api.github.com/users/cmcnulty/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2012-08-08T15:10:09Z","updated_at":"2015-04-05T16:00:37Z","closed_at":"2014-06-19T23:53:34Z","body":"I've forked SuperGenPass to include support for bcrypt and symbols using base85 rather than base64.  For me this addresses the two biggest weaknesses of SGP:\n\n1) SGP generated password is unnecessarily weak, and can be more easily compromised when password database is compromised (see In, Linked).  This can be resolved by manually padding the SGP password but, I'd prefer if the tool did the work.\n\n2) Master password retrieval is potentially too easy because of the inherent weakness of using a \"fast\" hashing algorithm if the domain/SGP password has already been compromised (see 1).  By using bcrypt to arrive at the SGP password, it becomes infeasible to brute-force even a relatively weak master password.\n\nSee: cmcnulty/SuperGenPass@5875e2d0eb4349b13621d32b75a789c1443506ab\n"},"comment":{"url":"https://api.github.com/repos/chriszarate/supergenpass/issues/comments/89796532","html_url":"https://github.com/chriszarate/supergenpass/issues/4#issuecomment-89796532","issue_url":"https://api.github.com/repos/chriszarate/supergenpass/issues/4","id":89796532,"user":{"login":"weakish","id":114114,"avatar_url":"https://avatars.githubusercontent.com/u/114114?v=3","gravatar_id":"","url":"https://api.github.com/users/weakish","html_url":"https://github.com/weakish","followers_url":"https://api.github.com/users/weakish/followers","following_url":"https://api.github.com/users/weakish/following{/other_user}","gists_url":"https://api.github.com/users/weakish/gists{/gist_id}","starred_url":"https://api.github.com/users/weakish/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/weakish/subscriptions","organizations_url":"https://api.github.com/users/weakish/orgs","repos_url":"https://api.github.com/users/weakish/repos","events_url":"https://api.github.com/users/weakish/events{/privacy}","received_events_url":"https://api.github.com/users/weakish/received_events","type":"User","site_admin":false},"created_at":"2015-04-05T16:00:37Z","updated_at":"2015-04-05T16:00:37Z","body":"> 1) SGP generated password is unnecessarily weak, and can be more easily compromised when password database is compromised\r\n\r\n@cmcnulty I thought knowing `md5(pw:A)` and `A` does not helps cracking `pw` or `md5(pw:B)` where `B` is known, unless `pw` is weak.\r\n\r\nIf `pw` is weak,  `pkdf2`, `bcrypt` and `scrypt`  do require more time to crack."}}