Workflow to regenerate passwords over from v1.x passwords

palant / pfp

A simple and secure browser extension to be used with KeePass databases.

https://pfp.works/

Mozilla Public License 2.0

113 stars 14 forks source link

Workflow to regenerate passwords over from v1.x passwords #73

Closed r-a-y closed 6 years ago

r-a-y commented 6 years ago

Congrats on the new v2.0 release.

v2.0 uses ~~bcrypt~~ scrypt for passwords. For those of us that have been using since v1.0, I'm finding it a little difficult to change my passwords over.

Clicking on the "Generate new password for this user name" link works, but I cannot use the same revision number as before because pFp will not let me do so. Does the revision number matter in instances where we are attempting to change over to v2.0?

Right now, in order to start fresh, I'm removing the previous v1.x password and recreating the password with the new algorithm. But, this increases the amount of steps I need to make.

Would appreciate what the recommended workflow is.

ghost commented 6 years ago

Actually it's scrypt not bcrypt. I had the same dilemmas as you and settled with doing it manually same as you did.

I think possibility of recreating password with same revision number can be added for easier transition. Increasing revison number for every password would make password recovery harder.

palant commented 6 years ago

Yes, I am aware of this being awkward. Trouble is, with most sites changing your password requires both passwords to be used. So if the password is simply replaced, you need to fill in the "current password" field before doing it. Do you think people will get this right?

The following would be easily doable:

Add a password menu item "Upgrade to PfP 2.x password" and have clicks on the exclamation mark have the same effect.
When a password is being upgraded, you first get a warning: "This password will change as the result of upgrading. Most websites require entering your current password when changing passwords, only proceed when you already filled in the current password. Proceed replacing this password?"
If the user clicks "Yes" the password will be replaced and can be filled into the "new password" fields.

What do you think?

ghost commented 6 years ago

Yeah, I think above should be fine.

palant commented 6 years ago

I added this functionality now, it will be part of the 2.0.1 release which will hopefully get out today.

r-a-y commented 6 years ago

New changes work great. Thanks for implementing!