search

wijjo / passhash

Password Hasher Firefox extension
http://wijjo.com/passhash
Mozilla Public License 2.0
41 stars 19 forks source link

Minor improvements #2

Closed uyar closed 7 years ago

uyar commented 12 years ago

This enables the use of PassHash with sites containing country codes.

uyar commented 12 years ago

I've encountered a problem when exporting/importing passwords: Using the Password Exporter addon, when importing passwords, the artificial host name for PassHash will be changed to "http://passhash.passhash" and PassHash can no longer function properly. In order to prevent this, I've changed the artificial hostname to "chrome://passhash". Firefox Sync and Zotero also use this type of domain name for similar purposes.

CAREFUL: This change breaks existing data; all "passhash.passhash" entries in the password database should be updated as "chrome://passhash" before applying this change. For example:

$ sqlite3 signons.sqlite sqlite> update moz_logins set hostname='chrome://passhash' where hostname='passhash.passhash';

samueltardieu commented 12 years ago

I think your first change is too broad. With more and more vanity domains being created, you are likely to find false positives. For example, if ".ic" were to open, you may be sure that "com.ic" would be one of the first domains created there because it sounds like "comic". I think an explicit list of non-first-level domains could be quickly looked up after concatenating the last two components of the domain name.

Regarding your second change, it would be great to include an automated migration path to avoid losing all data.

uyar commented 12 years ago

You're right on both accounts. But I think that failing on a site address like "com.ic" is the lesser of two evils compared to failing on all addresses containing country codes, considering the number of users who are affected. On the other issue, I'm not familiar with Firefox extension development and I have no idea about the password storage API. If I can figure it out, I will try to add the code to do the migration on an update.