base64 support already in the code?

[koreth]

I thought I'd go add base64 support, but it looks like it's sort of already there; I see base64 conversion functions in several of the hash-function .js files. Is base64 support planned for the 0.6 release?

Yeah, I realize it's highly unlikely anyone will guess a hash-generated password even if it's in hexadecimal. But I guess it takes a certain amount of paranoia to even want to use a program like PasswordMaker in the first place, so I figure why not put on the jumbo tinfoil hat?

[Eric H. Jung]

ROFL.

Yes, support for Base64 is already in the hash algorithm code. But it's not in the UI or persistence code, which is why it hasn't been available yet. Both Base64 and Base95 will be available in 0.6.1, due out very shortly (a few days) after 0.6. I don't want to hold up 0.6 any longer than necessary.

Base95 support is also on the way using a derivative of this function by David Finch.

Code: [Select]

//nearly all typable characters
var base95=
  "`1234567890-=qwertyuiop[]asdfghjkl;'\\zxcvbnm,./~!@#$%^&*()_+QWERTYUIOP{}ASDFGHJKL:\"|ZXCVBNM<>?"
function getFiltered(binarray,chars) {
    var m=chars.length;
    var s="";
    for(var i=0;i<binarray.length;i++) {
  var k=binarray[i] & 2147483647;
  while(k) {
      var c=k&127;
      k>>=8;
      if(c>0 && c<=m) {
    s+=chars.charAt(c-1);
      }
  }
    }
    return s;
}



[koreth]

Any news on the base64/base95 front? 0.6 looks great but I'm starving for the letter G!

[Eric H. Jung]

Hi Koreth,

Here's the news and the reason for the delay. Adding Base32, Base64, and even Base95 support isn't terribly difficult. What I'm doing, however, is adding support for any character set. You'll be able to choose from preset character sets (like Base16/32/64/95), or define your own -- the minimum being two characters.

This provides maximum flexibility, and also fulfills one of the other feature requests: the ability to eliminate certain characters from passwords (some sites don't allow special characters in passwords, for instance).

Morever, this will allow people to use non-English characters such as characters with accents, umlauts, tildas, and other things (e.g., Ð Ñ, Ã’,Ó    Ã”, Õ, Ö, Ø, Ù, Ú, Û, Ãœ, Ý, Þ, ß). It might even work with non-ISO-8859-1 characters, although I'm not sure yet.

Unfortunately I won't be able to work on the extension this weekend, otherwise I'd have this completed by Sunday evening.   :(

Look for it next week... that's the best I can do. Sorry for the delays :(

-Eric

[koreth]

No problem, just wanted to know how I should set my expectations! Sounds like you're taking the time to do it right rather than hacking something together quickly. I'd much rather wait a little longer to get a better result.

And I should add that I'm so anxious to get it because this software rocks. Aside from the pure convenience factor, anyone who uses it to generate all their passwords will automatically be immune to most phishing techniques. A human might mistake "paypa one" for "paypa L" but a hash function never will, and it won't be fooled by Unicode glyph spoofing either.

Won't surprise me at all if your code ends up being folded into Firefox at some point, because it's the best implementation of the idea I've seen and the idea is such an obvious improvement over traditional password vaults.

There, how's that for kissing up? :)

[Eric H. Jung]

Koreth, I have 0.6.1 beta available with this feature. If you want to try it, email me directly.

-Eric