HashMask : Help

About HashMask

HashMask is a browser extension for your password fields.

It's meant to help prevent some errors when logging into various websites. It does this by giving you a consistent sparkline representing your passwords. On any site you visit with a password field, start typing, and a little colored sparkline will appear. This is your clue - try and remember something about the color, shape, or both. Before you know it, your login error rate will drop immensely.

Of course, it's just an aid - if you can't remember all your sparklines, don't worry about it! It's just a visual aid. Use it, or not, however you want. Perhaps only remembering one or two really important sparklines for a password you forget or mistype often would be useful, or perhaps you can try to remember all of them. Either way, it's up to you.

Frequently Asked Questions

We have here some questions you might be thinking. As we notice more, we'll go ahead and update this list.

Q1 - How could I possibly memorize all these sparklines?

Well, you don't have to, really. As we said in the intro, they're just meant to be aids. Remember some of, or all of, your personal sparklines, whatever works for you. We don't store or change anything about passwords sent to the website you're on, we only make a visible change in your browser.

Q2 - Couldn't someone guess my password from these sparklines?

Not really. See, by default, we generate a random salt for you. Any password you type into any site is combined with that random salt, then hashed, and then converted to a visual sparkline. So an attacker (that guy looking at the sparkline over your shoulder) would have to have both a perfect replay of your visual hashes and your salt to be able to reproduce your password. There are much easier methods to attack a victim, so HashMask really doesn't make you any more vulnerable to any attacker.

Q3 - Is there a maximum number of attempts that I can make?

No, you're free to try any number of combinations with HashMask. You press a key, and we'll update your sparkline. That's it. The security comes from the random salt that we generate for you and your browser keeping addons in an isolated world. Not to mention a few extra options to make it yet harder for an attacker to duplicate your HashMask settings.

Q4 - I found a problem!

Dang, guess our code's not perfect. File an issue for us, right here on github. If you don't have a github account, you can contact the main developer directly wyantb@gmail.com.

Q5 - I'm a web developer. Can I include HashMask on my site?

Well, technically, you could. We don't suggest it, however. See, we want you to recall the salt that we generate for every user. That's the key to the security of HashMask. There's really no good way for an individual site to generate a salt for each user, so we wouldn't recommend trying it. Furthermore, consider user choice - some people could just find it irritating, maybe it slows down their browsing experience, or maybe they just use KeePass or other similar software to manage their passwords already.

Other Help Articles

What does a salt do?

As always, Wikipedia has some pretty good information on salts.

In the case of HashMask, we use it to provide an attacker even more difficulties in guessing your password. Even if they can replay each image of your sparkline, without the salt that we generate for you by default, they can't get your password.

We should make special note that your salt will, by default, be different on different machines. Each time you download HashMask onto a different browser, we will generate a new salt for you. If you want to use HashMask on different browsers or computers, we advise manually copying your salt into those other browsers/machines. This only needs to be done once, so it's not too bad.

What does a delay do?

Pretty simple, actually. It represents, in milliseconds, the amount of time lag that occurs before your hash appears.

We use a default lag of 0ms, so the HashMask should appear as soon as your computer can compute the hash. Still, if you want to remove your salt or something, you can still prevent eavesdroppers from figuring out your password by delaying the image hashes that appear.

What is a hash algorithm?

As always, Wikipedia has some pretty good information about hash algorithms.

In the case of HashMask, we use it to provide you more options. If you select a different hash algorithm than the default (SHA-256), it's even harder for an attacker to guess your password, since they can't even be sure of which algorithm you're using.

We make special note of one factor: SHA-1 is the fastest algorithm. If you're noticing speed problems on any website after installing HashMask, you might try switching to that algorithm (just click the SHA-1 radio button in the options page).

About RIPEMD-160

I'm no cryptologist. I'll bat this answer off to Wikipedia and TrueCrypt.

If you are knowledgable in such matters, and would like to check our implementation, that can be found here. It's minimized, however, so you may want to check out the original source, linked here.

About SHA-1

I'm still no cryptologist. I'll bat this answer off to Wikipedia.

We'll add a special note that if you're having performance problems with HashMask, this algorithm is probably the best option for you.

In any case, if you are knowledgable in such matters, and would like to check our implementation, that can be found here. It's minimized, however, so you may want to check out the original source, linked here.

About SHA-256

Still not a cryptologist. I'll bat this answer off to Wikipedia and TrueCrypt.

If you are knowledgable in such matters, and would like to check our implementation, that can be found here. It's minimized, however, so you may want to check out the original source, linked here.

About Whirlpool

Cryptologist? Nope. I'll bat this answer off to Wikipedia and TrueCrypt.

If you are knowledgable in such matters, and would like to check our implementation, that can be found here. It's minimized, however, so you may want to check out the original source, linked here.