1. I don't want a single point of failure, though I suppose an email account fulfills that role no matter what you're using. My email account password is 30-34 characters long.
2. I use multiple computers, multiple OSes, sometimes not owned by me, and sometimes multiple browsers.
3. Many accounts I couldn't care less if they got compromised; they get the same password as each other, which is still complex.
> hashing your master password with SHA-256, encrypting the result a default of 6000 times with AES, and then hashing it again
Any crypto-geeks around to say whether this makes it more secure or less? I've heard it said many times that multiple encryptions and hashings can actually make the encryption weaker.
Using KeePass + Dropbox + local copies of the passwords db makes it so that even if Dropbox goes out of business, you'll still have your database. Dropbox and KeePass (well at least variants thereof) all run on Linux, OSX, Windows, and Android. On the issue of computers not owned by you, you shouldn't be entering your passwords on untrusted computers to begin with, but if you must, KeePass works right off a USB drive.
> Many accounts I couldn't care less if they got compromised; they get the same password as each other, which is still complex.
Sign up on mywebsite.example. I now have the password to (depending on what accounts you couldn't care less about) your Facebook, Twitter, Hacker News, etc. accounts and can ruin your reputation by spreading false information.
In this context (key derivation), repeatedly applying a computationally expensive function is apropriate and standard practice. It's called "key stretching".
See the PBKDF2 algorithm for a standardised example.
I've heard this as well so I whipped up a quick Ruby script that hashes a numbers of strings over and over, let it run for a few days on a quad-core machine and found zero collisions. I tested MD5 and SHA-1. It may weaken the hash a bit but it also makes the algorithm slower which means it's harder to brute-force.
1Password + Dropbox means your passwords will be secured on multiple locations: your computer, iOS devices, and dropbox ... and there's even a neat html version as well.
1. I don't want a single point of failure, though I suppose an email account fulfills that role no matter what you're using. My email account password is 30-34 characters long.
2. I use multiple computers, multiple OSes, sometimes not owned by me, and sometimes multiple browsers.
3. Many accounts I couldn't care less if they got compromised; they get the same password as each other, which is still complex.
> hashing your master password with SHA-256, encrypting the result a default of 6000 times with AES, and then hashing it again
Any crypto-geeks around to say whether this makes it more secure or less? I've heard it said many times that multiple encryptions and hashings can actually make the encryption weaker.