simontabor

What does this do that calm.com doesn't do better?

it really, really isn't

Apologies for the lack of support on the chart, SVG rendering is terrible in Firefox.

If you click on the 'Day' view and then 'Show only Mavericks' you can clearly see a rise from 0.20% at 7pm yesterday up to almost 10% at 5pm today. The other lines have had a slight decrease, but yes it does look like Mountain Lion users are upgrading fastest. I'd be surprised if Leopard/Tiger users upgraded quickly as I'm sure they'd be apprehensive of updating their old and potentially fragile kit.

I still don't think you get the idea. Using 'the old lemon man jumped high as a pokemon' across multiple services may be secure from someone trying to hack just you, but it's much more likely that one of those services will leak your password (security flaw of some kind) and will therefore compromise your password across every service.

You could easily just use 'servicename||this is my secure password' as your password, but it's still obvious what the pattern is to anyone who obtains that password, rather than getting 404fC7C426Cb6cD694E6C2Ee828c133fA771AcC8. You should be able to leave your password and email address in public places without anyone being able to have any significant effect on your security (they might gain access to one service).

I may do, it's not too difficult for people who care about it to just take it out - I'd actually rather people take the code, remove tracking if they'd like, edit colours/whatever and make it their own. It's more the concept that I care about (never ever send your main password over the wire)

That's a decent idea, appending/prepending the service name to the hash would probably help.

Yes, but it's by far the lesser of two evils. You can easily take a substring of the generated password.

How would you randomise the length of the password in a repeatable + secure manner?

Sounds like you've misunderstood the purpose of this.

I usually just use a single password across most services, so they all know your password, even if you trust them not to store it in plain text. It's infinitely more secure to use something like PW, never entering your main/master password into any other services and then have a generated hash that really means nothing to anyone (can't be decoded or anything stupid). The length factor here makes very little difference, and only you need to know that you use 40 character password (yes, 40, which I bet is longer and more secure than your current password(s))

It's a repeatable SHA1 hash, what more do you want?