A computer-implemented method for generating passwords, wherein a user accesses by means of a first computation device, for the first time, a webpage or website identified by a web domain that requires an identification, by means of credentials including a user identifier and a password, of said user on said webpage or website, the method being characterised in that it comprises generating said password required by the webpage or website by means of performing the following steps:
- intercepting, by said first computation device, insertion of the credentials, when the user accesses said webpage or website;
- retrieving, by the first computation device, information referring to said web domain and said user identifier;
- generating, by the first computation device, a local signature (local Domain Signature), which identifies the domain that possesses the requested resource;
- checking, by the first computation device, if there is already a record for said web domain and for said user identifier in a database of the first computation device, and checking if a cryptographic value (Id_Hash) is different from zero;
- sending, by the first computation device, if a the result of said checking was false, information referring to the web domain and the user identifier to a remote server, so that the remote server generates a Domain Signature for that web domain;
- receiving, by the first computation device, from said remote server, the generated Domain Signature and generating a random value for said Id_Hash;
- and
- checking, by the first computation device, that the Domain Signature received from the remote server matches the local Domain Signature generated previously, and if they match, generating a necessary input so that a password generator module generates the password required by the webpage or web service by means of performing the following actions:
- i. requesting, by the first computation device, that the user introduce a master password (Master-Pass) into the first computation device;
- ii. executing, by the first computation device, a cryptographic mathematical function on the user identifier, the web domain identifier, the Id_Hash, the local Domain Signature and the requested Master-Pass, resulting in an encrypted value that is concatenated with password policies related to the cited domain;
- iii. sending, by the first computation device, the information resulting from said concatenation to said password generator module so that the password generator module generates the password required by the webpage or website by implementing a computational algorithm that uses the Master-Pass and the Id_Hash;
- and
- iv. receiving, by the first computation device, the password generated by the password generator module and directly, without storing it, inserting it into the webpage or website;
- accessing, by the user, the webpage or website with a second computation device, wherein said second computation device is synchronised with the first computation device through the introduction of a one-time password (OTP) into the second computation device, said OTP having been generated and transmitted to the second computation device previously by the remote server;
- sending, by the second computation device, the OTP to the remote server so that the remote server performs latter may perform the validation of the OTP;
- receiving, by the second computation device, if the result of said validation was correct, an encrypted message from the remote server,
- wherein said encrypted message includes said OTP and data associated with the webpage or website encrypted by means of the use of the Master-Pass, and
- wherein said data includes the user identifier, the web domain identifier and the Id_Hash;
- and
- requesting, by the second computation device, that the user introduce the Master-Pass in order to decrypt the contents of said encrypted message.