Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

networkworld.com

Post reply on HN
Print view View original

51–60 of 96 posts

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#51

Post by crazygringo »

sprash wrote: post #46
fredley wrote: post #37

Earlier quoted context omitted.

This suffers from the same problem as the article's algorithm: it is fine until you need to change one of your passwords. Say a site gets compromised, or for whatever reason you need to change your password. Now what? You need to change all your passwords in order to be able to use this method, or you need to remember one different password, or remember that you need to do .2 or something. Either way, you're back to…

> it is fine until you need to change one of your passwords For me, this happens less often than once a year. And then it is a good idea to change all passwords anyway. The alternative is to store passwords somewhere in a password manager. However if this storage gets somehow lost/compromised ALL of your passwords get lost/compromised.

I had my mail account "suspect" a compromise 4 times in 2 months (no idea what triggered it) and forced me to change my password 4 times.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#54

Post by redblacktree »

oniony wrote: post #39
jeremysmyth wrote: post #4

This method fails as soon as you have to change a password: - One of the sites is compromised - One of your devices is stolen/lost and you have to change some passwords - One of the sites has a password expiration policy Pretty soon you end up with multiple password schemes and you're in precisely the same situation as before, wondering which password goes with which site, only this time you have to perform algorithm…

Even if none of the sites are compromised; even if your device is not stolen or lost; even if the sites don't use password expiration it doesn't work very well because some sites are just plain stupid with their password restrictions. Some of the things you'll face: • Passwords that prevent double characters within the password: not ideal when using a scheme. • Passwords with a minimum/maximum length: I've seen sites…

> maximum length

This one really grinds my gears because it also indicates that they're most likely storing your password in the clear. Hashes are all the same length.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#55

Post by wrsh07 »

drinchev wrote: post #13

I try to ignore articles like this and I'm surprised that this was written in 2015. As @jeremysmyth noted this method is flawed. There's no solution for passwords today, better than the password manager. People reading this article, should not consider Manuel Blum's idea as use-worthy.

A good solution to the lack of security in passwords is 2 factor authentication, though.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#56

Post by msellout »

redblacktree wrote: post #54
oniony wrote: post #39

Earlier quoted context omitted.

Even if none of the sites are compromised; even if your device is not stolen or lost; even if the sites don't use password expiration it doesn't work very well because some sites are just plain stupid with their password restrictions. Some of the things you'll face: • Passwords that prevent double characters within the password: not ideal when using a scheme. • Passwords with a minimum/maximum length: I've seen sites…

> maximum length This one really grinds my gears because it also indicates that they're most likely storing your password in the clear. Hashes are all the same length.

Or worse, if they ask you to type your password into a phone keypad (eg. the 9 button stands in for [9w-zW-Z] and 0 for all punctuation). Not only does this mean they're storing your password in plaintext, but reducing the character set to just 0-9.

A major financial company does this, of all the terrible places.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#57

Post by surlyadopter »

Articles like these always remind me of this fantastic essay by James Mickens and his "Mossad/Not Mossad" concept.

http://files.catwell.info/misc/mirror/mickens-usenix/thiswor...

"“But James,” you protest, “there are many best practices for choosing passwords!” Yes, I am aware of the “use a vivid image” technique, and if I lived in a sensory deprivation tank and I had never used the Internet, I could easily remember a password phrase like “Gigantic Martian Insect Party.” Unfortunately, I have used the Internet, and this means that I have seen, heard, and occasionally paid money for every thing that could ever be imagined. I have seen a video called “Gigantic Martian Insect Party,” and I have seen another video called “Gigantic Martian Insect Party 2: Don’t Tell Mom,” and I hated both videos, but this did not stop me from directing the sequel “Gigantic Martian Insect Party Into Darkness.” Thus, it is extremely difficult for me to generate a memorable image that can distinguish itself from the seething ocean of absurdities that I store as a result of consuming 31 hours of media in each 24-hour period."

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#58

Post by tekism »

jeremysmyth wrote: post #4

This method fails as soon as you have to change a password: - One of the sites is compromised - One of your devices is stolen/lost and you have to change some passwords - One of the sites has a password expiration policy Pretty soon you end up with multiple password schemes and you're in precisely the same situation as before, wondering which password goes with which site, only this time you have to perform algorithm…

Just add a "2" to the end of the existing password, duh.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#59

Post by burkaman »

sprash wrote: post #27

Why not use a base64 encoded sha1 hash of your password salted with the web address like this: #!/bin/sh #usage: webpass.sh website=$1 stty -echo read -p "Password: " password echo stty echo echo -n "$website" | openssl sha1 -hmac "$password" | cut -d" " -f2 | xxd -r -p | base64 | tr -d -c "[:alnum:]" echo At least this is somewhat cryptographically secure.

Because your bank probably limits you to 10 characters or something, and your insurance company requires at least one special character, and now you have to remember a bunch of special cases and you start wanting a password manager again.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#60

Post by keypusher »

raverbashing wrote: post #15
drinchev wrote: post #13

I try to ignore articles like this and I'm surprised that this was written in 2015. As @jeremysmyth noted this method is flawed. There's no solution for passwords today, better than the password manager. People reading this article, should not consider Manuel Blum's idea as use-worthy.

Password managers have a central point of failure, either it's breached or its password/data is lost I can trust a password manager, but I would keep an offline physical backup, and they're not the 'ultimate solution'

Using two-factor authentication with your password manager helps mitigate the risk. Online managers such as lastpass only keep encrypted versions of your passwords, and they do not know your master pw to unlock that vault, so even if they get breached (which has happened), the attacker just has a bunch of encrypted passwords.
Post reply on HN