Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn password leak

usblog.kaspersky.com

Post reply on HN
Print view View original

211–218 of 218 posts

Re: LinkedIn password leak

#211

Post by cyphar »

kazinator wrote: post #209
cyphar wrote: post #168

Earlier quoted context omitted.

"crypt" = "cryptographic hash" != "encryption". Not to mention that someone might get the wrong idea and decide that encryption (or single-round hashing) is good enough.

https://www.freebsd.org/cgi/man.cgi?crypt%283%29 NAME crypt -- Trapdoor encryption Linux man page: NAME crypt, crypt_r - password and data encryption Solaris 10 man page: NAME crypt - string encoding function Darwin: DESCRIPTION The crypt() function performs password encryption ...

To be fair, "trapdoor encryption" == "hash".

Re: LinkedIn password leak

#212

Post by tudorw »

tudorw wrote: post #191

I've read zero reports of people breaking into houses, finding a piece of paper down the back of the cabinet with lots of passwords on and no site names, then using those passwords randomly to gain access to an unknown system... A 'software' or 'online' password manager seems like a terrible idea, all your eggs in one convenient basket, if Sony and VISA and the NSA are unable to secure their systems 100% of the time…

Maybe using a password manager is better than using the password "wizard007" everywhere, including your HN account.

:P

//not-tudorw

Re: LinkedIn password leak

#213

Post by warrenpj »

daenney wrote: post #208
unlinker wrote: post #204

Earlier quoted context omitted.

If they can hack into your mail they can reset your password anyway. (I'm not being technically correct here, but I'm being practical, and my argument here applies to 99.9999% of all cases)

It's not about hacking your email even. A significant amount of SMTP traffic still goes around unencrypted so just seeing that traffic fly by is enough to get the password.

A one-time password system should also have a second token that was sent to the browser as a cookie over SSL. When the link is clicked the browser sends both tokens (the cookie and the OTP) together. The password is only valid for one browser. Also the OTP should expire after a short time. [1] It has the same security properties as a federated identity service like OpenID (except that it is less vulnerable to phishing.)

Of course if you're talking about just a normal plain text static password, then it's obviously wrong to see it in an email.

[1] "Simple Authentication for the Web" (2007) https://isrl.byu.edu/pubs/saw_TechReport%20%28revised%20Marc...

Re: LinkedIn password leak

#214

Post by ben_jones »

yoha wrote: post #182
zamalek wrote: post #172

Earlier quoted context omitted.

Or, better yet, a password manager. If you aren't using one yet, now is a great opportunity.

I agree that password managers are great. They let you use completely different passwords for each service, efficiently mitigating any compromise. Also, they tend to encourage you to use actually random passwords (using a generator). However, most users will not bother, and getting them to use at least decent passwords would be a great step forward. Additionally, you still need a master password for your password man…

Also you can't really rely on a free password manager (which is what users will generally select) to be a long-time solution. Either because they go out of business, change their monetization model, get hacked, whatever. It's one of those things that sounds good, but in reality is unable to gain critical mass for human reasons.

Re: LinkedIn password leak

#215

Post by tudorw »

tudorw wrote: post #212
tudorw wrote: post #191

I've read zero reports of people breaking into houses, finding a piece of paper down the back of the cabinet with lots of passwords on and no site names, then using those passwords randomly to gain access to an unknown system... A 'software' or 'online' password manager seems like a terrible idea, all your eggs in one convenient basket, if Sony and VISA and the NSA are unable to secure their systems 100% of the time…

Maybe using a password manager is better than using the password "wizard007" everywhere, including your HN account. :P //not-tudorw

fair point :)

Re: LinkedIn password leak

#216

Post by [deleted] »

tudorw wrote: post #212
tudorw wrote: post #191

I've read zero reports of people breaking into houses, finding a piece of paper down the back of the cabinet with lots of passwords on and no site names, then using those passwords randomly to gain access to an unknown system... A 'software' or 'online' password manager seems like a terrible idea, all your eggs in one convenient basket, if Sony and VISA and the NSA are unable to secure their systems 100% of the time…

Maybe using a password manager is better than using the password "wizard007" everywhere, including your HN account. :P //not-tudorw

[deleted]

Re: LinkedIn password leak

#217

Post by tudorw »

tudorw wrote: post #215
tudorw wrote: post #212

Earlier quoted context omitted.

Maybe using a password manager is better than using the password "wizard007" everywhere, including your HN account. :P //not-tudorw

fair point :)

while obviously fairly painful, am assuming that came from the Stratfor list ? While I concede a piece of paper is far from secure, I'm human and what I do others do too, I would have faired better had I followed my own advice. Conveniently your point does re-inforce they key aspect of my comment, that if Stratfor, a global intelligence company, can fall foul of security then there really are very few safe ports to rely on harbouring your secrets ;) Btw, thanks for not locking me out, gentlemanly of you.

Re: LinkedIn password leak

#218

Post by zeveb »

savanaly wrote: post #82
zeveb wrote: post #72

Aaaand that's why I use 'pwgen -s 22' to generate a unique password for every single site I use. I don't care if a salted password database is stolen; heck, as soon as I change my password I don't even care if a plaintext database is stolen. Why -s? Because it means each password is a complete word, and may easily be double-clicked in a password list (which is nice, because selection is copy in X). Why 22 characters?…

How do you track those passwords? I presume not with a password manager otherwise it would be creating your passwords for you. Do you keep them in a text file on your computer or write them down and carry them around with you or something?

I store them in an encrypted file on my computer: the encryption password is memorable, but since I have physical control of my computer (I hope!) I think the security tradeoff is a win. Rather than many memorable-but-guessable passwords scattered across numerous services, I have one memorable-but-guessable password (well, passphrase) securing a file I control.

Writing them down would probably be even better.

Post reply on HN