21–30 of 171 posts
Earlier quoted context omitted.
What risk is there to estimate? Assume that the attackers have the clear text of your password, and know that it's your password.
Would be nice if they told us how they hashed it or if they hashed it at all. If the passwords are bcrypt then it wouldn't matter if an attacker got that hash.
As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
I'm using LastPass with a 2FA Yubikey token. In addition, I try use different E-Mail adresses whenever I sign up, a catchall makes sure they end up in the same inbox. This might not stop a sophisticated targeted attack, but it should throw off a lot of automated runs since the email they got is seemingly not used at another service. A litte obscurity to strengthen the rest of my security ;)
Earlier quoted context omitted.
I'm using LastPass with a 2FA Yubikey token. In addition, I try use different E-Mail adresses whenever I sign up, a catchall makes sure they end up in the same inbox. This might not stop a sophisticated targeted attack, but it should throw off a lot of automated runs since the email they got is seemingly not used at another service. A litte obscurity to strengthen the rest of my security ;)
How does the Yubikey work? Do you have to plug it in every time you want to sign into a site?
As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions. For 2FA I use either SMS or Authy https://www.authy…
As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
echo "secret123|google" | sha1sum
echo "secret123|facebook" | sha1sum
EDIT: it is best to write a script for this
How user friendly is guacamole? Anyone have any experience setting it up for non techies?
However, not having used it for a prolonged period, I don't know what the time investment for maintenance will be.
It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Maybe it's because of changing IP addresses and domain names? The cost of this service seems to be slightly more than the cost of maintaining your own domain name.