101–110 of 171 posts
Earlier quoted context omitted.
How do you generate new emails? Say, I see a new websites I need a new email? What do you do? Is there a chrome extension that can do it with one click?
Gmail doesn't need any config. Add whatever you want to your usual email after a + and it'll just work
Earlier quoted context omitted.
In the example of wanting to access a computer in your home, you can implement this fairly easily using entirely free software with VNC-over-SSH, but it's depending on having a public IP address and open port on your home NAT/router. One of the main reasons that things like gotomypc and teamviewer have been successful in the market is the huge number of people who don't know how to/don't care to take the time to set…
If you're on a Windows system this is even easier. Go to System -> Remote Desktop Connections and check the box to enable incoming connections. On your router, forward port 3389 to the machine you want to access. On any client device running Windows (linux/mac can use FreeRDP, for which there are numerous wrappers) connect to your home's Public IP, and log in with your computer's usual username and password. For the…
Earlier quoted context omitted.
Good idea on (2). I have a gmail account, so I just use myaccount+whatever_service@gmail.com. Pretty handy.
If a lot of people start doing this thing, then it will be trivial for an attacker to figure out name+service1@domain can be changed to name+service2@domain
Another nice property of this suffix is that one can identify who gave away their email address / which site it was scraped from when receiving spam; not sure where I have seen this written down originally.
Earlier quoted context omitted.
Add grep whitelist to your spam filter for some arbitrary extension, e.g. a tld such as '.com'. This way the address can be some-web-app.somecompany.com@yourdomain.tld, you can whitelist *.com@ (or higher up on the subdomain if necessary). Not sure if this would maintain the efficiency of your (or any) spam filter, but it does avoid the '+' character.
In my experience adding the domain of the recipient often leads to problems. Rep: "Can you verify your email address?" Me: "er, em-verizon@example.com" Rep: "Hey, I didn't know you worked for Verizon!" Me: "no..." And now the call gets excruciatingly slow and unfriendly because the rep thinks I'm trying to hack something. Also, more than one web forum has silently binned me until I removed the domain from my email ad…
Earlier quoted context omitted.
But if the trick you are using results in sufficient entropy, it shouldn't matter that the enemy has thought of it too. I'm still a fan of linking common words together as this results in easily-memorized passwords with very high entropy. "Catrunningfishhostagelaptop" is a good password these days. it is easily remember but also difficult to brute force even if you know the trick by which it was constructed. (And yes…
Couldn't I write a bruteforcer that instead of 5 * letters, tried 5 * dictionary words and get your password easily?
For a normal 5 letter (alpha-numeric only) password:
36 factorial, which is (36 * 36 * 36 * 36 * 36) = 60 million possible combinations.
However, for a 5-word password, the calculation is as follows:
Assuming the number of possible words in the English language is 1.025109 million, then:
1,025,109 factorial, which is (1,025,109 * 1,025,109 * 1,025,109 * 1,025,109 * 1,025,109) = A really big number.
So, granted, the amount of possible words is much smaller than that. But the attacker can't know that for sure. To put the number above in scale, just 69 factorial is equivalent to 1.711224524 * 10^98.
As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions. For 2FA I use either SMS or Authy https://www.authy…
I've been using a catch all domain for at least 15 years. One thing I learned early is to use a subdomain, which avoids getting dictionary spam attacks.
For the last many years, I just forward it to a gmail account, where there is a corresponding filter to label it into an "accounts" group. I get essentially zero spam to this.
Also, I've had multiple times where it confused reps as well. It's kind of funny when it happens, but also sad that having "theircompany@sub.my domain.com" makes them go "oh, did you used to work here or something?".
Earlier quoted context omitted.
> It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Very few users can run their own web servers. We used to deploy GoToMyPC for users; it was reliable, performed well, platform independent (including mobile), and secure. I expect it still is. When the new OS or other new tech came out, GoToMyPC handled…
> optional one time pads Any good reason why this wouldn't be the default? Speed + key exchange transmissions, maybe?
It costs time and effort for the users, not only to execute it but to learn it, troubleshoot problems, etc. It would drive many users away; in a business environment especially, that time and effort are rare and precious.
It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Maybe it's because of changing IP addresses and domain names? The cost of this service seems to be slightly more than the cost of maintaining your own domain name.
I run my own web server with a residential ISP and they don't seem to mind. But in places like an office or with really crappy ISPs you just don't have a public IP. I've searched for services that just let you forward out a few ports over SSH but these don't seem to exist. Right now, to get to my laptop I have a raspberry pi "jump box" that sits on the book shelf and my laptop connects to it over SSH and forwards out…
Earlier quoted context omitted.
In the example of wanting to access a computer in your home, you can implement this fairly easily using entirely free software with VNC-over-SSH, but it's depending on having a public IP address and open port on your home NAT/router. One of the main reasons that things like gotomypc and teamviewer have been successful in the market is the huge number of people who don't know how to/don't care to take the time to set…
If you're on a Windows system this is even easier. Go to System -> Remote Desktop Connections and check the box to enable incoming connections. On your router, forward port 3389 to the machine you want to access. On any client device running Windows (linux/mac can use FreeRDP, for which there are numerous wrappers) connect to your home's Public IP, and log in with your computer's usual username and password. For the…