51–60 of 557 posts
Earlier quoted context omitted.
magic link. That's what medium does for email logins, and slack offers the option as well. it's easily one of the safest methods
Ah.. Yes, but that will leave anyone that has somehow gotten access to my mail to suddenly have access to all my accounts then, wouldn't it?
I wonder why the SHA1s don't have the salt. Were they removed so that only the original owners have it so it's easier to crack? Oh well, another HIBP entry with my email address...
Self hosting is my way to go. Had enough of this. > My wife uses a password manager. If your significant other doesn't (and I'm assuming you do by virtue of being here and being interested in security), go and get them one now! 1Password now has a subscription service for $3 a month and you get the first 6 months for free. How about...not? There are tiny open source tools for every OS. You can do it locally, save it…
> Self hosting is the way to go. Because you can secure it better than them? Or because you'll be less of a target?
E.g., I use Resilio Sync (formerly Bittorrent Sync) for file sync with encryption-only keys on my cloud peer. The cloud peer participates in the mesh, providing bandwidth, but if it gets hacked, no one can read the data.
(Of course, I would prefer an open source solution. SyncThing does not have the right sharing model for me. So I was thrilled to hear about LibreVault on HN, which provides functionality similar to BTSync 1.x: https://librevault.com)
Dropbox is about the only service I use a memorable password for, as it has my 1Password file in it, which has my Google one-time-auth codes in it. If I lose my phone while on the road, only remembering my Dropbox password is going to get me out of the mess. Any sensible other solutions here? It's still ~14 characters, but other than making it more random, what are my options?
Self hosting is my way to go. Had enough of this. > My wife uses a password manager. If your significant other doesn't (and I'm assuming you do by virtue of being here and being interested in security), go and get them one now! 1Password now has a subscription service for $3 a month and you get the first 6 months for free. How about...not? There are tiny open source tools for every OS. You can do it locally, save it…
a subscription service for $3 a month and you get the first 6 months for free. ...and now, a word from our sponsors.
50% of the leaked hashes were bcrypt and the other 50% were salted sha1. So, asking the HNers who crack passwords or follow the tech closely and have a good feel: Salted sha1 can be brute forced much quicker, but in practical terms what kind of complexity of password is vulnerable today if it was stored salted sha1 vs bcrypt? And how can this be projected to change in the next couple of years?
The salts for the sha1 passwords weren't leaked. So they're hard to crack in practical terms. Depends how random they were. See hashcat docs and benchmarks for complete answers to your questions. The GPU versions of hashcat.
Is anyone able to make any sense of the GPU hashcat benchmarks that are posted? Something distilled down to "if you spend $xxx, then you can crack any salted sha1 under 12 letters+digits+punctuation in n hours if you knew the salt; if its bcrypt, that would take x hours". Something like that ;)
Added: I'm a bit confused how the attackers know the hash and not the salt though; normally they are stored side-by-side. Or were dropbox using a site-wide salt?
(I've seen systems with a site-wide salt hardcoded into the codebase and a per-user salt in the db with the hash; This means attackers have to compromise both sourcecode and db to get far.)
Why isn't Dropbox reporting this? I'd have more respect for them if they were more honest about this.
Dropbox is about the only service I use a memorable password for, as it has my 1Password file in it, which has my Google one-time-auth codes in it. If I lose my phone while on the road, only remembering my Dropbox password is going to get me out of the mess. Any sensible other solutions here? It's still ~14 characters, but other than making it more random, what are my options?
Earlier quoted context omitted.
Anyone know of automated ways to rotate all the passwords on all of our accounts across the web?
It's a common feature of password managers.
Earlier quoted context omitted.
> Self hosting is the way to go. Because you can secure it better than them? Or because you'll be less of a target?
It's not clear to me whether the grandparent is referring to self-hosting password management or file synchronisation. However, one obvious security advantage of self-hosting is that you can use end-to-end encryption (which most cloud sync services don't support). E.g., I use Resilio Sync (formerly Bittorrent Sync) for file sync with encryption-only keys on my cloud peer. The cloud peer participates in the mesh, prov…