481–490 of 557 posts
Earlier quoted context omitted.
Anyone know of an open source Firefox extension that can do this?
I don't, but would the extension in-effect need to have all your passwords too? Since I don't know of any battle tested (multiple very bad vulnerabilities exposed in public) password managers that offer this other than LastPass, I say check out the public opinion of that extension.
How is it possible for Hashcat to crack a 20 character long random password in 6ms? That is mind boggling. I thought he was just going to hash the password and see if it fit the leaked hash, but no, it looks like he actually did the reverse and cracked the hash to see if it fit the password, right? Edit: oh it looks like he provided the password to hashcat in the form of a psudo 'dictionary' to use. So Hashcat was no…
He did it in a way that appears more complicated to people using Hashcat not as often as he probably does.
Hashcat used the real password as a single-entry password dictionary. So in order to "crack" the hash, it grabbed the first and single entry from its dictionary, hashed it, ... match!
Don't worry, this has been confusing to me and several people in the comments section on his website as well.
Dropbox is about the only service I use a memorable password for, as it has my 1Password file in it, which has my Google one-time-auth codes in it. If I lose my phone while on the road, only remembering my Dropbox password is going to get me out of the mess. Any sensible other solutions here? It's still ~14 characters, but other than making it more random, what are my options?
Are 1Password's files not encrypted? Store it publicly on your web site, email it to your friends, print it out in base64 in a machine-readable font and keep copies pinned on the wall of your cube. You still have to remember one password but at least you're depending on crypto instead of Dropbox's security.
@dang Can we please change the URL to not have the query parameters?
Earlier quoted context omitted.
A rough estimate for using spot instances on EC2 says you can get maybe 40 trillion SHA1 hashes per dollar. (700MH/s and just under $.07/hour) So one dollar will crack a password 7 characters long. A million dollars will crack a password 10 characters long. Switch to bcrypt and you're now at 25 million hashes per dollar on those same instances. Now you can barely crack passwords that are 4 characters long, or for a m…
Pro tip: Build your own GPU cluster out of consumer gear. It's orders of magnitude cheaper because GPUs for the data center are expensive and/or slow. Our commercial cracker is consumer gear in a custom built chassis in colocation. Cloud GPU just isn't there yet.
Earlier quoted context omitted.
IIRC encryption and decryption is done on the client side and the server only stores encrypted data. Dropbox was not encrypting passwords they were hashing them. If you stored already encrypted files on Dropbox nobody can decrypt those files provided your encryption key is good.
> Dropbox was not encrypting passwords they were hashing them. Incorrect.
I'm pretty sure you're going to say "they do TLS" and then the person you're talking to can go ahead and explain that the encryption LastPass/1Password does protects an entirely different threat model, but unless you have a conversation here no one is going to be able to communicate a thing.
Earlier quoted context omitted.
That's a solid point. I've generally avoided password managers because not knowing my (unique-per-service, strong) passwords makes me nervous in exactly the same way as not actually knowing the phone numbers of the most important N people in my life.
You'll get over that little hurdle once you realize that you can dump the anxiety of remembering a hundred password variants for different sites. And realistically speaking, you're probably not even using a hundred variants...or possibly even 10. If you're memorizing passwords, chances are your re-use frequency is nonzero. What's important is to keep a backup of your password database in a few places. I use KeePass b…
Dropbox should absolutely be held to the flame for trying to downplay the severity of this. Their communication says 'This is purely a preventative measure', but if you had/have reused this password on any other sites (let's face it a huge proportion of non tech savvy people do this) then your entire online presence may be exposed.
Non tech savvy? Everyone does this. It's practical. Sure most of us have a few passwords we reuse, but I know less than 5 people with truly unique passwords.
Earlier quoted context omitted.
Haha for me it's the opposite. My password never works in Dropbox. I think it's because they don't support spaces in passwords, but they don't tell you when you change your password. They just accept the change and then you can't login.
There are many sites with little exceptions like that. I think that their password filter allows the characters, but their backend input sanitization doesn't, so it cleans it up and inserts a transformed version of the pass without providing notification. I've found this happens particularly often with passwords with symbols like !, #, or ;.
I wonder if there has ever been an attempt through a forum like RFCs or ISO to define a worldwide (or at least latin char set) standard for password requirements. Based on what i've seen in forums like this, there seems to be fairly broad acceptance that allowing a large number of characters from a character set with as few limitations as possible bests serves the interest of security. The thorniest issue would likely be about balancing requirements for increased complexity (eg capitals and lowercase, numbers, etc) with ease of use.
Earlier quoted context omitted.
For credit cards, check out privacy.com I recently started using it, works great.
geez, privacy.com, I wonder how much that domain cost. I'm using a card from getfinal.com, which appears to be the same idea. So far so good, though it's not 100% disposable, I still have a plastic card who's number is no easier to change than a chase card.