43M passwords hacked in Last.fm breach

Post by pjc50 » Fri, Sep 02, 2016, 11:59 AM UTC

jcrites wrote: post #77

grrowl wrote: post #60

Earlier quoted context omitted.

Emailing a single-use "sign in link" to a user (Slack calls these "Magic Links") is the way forward. Yes, it move the single point of failure to the user's email account, but expecting the regular user to use (and remember) unique passwords for each service is impossible -- they simply won't do it. Plus, when/if your service is breached, you won't compromise all their other accounts as well.

It's really a shame that we haven't solved this problem yet as an industry. I was thinking we could build a general purpose version of "Magic Links" for logging in, where the format of the email is well-defined, and the user's browser is able to receive these messages on their behalf through some form of integration. You could imagine a webmail provider offering some kind of polling or websocket API for listening for…

Post by lquas » Fri, Sep 02, 2016, 12:08 PM UTC

finchisko wrote: post #122

The tragicomic part is how they enforcing password complexity: Your password is not strong enough. New passwords must: Be at least six characters long Contain one or more numbers Include at least one of the following special characters: !"#$%&'()*+,-./:; ?@[\]^_`{|}~, or a space So password efZeLmur3ivio4t7 is not safe enough to be used by last.fm and they use md5 without salt to protect it?

Post by nommm-nommm » Fri, Sep 02, 2016, 12:27 PM UTC

GolDDranks wrote: post #25

dogma1138 wrote: post #21

Earlier quoted context omitted.

Password managers already do that, they just check for password type field and the site. Keepass does that pretty sure all the others also do. But again what problem are you trying to solve? using password managers is easy as pie today including automating signup and generating passwords, most people do not use them.

I started using LastPass just the other day because the recent news made me nervous. It's NOT easy. The interfaces are clunky. I have to pay to get some basic features like browser plugin. There's a lot of false positives (it suggests me sometimes to save a password even if the field is not for passwords.) Generating secure passwords is hard because some sites validate length and charset only serverside and the poor…

Post by nommm-nommm » Fri, Sep 02, 2016, 12:29 PM UTC

GolDDranks wrote: post #107

toomanybeersies wrote: post #42

Earlier quoted context omitted.

I'm using lastpass and I haven't had to pay for the browser plugin. I've been using lastpass for the past year or so, and I've had no real issues with it ergonomics-wise. I can't even think of any sites off the top of my head that have given false positives. It does seem painfully slow and unresponsive sometimes though, which isn't ideal. It's slow enough to disrupt my flow more than just typing in the same password…

I could use the plugin for a trial period, but now it says that I have to be a premium member? Maybe it's because I also installed the app to my smartphone, thus my smartphone become the one device I can use the free version with?

Post by cuu508 » Fri, Sep 02, 2016, 12:33 PM UTC

dogma1138 wrote: post #45

whorleater wrote: post #32

Earlier quoted context omitted.

Automatic password changing would be a mess if you ever got locked out of your password manager, combined with the fact that if the protocol for password changing was to be breached, you'd be locked out of that account as well.

The protocol isn't any different than it is today you need to know the account and the current password, there isn't anything more to breach then today it's no different than any password change form. If you get locked out of your password manager you are already fucked. And in any case It doesn't prevent users from reseting a password manually directly on each site.