Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Stole My Website

medium.com

Post reply on HN
Print view View original

141–144 of 144 posts

Re: Hackers Stole My Website

#141

Post by passivepinetree »

emanreus wrote: post #91
passivepinetree wrote: post #34

As others have noted, her advice seems to be a little suspect. I took issue with the following: > Your password should not contain “real” words (and definitely not more than one real word in immediate proximity, like “whitecat” or “angrybird”), and should contain capital letters, numbers and symbols. The best passwords of all look like total nonsense. Isn't it generally accepted that the XKCD-style "correct horse bat…

One downside of xkcd style passwords is that they are not accepted everywhere. Many websites have a list of characters you must and must not include in your password.

Right, but a good password manager (like 1pass) will have both options available to generate so you can do XKCD-style where possible and randomly generated characters elsewhere.

Re: Hackers Stole My Website

#142

Post by Gaelan »

el_benhameen wrote: post #131
Gaelan wrote: post #116

Earlier quoted context omitted.

I use iCloud Keychain. Works well as long as you use safari, which is admittedly uncommon.

Yeah, I tried really hard to make Safari my default browser in order to use keychain. Keychain itself was great, but safari just didn't cut it for me. Their devtools equivalent is terrible, and I didn't like running two browsers. I was bummed to lose keychain, though.

Huh, I find safari's devtools much more useful than Chrome's, though I admit I am more used to it. What annoys you about Safari's dev tools?

Re: Hackers Stole My Website

#143

Post by Gigablah »

id122015 wrote: post #118
striking wrote: post #100

Earlier quoted context omitted.

2FA isn't hard to use, and is barely inconvenient. How often do you log into your email, anyway? Also, if you lose your phone, you can make use of your recovery code.

The reason I mentioned about loosing phone was not related to email recovery but the fact that I did not learn the security lesson of not using a PIN to protect my data. After I have read this post I wanted to actually enable 2FA right now, but then I discovered that breaking news, terror attack, and again I postponed, the same like I postponed securing my phone with a PIN.

Have you enabled 2FA yet?

Re: Hackers Stole My Website

#144

Post by BrandoElFollito »

zeroxfe wrote: post #83
sly010 wrote: post #63

Earlier quoted context omitted.

> This password is then destroyed by both parties. I don't quite understand this. Won't the email client need the need the password every time to auth with IMAP?

Some IMAP providers like Gmail use a more sophisticated auth mechanism where a secret token is shared over the encrypted link after the first password auth. This token typically has a long lifetime and is used for future sessions.

I have never heard of that, do you have any sources?
Post reply on HN