Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Algorithms

penguindreams.org

Post reply on HN
Print view View original

31–40 of 114 posts

Re: Password Algorithms

#31

Post by donald123 »

jpfed wrote: post #24
donald123 wrote: post #21

This is the false sense of security through obscurity. Given the simple algorithm and without any entropy, it will be trivial to crack the password if the hacker has your multiple passwords. This is very possible since you are sticking to the same algorithm for every website but you don't know which website will just store the plain text of the password. One can easily link you among different websites with your user…

This threat only holds for dedicated attackers. 1. They have to have multiple passwords to have a chance to derive the algorithm. 2. They also need to somehow think it's worth their time to reverse the algorithm instead of just going with lower-hanging fruit.

This is not necessarily true. Attackers with multiple sites' passwords can link users and look at their passwords. When they see some similarity of the passwords for the same user, it would take least effort for them to crack the password.

Even if it only applies to dedicated attackers, think about the consequence, once the attacker cracks your password, he knows your algorithm, all your passwords will be exposed.

And the point is the method is not more secure than using the same password for multiple sites.

Re: Password Algorithms

#32

Post by robmcm »

metalliqaz wrote: post #11
gregmac wrote: post #2

> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character. This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do? I use a pa…

How often do you find yourself in a situation where you need to enter a password, but you don't have the password manager on that device? Algorithms have their downside, sure, but for someone like me who is often working on other computers that aren't mine, managers are a non starter.

Logging into a system that doesn't support your password manager, such as games consoles, shared computers, restricted work machines etc.

Copying over a really long generated password is much harder than an algo you can perform in your head.

Re: Password Algorithms

#33

Post by gruez »

genpfault wrote: post #30
gambiting wrote: post #16

Earlier quoted context omitted.

Heh, our HR system had a following requirement: - password must be between 7 and 8 characters long - has to include one number - has to include one of the following: $#!*, no other special characters are allowed It was so horrendously bad it's not even funny.

> password must be between 7 and 8 characters long How do you enter a fractional character?

ranges in english (and probably other human languages) are usually inclusive on both sides.

Re: Password Algorithms

#34

Post by [deleted] »

robmcm wrote: post #32
metalliqaz wrote: post #11

Earlier quoted context omitted.

How often do you find yourself in a situation where you need to enter a password, but you don't have the password manager on that device? Algorithms have their downside, sure, but for someone like me who is often working on other computers that aren't mine, managers are a non starter.

Logging into a system that doesn't support your password manager, such as games consoles, shared computers, restricted work machines etc. Copying over a really long generated password is much harder than an algo you can perform in your head.

[deleted]

Re: Password Algorithms

#35

Post by katastic »

gregmac wrote: post #2

> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character. This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do? I use a pa…

I have BANKS and INSURANCE companies require CASE SENSITIVE, alphanumeric only passwords. It's pure insanity.

Re: Password Algorithms

#36

Post by [deleted] »

AdmiralAsshat wrote: post #28

I'm not sure why Password Algorithms are rising in popularity. We refute them every time they come up. They don't work. They work UNTIL one of your passwords gets compromised. Then you're stuck either rotating one of your passwords and remembering which one(s) have been rotated, or you're stuck rotating every one of them. I wrote this page to be a guide to friends and family, but I feel like I end up linking to the r…

[deleted]
Post reply on HN