Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Algorithms

penguindreams.org

Post reply on HN
Print view View original

51–60 of 114 posts

Re: Password Algorithms

#51

Post by Klathmon »

fredley wrote: post #9
gregmac wrote: post #2

> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character. This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do? I use a pa…

* Your password must be between 7 and 20 characters * Your password must contain * At least one number * At least one upper-case letter * At least one symbol from this list (!@#$%*) * Your password must be changed every 30 days Plus this: https://blog.mamota.net/resources/img/wat_2.gif

The "must be changed every 30 days" always annoys me to no end.

A system I use not only has that requirement (along with a very insane set of requirements like "no patterns like 123 or ABC"), but they also NEVER let you reuse a password.

Which means they have a database of every password I've ever used on a machine somewhere, hashed or otherwise.

So the annoying workaround is to append year+month on the end of each password (which I was basically told to do when first setting up my account). So combined with a "maximum 10 characters" leaves 6 for my actual password...

Re: Password Algorithms

#52

Post by kennysmoothx »

e0m wrote: post #19

I used to have a password algorithm then switched to 1Password and never looked back. My problem of 4 years of algorithm use was that it would slowly change over time. I began to add mechanisms to predictably rotate the passwords. I began to add mechanisms that dealt with arcane dumb password requirements. Encountering a login from 3 years ago usually had me trying 3 different variants before getting it. Furthermore,…

Man, not a day goes by where I dont feel relieved and ecstatic that I have 1Password.

Everytime I go to an obscure website I rarely visit and I have to log in, I hope it's in my 1password account, and when it is I feel so releived I dont have to worry about what my damn password is for that one site.

Obscure password requirements are what drove me to 1password.

Re: Password Algorithms

#53

Post by pixl97 »

jpfed wrote: post #24
donald123 wrote: post #21

This is the false sense of security through obscurity. Given the simple algorithm and without any entropy, it will be trivial to crack the password if the hacker has your multiple passwords. This is very possible since you are sticking to the same algorithm for every website but you don't know which website will just store the plain text of the password. One can easily link you among different websites with your user…

This threat only holds for dedicated attackers. 1. They have to have multiple passwords to have a chance to derive the algorithm. 2. They also need to somehow think it's worth their time to reverse the algorithm instead of just going with lower-hanging fruit.

3. With Yahoo leaking billions of accounts, and hundreds of other services leaking 10's of millions of accounts, your passwords are already out there.

4. Someone makes a John the Ripper/Hashcat plugin that searches password dumps for common usernames/email addresses and attempts to determine if the password is based on an algorithm.

5. With advances in NLP AI, this will just get easier in the future.

Re: Password Algorithms

#54

Post by ythn »

gilrain wrote: post #40

At least it's honest: "Here's my solution to passwords. Any expert will say not to use it, but I do anyway." Okay.

Experts don't care about usability or convenience, only security. I use password algorithms because managers are so darn inconvenient. Especially when I need to type my password into an Xbox, for example, or on my wife's computer real quick.

I believe my algorithm is strong enough that it puts me completely out of reach against automated attacks. If one password is compromised to plaintext, will an attacker even recognize it was generated by an algorithm? Unlikely. If two of my passwords are compromised to plaintext somehow will a determined attacker specifically targeting me be able to recognize and determine my algorithm? Possibly yes. But in my mind, the risk of being individually targetted and having two different passwords compromised to plaintext is not high enough to outweigh the convenience factor of password algorithms.

Re: Password Algorithms

#55

Post by gruez »

pythonaut_16 wrote: post #46
zeveb wrote: post #10

Earlier quoted context omitted.

Among other things, they apparently use webpage encryption (their technology page indicates that AES is implemented in JavaScript for their website), which means that they have the ability to target any user at any point in time. Also, they're proprietary software. Password security is too important to entrust to proprietary software.

When talking about Password Managers (and security in general), I think it's important to keep your threat model in mind. Is LastPass going to protect you against sophisticated State, or even potentially Corporate attackers? Maybe not. Will it protect you against random hacks and insecure sites better than just reusing the same password that you can remember? Yes. I generally agree though that this is an area where o…

>Is LastPass going to protect you against sophisticated State, or even potentially Corporate attackers? Maybe not. Will it protect you against random hacks and insecure sites better than just reusing the same password that you can remember? Yes.

but using keepass does protect you in the case that lastpass' servers get compromised into serving malicious javascript.

Re: Password Algorithms

#56

Post by kranner »

roryisok wrote: post #6

The author recommends using a password algorithm that you can mentally process and then storing the results in a password manager. If you're going to store them why not let the password manager generate the pass for you?

The author suggests storing in password managers optionally, "for reference". The point of using an algorithm to generate a password is that you only have to remember the algorithm and can always work out the password on a new computer.

Re: Password Algorithms

#57

Post by throwawayReply »

jksmith wrote: post #8
zeveb wrote: post #7

Earlier quoted context omitted.

> I use a password manager and generate 30-ish character long passwords Do note that you don't need anything more than 22 random mixed-case letters & digits: 26 lower-case letters plus 26 upper-case letters plus ten digits is 62, and 62²² ≈ 2¹²⁸. Completely agree re. the ineptitude of the developers of sites that try to limit one to less than that.

diceware.com

Diceware is good for encryption passkeys or for master passwords for password managers.

It is awful for actual third-party passwords.

Re: Password Algorithms

#58

Post by ythn »

AdmiralAsshat wrote: post #28

I'm not sure why Password Algorithms are rising in popularity. We refute them every time they come up. They don't work. They work UNTIL one of your passwords gets compromised. Then you're stuck either rotating one of your passwords and remembering which one(s) have been rotated, or you're stuck rotating every one of them. I wrote this page to be a guide to friends and family, but I feel like I end up linking to the r…

> We refute them every time they come up. They don't work.

They "don't work" in theory, but in practice hardly anyone is individually targeted by attackers. 99.9% of compromised accounts are due to automated attacks churning through compromised databases looking for low hanging fruit. People who use algorithms are not low hanging fruit.

Re: Password Algorithms

#59

Post by notzorbo3 »

earenndil wrote: post #38

What about the correct horse battery staple[1] approach? 1: https://xkcd.com/936/

In modern times (read: every site leaks its database all over the place), you really need a different password per service. XKCD approach isn't going to help, since you'll never be able to remember the password to a site you haven't used in 4 months. You still need a password manager, so you might as well let it generate strong passwords for you. XKCD passwords aren't as strong as you'd think.

Re: Password Algorithms

#60

Post by kranner »

notzorbo3 wrote: post #47
lucideer wrote: post #15

Earlier quoted context omitted.

My guess is that the intent is that the passwords would be recoverable by you without the aid of a password manager, but that the relative convenience of a password manager still adds benefits (e.g. behaviourally: guiding you away from any potential tendency to opt for "simpler" passwords out of laziness)

> that the passwords would be recoverable by you Just click "Forgot password"?

Passwords can be used for systems other than websites, where "forgot password"-type reset doesn't always exist.
Post reply on HN