Don't give away historic details about yourself • Hacker News Board

Re: Don't give away historic details about yourself

#71

Post by tgb » Tue, Apr 10, 2018, 7:16 PM UTC

jwilk wrote: post #53

ben_w wrote: post #19

Earlier quoted context omitted.

I believe the entropy problem is only that people don’t choose words randomly. I wrote a script to do it for me, with numbers separating words because some websites demand numbers, and assuming the random number generation is suitable, it’s 73 bits of entropy. I have no idea if the random number generation is sufficient: https://github.com/BenWheatley/HighEntropyPassword

I only looked at the Python part, and no, it's not good. Documentation for the random module¹ prominently warns: The pseudo-random generators of this module should not be used for security purposes. Use os.urandom() or SystemRandom if you require a cryptographically secure pseudo-random number generator. ¹ https://docs.python.org/2/library/random.html

Okay, I don't study this, but I don't think that's what "cryptographically secure pseudo-random number generator" means. Not all things vaguely related to cryptography are required a CSPRNG and these answers are not being used cryptographically at all in many cases (like you just reading it over the phone to the representative). Please correct me if I'm wrong.

Re: Don't give away historic details about yourself

#72

Post by roywiggins » Tue, Apr 10, 2018, 7:20 PM UTC

enobrev wrote: post #61

ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

I agree with you and for accounts that matter (bank, etc), I'll generally generate additional passwords with my PW manager for each question and store them there. That said, I have a peeve with one of the standard questions they ask, which is the "favorite" question. Favorite movie, favorite band, favorite song, etc. Besides the fact that I don't have One Favorite anything, does anyone actually have life-long singula…

> I'll generally generate additional passwords with my PW manager for each question and store them there.

You have to be a bit careful with that, since some banks like to use those answers as "second factors"* when you call them. So I've gotten in the habit of using diceware-style passphrases for those, as those work over the phone better than pure white noise passwords.

*extreme air quotes

Re: Don't give away historic details about yourself

#73

Post by Dylan16807 » Tue, Apr 10, 2018, 7:21 PM UTC

dsfyu404ed wrote: post #63

Simon_says wrote: post #54

Earlier quoted context omitted.

Are you kidding? Those are terrible passwords, and there’s already some script kiddie out there with a password list containing the top 10 billion book, music, tv show, and movie quotes. A good password has entropy, which is not a property of the alphanumeric string but of the process used to create it. Could your password generation method plausibly have produced 2^60 alternative passwords with equal probability? Pr…

Are you kidding? Which is longer, the alphabet or the dictionary? There's a hell of a lot more words in any language than there are characters that make them up. N case insensitive words is far better than N character password from the normal set of characters (alphanumeric + special characters). Even if you restrict the combinations of words to grammatically correct sentences there's still more combinations than the…

If you're using a famous quote, after a few words you're adding next to zero entropy per word.

You're using an analysis for random words, which is completely different.

Also in general a random word is worth around as much as two random characters. There's no clear-cut winner, use whatever you like more.

Re: Don't give away historic details about yourself

#74

Post by roywiggins » Tue, Apr 10, 2018, 7:21 PM UTC

hnaccy wrote: post #46

gnulinux wrote: post #36

Earlier quoted context omitted.

I do this too, I was told to add something like "PLEASE MATCH THIS TEXT, THIS IS NOT A RANDOM STRING" at the beginning. Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account.

You could have predefined mappings of characters to strings so that they appear non-random, e.g. SBNLWPXMZ -> Seattle Boston Newcastle Lagos Washington Paramaribo Xanadu Montreal Zagreb.

Diceware?

http://world.std.com/~reinhold/diceware.html

Re: Don't give away historic details about yourself

#75

Post by samstave » Tue, Apr 10, 2018, 7:23 PM UTC

ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

I love the following technique:

Question: What was the name of your first cat?

A: cat

Q: what city were you born in

A: city

Q: what is your moms maiden name?

A: name

and the like.

Re: Don't give away historic details about yourself

#76

Post by EGreg » Tue, Apr 10, 2018, 7:26 PM UTC

I think you have it backwards, here.

Instead of urging people to NOT reveal details about their life such as their first pet’s name, you should urge them to answer all password reset questions with at the very least irrelevant answers, or a password reset password.

Re: Don't give away historic details about yourself

#77

Post by acchow » Tue, Apr 10, 2018, 7:28 PM UTC

ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

Square Cash is passwordless. They move money around.

Re: Don't give away historic details about yourself

#78

Post by jstanley » Tue, Apr 10, 2018, 7:28 PM UTC

StavrosK wrote: post #65

enobrev wrote: post #61

Earlier quoted context omitted.

I agree with you and for accounts that matter (bank, etc), I'll generally generate additional passwords with my PW manager for each question and store them there. That said, I have a peeve with one of the standard questions they ask, which is the "favorite" question. Favorite movie, favorite band, favorite song, etc. Besides the fact that I don't have One Favorite anything, does anyone actually have life-long singula…

They stop making new movies when you answer that question, thus ensuring your answer will remain valid.

That still doesn't stop you stumbling across an older film that you've never watched before, and then finding that you like it more than your "favourite".

Re: Don't give away historic details about yourself

#79

Post by icebraining » Tue, Apr 10, 2018, 7:28 PM UTC

downer61 wrote: post #22

ghfbjdhhv wrote: post #12

Earlier quoted context omitted.

>The people that expect you to maintain retardedly formatted passwords with stupid character mixtures, and expiration/re-use rules are obstacles, and I like making them as miserable as they make me. The person on the other end of the phone had nothing to do with it.

My hope is that the ambient animosity seeps through, via high turn-over, leading to increased personnel costs for the organization. In general, hopefully this uncooperative behavior adds to the general misery distributed throughout the world, and all just because security goons need to feel like they're smarter than the people subject to their policies. Consider this, oh reader, should you have the opportunity to alt…

Clearly you haven't done customer support, if you think having to listen to a long string of characters is what's going break them :)

Re: Don't give away historic details about yourself

#80

Post by PrimHelios » Tue, Apr 10, 2018, 7:28 PM UTC

ourmandave wrote: post #49

Stealing one account at a time is small time hoodlum level sh*t. The pros just download the entire user table in one go. They don't care what your first pet's name was.

It doesn't matter if the person after your account is a skid, or is a government-backed entity, you lose all your data and online accounts either way.