Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Bare Minimum You Should Do to Protect Your Family's Data

blog.mozilla.org

Post reply on HN
Print view View original

51–60 of 119 posts

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#51

Post by astura »

_8j50 wrote: post #34
ken wrote: post #23

Earlier quoted context omitted.

Previously, from a former Mozilla developer [1]: > At best, there is negligible evidence that major non-MS AV products give a net improvement in security. More likely, they hurt security significantly; for example, see bugs in AV products listed in Google's Project Zero. These bugs indicate that not only do these products open many attack vectors, but in general their developers do not follow standard security practi…

Vulnerability is not lack of security. You need a threat actor exploiting the weakness for it to become actual insecurity.

That's... not what vulnerability means.

vul·ner·a·bil·i·ty noun the quality or state of being exposed to the possibility of being attacked or harmed, either physically or emotionally.

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#52

Post by heinrich5991 »

ImprovedSilence wrote: post #42
saagarjha wrote: post #17

> They should be at least eight characters and have a combination of letters, numbers, and special characters, such as 5pEAzhawh$ for “five pizzas.” Obligatory xkcd telling you to not do this: https://xkcd.com/936/

I'm by no means and expert is this field, but I thought at some point I had heard that using words like the xkcd comic were actually less secure, I thought what I heard was that there is a type of dictionary search that can be more efficient in cracking those "all words" passwords (as in, you don't really have 44 bits of entropy). Again, I've got no source, and am not very knowledgeable in this space, so someone corr…

Assuming you pull these four words randomly (not-human-random, actually random) out of a dictionary of at least 2048 words, and separate them by a space, you have a password of (at least) 44 bits of entropy. There's no way a "dictionary" attack can reduce the possible password space to less than 244 possibilities.

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#54

Post by astura »

heinrich5991 wrote: post #52
ImprovedSilence wrote: post #42

Earlier quoted context omitted.

I'm by no means and expert is this field, but I thought at some point I had heard that using words like the xkcd comic were actually less secure, I thought what I heard was that there is a type of dictionary search that can be more efficient in cracking those "all words" passwords (as in, you don't really have 44 bits of entropy). Again, I've got no source, and am not very knowledgeable in this space, so someone corr…

Assuming you pull these four words randomly (not-human-random, actually random) out of a dictionary of at least 2048 words, and separate them by a space, you have a password of (at least) 44 bits of entropy. There's no way a "dictionary" attack can reduce the possible password space to less than 2 44 possibilities.

You can use Dicewear to generate these passwords: http://world.std.com/~reinhold/diceware.html

They recommend a minimum of six words though.

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#55

Post by TimTheTinker »

astura wrote: post #46
TimTheTinker wrote: post #29

Earlier quoted context omitted.

Yes, they clearly didn't consult (and/or use) security researchers' most recent recommendations about passwords. Password managers have become a nearly non-negotiable necessity. Telling people just use a password manager is becoming kind of like telling developers just use source control 15 years ago. You just won't know how important they are (or the true cost/benefit) until you start using one yourself.

15 years ago? Source control was very, very standard 15 years ago. 15 years ago I would have run, not walked, from a job if they didn't use source control. There was no git, we used CVS, which was almost old enough to vote at that time.

> Source control was very, very standard 15 years ago.

For commercial shops, perhaps. But back then the bar for using source control was much, much higher, so for many small projects, people didn't bother. There wasn't anything as simple as `git init`.

There were a few public CVS and SVN servers that were appropriate for open source projects, but for anything personal or commercial, you had to use a local, single-user repo or set up your own server. (Back then, the only viable DVCS systems were commercial.)

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#57

Post by perplamps »

cmurf wrote: post #30
Zhenya wrote: post #14

"Use antivirus protection. Buy and download antivirus software from a reputable source such as McAfee, Norton, or Symantec. Beware of free antivirus software, as it can contain malware. The iOS operating system has antivirus software built in..." Do people still really install anti-virus? Isn't it just another vector for attack since they themeselves use exploits to manipulate the OS? Linux for desktop, pixel or iOS…

Not only do people install it, I see it required in corporate IT all the time. As in, they even set a VPN policy that checks your anti-virus definitions for currency and will refuse to connect if the definitions aren't current or if anti-virus is not installed. These same corporate IT who force 90 day password changes, and nonsense like 5pEAzhawh$ instead of fivepizzassoundsgoodbutdontforgetthebeer because no matter…

That's often due to PCI compliance which I believe mandates antivirus software.

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#58

Post by astura »

ozim wrote: post #33
codegeek wrote: post #3

Overall a good resource but please no to "antivirus" software like McAfee. Absolutely horrible and makes it worse.

Ok so you have kids who play say Minecraft, they download all mods they can in zipfiles and install all the other games packs from weird internet forums. What is bigger threat and attack vector, McAfee, Symantec or modding forums for 10 year old? For me installing AV is silly I don't download and run random crap from internet that friend from school also installed. But If I would have kids having installed AV and upd…

Is McAfee really better than Windows Defender in this use case though?

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#59

Post by dqpb »

ChrisSD wrote: post #22

> Use tough passwords and change them frequently. The best practice for passwords is to use real words or phrases you can remember easily — but spell them incorrectly. They should be at least eight characters and have a combination of letters, numbers, and special characters, such as 5pEAzhawh$ for “five pizzas.” The result of encouraging frequent changes: 5pEAzhawh$, 5pEAzhawh$2, 5pEAzhawh$3, 5pEAzhawh$4, 5pEAzhawh$…

No, the best practice is to use a password manager with randomly generated passwords.

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#60

Post by SlowRobotAhead »

glitcher wrote: post #11
imbusy111 wrote: post #9

I expected better from Mozilla. Connecting to unsecured WiFi is mostly not a problem. Most websites and applocations encrypt traffic and the security of the channel does not matter. Plus, the recommendation to installl shady antivirus software throws the motivation of this article into doubt.

I agree. The section on "Use tough passwords and change them frequently", except for the final suggestion to use a password manager, felt like antiquated password advice.

Because that IS antiquated password advice.

1. In terms of “strong passwords” it’s better to use the words “paraphrase” which if they get past 4 words are almost always stronger than traditional “passwords” humans actually use. It’s a nitpick, but using the better term leads to better results in my experience. “Do I need a new password? No, you need a new passphrase”

2. In terms of rolling credentials frequently and on some time period, NIST specifically recommends against that now.

Post reply on HN