Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The password “ji32k7au4a83” has been seen over a hundred times

twitter.com

Post reply on HN
Print view View original

141–150 of 296 posts

Re: The password “ji32k7au4a83” has been seen over a hundred times

#141

Post by cyberferret »

jobigoud wrote: post #135
cyberferret wrote: post #53

I just keep the RandomKeyGen [0] site on the top of my bookmarks, and whenever I need to set a password for a newly spun up server, or SQL DBA admin password etc., I just pick a random one from there. Advantage over a password manager? - sometimes I have to document what the password is in offline technical notes or a password vault for the customer, and doing it this way lets me kill two birds with one stone. [0] -…

Why do you say this is an advantage over a password manager? You can store notes along password entries.

Not as easy to hand over to the customer at the end of a project though. We either manually enter the passwords in a digital vault under their control, or hand over a printed paper dossier with the access codes in it for them to do what they wish with them.

Re: The password “ji32k7au4a83” has been seen over a hundred times

#142

Post by cyberferret »

meruru wrote: post #92
cyberferret wrote: post #53

I just keep the RandomKeyGen [0] site on the top of my bookmarks, and whenever I need to set a password for a newly spun up server, or SQL DBA admin password etc., I just pick a random one from there. Advantage over a password manager? - sometimes I have to document what the password is in offline technical notes or a password vault for the customer, and doing it this way lets me kill two birds with one stone. [0] -…

Better to use the `pwgen` command for that. There's no guarantee the passwords from that site are really random / not being stored.

True, but that site doesn't just give you one option, but dozens, from which I can randomly choose one. I normally change one or two characters from the ones listed anyhow, just in the unlikely event they are somehow using a fixed list which they are randomly choosing from.

Re: The password “ji32k7au4a83” has been seen over a hundred times

#143

Post by Nition »

sp332 wrote: post #99
cyberferret wrote: post #53

I just keep the RandomKeyGen [0] site on the top of my bookmarks, and whenever I need to set a password for a newly spun up server, or SQL DBA admin password etc., I just pick a random one from there. Advantage over a password manager? - sometimes I have to document what the password is in offline technical notes or a password vault for the customer, and doing it this way lets me kill two birds with one stone. [0] -…

Mine is https://mostsecure.pw/ (please note this is a joke)

I'm amazed that this has been seen 0 times on HaveIBeenPwned[1]. It must be so secure that sites you use it on can't even be hacked.

[1] https://haveibeenpwned.com/Passwords

Re: The password “ji32k7au4a83” has been seen over a hundred times

#144

Post by tanilama »

ilamont wrote: post #49
swang wrote: post #34

This is using the zhuyin keyboard which most likely means Taiwanese users since Taiwan is probably the sole user of the zhuyin keyboard. Typing that out on a zhuyin keyboard gets you: ㄨㄛˇㄉㄜ˙ㄇㄧˋㄇㄚˇ In Pinyin that is wo3 de mi4ma3 Or in English "my password"

For the unfamiliar, "ㄨㄛˇㄉㄜ˙ㄇㄧˋㄇㄚˇ" is an example of "bopomofo" script, the phonetic system used to teach kids reading and pronunciation in Taiwan, and adapted to Chinese keyboard input (zhuyin). I learned it in the 1990s studying Mandarin in Taipei. It maps closely to pinyin romanization used in China (i.e., "ㄨㄛˇ" = "wo3" which is the sound in the Mandarin dialect for "我" and potentially other characters with the sam…

Zhuyin is indeed inspired/influenced by hiragana/katakana

https://zh.m.wikipedia.org/zh/%E6%B3%A8%E9%9F%B3%E7%AC%A6%E8...

But it wasn’t created by/for Taiwanese specifically, by that time Taiwan was under Japan’s rule and they were learning Japanese at the schools. Indeed it was imported back into Taiwan when KMT fled there.

PRC then went on its own jounery of inventing its own Romanization scheme for Chinese. They once almost chose Cyrillic alphabet because its ideological alliance with Soviets, but Latin script still won at the end of day, because the scholars were convicned it is more widely used and more useful.

Re: The password “ji32k7au4a83” has been seen over a hundred times

#145

Post by kakarot »

Dylan16807 wrote: post #127
kakarot wrote: post #60

Earlier quoted context omitted.

Even if you've provided information which narrows your password down to ~5,000 possible values, you've effectively handed out your password to one of 5,000 internet strangers whom you will never meet in real life. Then consider that this is Hacker News, and how many of those 5,000 have both the skills and motivation to exploit the information you've provided. Never give out "hints" about your password. Not its conten…

If giving out the length hurts anything, there's enough going wrong that you should probably assume it's already compromised. Unless there's something fundamentally wrong with the password, a public length of n is almost as secure as a secret length of n, and significantly more secure than a secret length of n-1 Never get into the specifics of a password, but explaining the basic structure should be a tiny impact and…

I'm willing to believe that if you could help me understand a bit more why that is so.

Re: The password “ji32k7au4a83” has been seen over a hundred times

#146

Post by usrusr »

peanutz454 wrote: post #111
jjnoakes wrote: post #88

Earlier quoted context omitted.

What I do is use a password manager, but when it enters a password into an app or site, I type a few more characters after the end of it before logging in. Kind of a secondary master password that's not stored anywhere except my memory and my safe. Best of both worlds in my opinion.

This is awesome! (I think). I've never used a password manager, because I was afraid one breach there is worse than many breaches everywhere else. But, I am curious, if I use a complex formula in my mind to create passwords that are unique to every website I visit, and I store those in Chrome am I not safe? The only problem I see is that I do not update passwords regularly.

If that database in the browser ends up somewhere it should not, a curious attacker will have a nice list of examples to figure out the formula. I share your vulnerability and "password manager + brain-stored component" has been my unexecuted upgrade plan for many years.

Re: The password “ji32k7au4a83” has been seen over a hundred times

#148

Post by usrusr »

pishpash wrote: post #48
davik wrote: post #5

Earlier quoted context omitted.

Here's the entire translated version Using the above principles, how can we design a good password? Tip 1: Replace characters with ones that sound the same For example, you can replace the letter e in succeed with the number 1 {note this sounds the same in Mandarin}, so that it becomes succ11d, which is easy to remember and combines numbers and letters. Tip 2: Replace characters with ones that look the same For examp…

The hilarious part is these are used as examples to illustrate an algorithm, not to suggest you use them as actual secrets.

No, the algorithms are bad as well. Transformed dictionary is hardly any better than dictionary if the transformation isn't unique.

All those annoying rules about required character classes are mainly there to prevent dictionary attacks, but "s3cr3t" is not much of an improvement over "secret" ("s4cr5t" would, because it's not the result of a popular transformation).

Re: The password “ji32k7au4a83” has been seen over a hundred times

#149

Post by infogulch »

kakarot wrote: post #145
Dylan16807 wrote: post #127

Earlier quoted context omitted.

If giving out the length hurts anything, there's enough going wrong that you should probably assume it's already compromised. Unless there's something fundamentally wrong with the password, a public length of n is almost as secure as a secret length of n, and significantly more secure than a secret length of n-1 Never get into the specifics of a password, but explaining the basic structure should be a tiny impact and…

I'm willing to believe that if you could help me understand a bit more why that is so.

Think of it this way: assume someone is trying to brute force your password. For simplicity let's say they know nothing about it, except that its characters are randomly drawn from a 50 character pool. As they guess passwords starting with 1 character, each added character takes 50x longer than all previous guesses put together to guess all possible passwords of that length. Put another way, if they knew the length beforehand, it would only save them from testing about 2% of the overall possible combinations.

Re: The password “ji32k7au4a83” has been seen over a hundred times

#150

Post by dmurray »

redisman wrote: post #129

I can imagine the cold sweat of reading this title when that is actually your password

I'm curious to know if this is right. If you use the zhuyin keyboard method, wouldn't you just remember your password in Taiwanese, and not even recognise the version in Roman characters?
Post reply on HN