Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The password “ji32k7au4a83” has been seen over a hundred times

twitter.com

Post reply on HN
Print view View original

191–200 of 296 posts

Re: The password “ji32k7au4a83” has been seen over a hundred times

#191

Post by ttsda »

SmallDeadGuy wrote: post #166
shubhamjain wrote: post #8

Related story: For some weird reason, I memorized the serial key for a very popular software (I must be fifteen then). Even today, I can recite the 25-letter key without a hitch. And I have used its first ten letters as a password to one of my accounts. Guess what? The password has been used 4000+ times before [1]. It's hard to digest the fact that there are at least a thousand people in the world who did the same th…

Being the "techy" kid in a 7 person family meant I was responsible for setting up any new devices on our wifi many many years ago. From the number of phones/consoles/laptops set up on the same WEP key, I have the 26 digit random hex string permanently ingrained in my memory. While I don't use it as a password any more, before password managers I'm pretty sure I had one of if not _the_ most secure banking password at…

My bank still has a mandatory fixed 8 numerical digit password, with 3 digit positions asked for login, and "two-factor" SMS confirmation for transfers. Very secure.

Re: The password “ji32k7au4a83” has been seen over a hundred times

#192

Post by astura »

cyberferret wrote: post #55
swang wrote: post #34

This is using the zhuyin keyboard which most likely means Taiwanese users since Taiwan is probably the sole user of the zhuyin keyboard. Typing that out on a zhuyin keyboard gets you: ㄨㄛˇㄉㄜ˙ㄇㄧˋㄇㄚˇ In Pinyin that is wo3 de mi4ma3 Or in English "my password"

I see this same explanation on the Twitter thread, which is great. However, I am concerned at how the OP got the string in the first place, that he compared to HaveIBeenPwned? Is he storing his user's passwords in plain text in his back end database, and decided to run them all against the service?? That in and of itself is a security red flag.

Lists of common passwords compiled from previous data breaches are readily available online.

Re: The password “ji32k7au4a83” has been seen over a hundred times

#193

Post by Sharparam »

james_s_tayler wrote: post #182
albertgoeswoof wrote: post #174

Am I the only person that thinks it’s weird that we encourage using unique passwords everywhere, but the second piece of information needed to login (username, email etc) we tend to keep the same for everything? I posted a Show HN last night for a side project I’ve built that can solve the email part of this: https://news.ycombinator.com/item?id=19296936

I did a cheap version of this where I didn't have to build anything but I could test out the concept because I thought it would be awesome and I thought I wanted it. Long story short it became problematic pretty quickly and I ditched it. You need to also be able to reply as that email address too etc. It's been done a bunch a times I understand.

For my custom domain I set up a catch-all so *@sharparam.com gets routed to my main address. If I end up needing to reply from such an address I set up a proper alias for it (currently I use GSuite to manage it).

Re: The password “ji32k7au4a83” has been seen over a hundred times

#194

Post by d33 »

KayEss wrote: post #158
cyberferret wrote: post #53

I just keep the RandomKeyGen [0] site on the top of my bookmarks, and whenever I need to set a password for a newly spun up server, or SQL DBA admin password etc., I just pick a random one from there. Advantage over a password manager? - sometimes I have to document what the password is in offline technical notes or a password vault for the customer, and doing it this way lets me kill two birds with one stone. [0] -…

My ~/bin/makepass file: #! /bin/bash cat /dev/urandom | base64 --wrap ${1:-"10"} | head -n 1 Defaults to 10 character passwords, but you can put bigger numbers as the first argument. I don't think the `base64` command is on the Mac, so probably won't work there.

How about:

tr -dc '[:print:]' < /dev/urandom | head -c 20

Re: The password “ji32k7au4a83” has been seen over a hundred times

#195

Post by albertgoeswoof »

james_s_tayler wrote: post #182
albertgoeswoof wrote: post #174

Am I the only person that thinks it’s weird that we encourage using unique passwords everywhere, but the second piece of information needed to login (username, email etc) we tend to keep the same for everything? I posted a Show HN last night for a side project I’ve built that can solve the email part of this: https://news.ycombinator.com/item?id=19296936

I did a cheap version of this where I didn't have to build anything but I could test out the concept because I thought it would be awesome and I thought I wanted it. Long story short it became problematic pretty quickly and I ditched it. You need to also be able to reply as that email address too etc. It's been done a bunch a times I understand.

> It's been done a bunch a times I understand.

Got any links to these services?

Re: The password “ji32k7au4a83” has been seen over a hundred times

#196

Post by albertgoeswoof »

Sharparam wrote: post #193
james_s_tayler wrote: post #182

Earlier quoted context omitted.

I did a cheap version of this where I didn't have to build anything but I could test out the concept because I thought it would be awesome and I thought I wanted it. Long story short it became problematic pretty quickly and I ditched it. You need to also be able to reply as that email address too etc. It's been done a bunch a times I understand.

For my custom domain I set up a catch-all so *@sharparam.com gets routed to my main address. If I end up needing to reply from such an address I set up a proper alias for it (currently I use GSuite to manage it).

Another alternative if you don’t have your own domain is to put a plus in the email address. The mail server will ignore anything after that plus, eg johnsmith+facebooklogin@gmail.com will have all email sent to johnsmith@gmail.com, but it will preserve the To header in the email.

This is useful for detecting the origin of spam, however it’s trivial for a spammer or hacker to workaround (just strip the plus and anything after it before sending)

Re: The password “ji32k7au4a83” has been seen over a hundred times

#197

Post by pinusc »

dredmorbius wrote: post #128
meruru wrote: post #84

Earlier quoted context omitted.

Well, I use pwgen and gpg ┐(´ー｀)┌ A great thing about password managers is that you can change your passwords more often since you don't have to bother coming up with and remembering new passwords. It can even be somewhat automated with pass-rotate: https://github.com/ddevault/pass-rotate

xkcdpass is also useful. https://packages.debian.org/stretch/xkcdpass https://xkcd.com/936/

I wrote a `pass` plugin [1] that works similarly to xkcdpass — but integrates it into a password manager. Makes usage far easier!

1: https://github.com/pinusc/pass-diceware

Re: The password “ji32k7au4a83” has been seen over a hundred times

#199

Post by dpacmittal »

shawnz wrote: post #11
shubhamjain wrote: post #8

Related story: For some weird reason, I memorized the serial key for a very popular software (I must be fifteen then). Even today, I can recite the 25-letter key without a hitch. And I have used its first ten letters as a password to one of my accounts. Guess what? The password has been used 4000+ times before [1]. It's hard to digest the fact that there are at least a thousand people in the world who did the same th…

Is your password "fckgw rhqq2"?

I remember this key. Lol.

Re: The password “ji32k7au4a83” has been seen over a hundred times

#200

Post by usrusr »

pishpash wrote: post #176
usrusr wrote: post #148

Earlier quoted context omitted.

No, the algorithms are bad as well. Transformed dictionary is hardly any better than dictionary if the transformation isn't unique. All those annoying rules about required character classes are mainly there to prevent dictionary attacks, but "s3cr3t" is not much of an improvement over "secret" ("s4cr5t" would, because it's not the result of a popular transformation).

Not much of an improvement, but never worse -- unless the function is not injective. You can't argue with Kolmogorov complexity. If the algorithm is secret and has computational complexity it gets better.

Sure, but we are talking about trivial substitution schemes here. I could have been more specific.
Post reply on HN