Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down

blog.jgc.org

Post reply on HN
Print view View original

31–40 of 125 posts

Re: Write your passwords down

#31

Post by crocowhile »

tghw wrote: post #23
crocowhile wrote: post #21

Earlier quoted context omitted.

The most commonly used hashers are pwdhash, supergenpass and magicpassword. Given that they all use hashing algorithms, none of them will result in a password using special characters, which is not optimal.

Optimal? No. More than sufficient? Yes. You can use all numbers in your password, so long as it's long enough (and the website actually uses all of them).

I use a hashing bookmarklet myself. Only, I wish there was a better algorithm and I think it's wise, at least with an audience like HN, to point the weaknesses of those system. See for instance : http://stackoverflow.com/questions/554224/is-the-bookmarklet...

Re: Write your passwords down

#34

Post by crocowhile »

ali001 wrote: post #30
crocowhile wrote: post #21

Earlier quoted context omitted.

The most commonly used hashers are pwdhash, supergenpass and magicpassword. Given that they all use hashing algorithms, none of them will result in a password using special characters, which is not optimal.

Actually, that's not true. Look at the encoding section of the PwdHash USENIX paper. PwdHash returns an ASCII representation (not a hex or base64 encoded string) of the hashed domain name + master password. PwdHash also applies a number of constraints to the returned hash to ensure that the special characters that it does use are legal at most websites. A typical PwdHash password, with domain name google.com and mast…

Oh, good to know. I stand corrected. I was using supergenpass but I should switch to pwdhash, then.

Re: Write your passwords down

#35

Post by dchest »

ali001 wrote: post #15

I think that a better solution is to use pwdhash. Check it out here: http://pwdhash.com It's a browser extension for Chrome and for Firefox that seamlessly hashes the concatenation of your master password and the domain name of the site you're logging into. This produces a different password for each site, and requires you to remember only your master password. The extensions were created by Blake Ross (big name in t…

Just yesterday I wrote a Chrome extension with the same idea. Algorithm is:

    password = base64(pbkdf2(secret, username@url))
Where PBKDF2 uses SHA-256 and 5000 iterations.

You can get it here: https://chrome.google.com/webstore/detail/hegbhhpocfhlnjmemk...

Website version: http://sellme.ru/p2

Source: https://github.com/dchest/cryptopass/

Re: Write your passwords down

#36

Post by [deleted] »

crocowhile wrote: post #31
tghw wrote: post #23

Earlier quoted context omitted.

Optimal? No. More than sufficient? Yes. You can use all numbers in your password, so long as it's long enough (and the website actually uses all of them).

I use a hashing bookmarklet myself. Only, I wish there was a better algorithm and I think it's wise, at least with an audience like HN, to point the weaknesses of those system. See for instance : http://stackoverflow.com/questions/554224/is-the-bookmarklet...

[deleted]

Re: Write your passwords down

#37

Post by gjm11 »

nowarninglabel wrote: post #19
mikeryan wrote: post #7

Its funny I worked for a startup that got acquired by Comcast, and eventually we started having to follow the Comcast security policy which made us change domain passwords every month with requirements around using strange characters etc. I'd say about 50% of the people ended up with their current password on a post-it on their monitor or desk.

Yes, this same thing happens on the ship I work on in the summers. There are about 300 people, and about half have to reset their password when they come on board. There is the arbitrary 8 character, at least 1 #, at least 1 special character, at least 1 capital, can't match a dictionary word, and can't be close to the previous password. Also can't contain their name. Try explaining that to 150 people over and over a…

> if we just require long passwords, no other requirement

... then I bet lots of users will choose passwords like "passwordpasswordpassword".

Re: Write your passwords down

#38

Post by trafficlight »

gjm11 wrote: post #37
nowarninglabel wrote: post #19

Earlier quoted context omitted.

Yes, this same thing happens on the ship I work on in the summers. There are about 300 people, and about half have to reset their password when they come on board. There is the arbitrary 8 character, at least 1 #, at least 1 special character, at least 1 capital, can't match a dictionary word, and can't be close to the previous password. Also can't contain their name. Try explaining that to 150 people over and over a…

> if we just require long passwords, no other requirement ... then I bet lots of users will choose passwords like "passwordpasswordpassword".

I'd go with passwordpasswordpasswordpassword. Just to be safe.

Re: Write your passwords down

#39

Post by jockc »

lukeschlather wrote: post #29
corin_ wrote: post #9

Personally I don't see any reason for having them completely randomly generated. 'thIs1smyp4ssw0rd19%2' isn't any less secure than another 20 character password that includes lower+upper case letters, numbers and special characters. Obviously, if you do something like 'c0r1np4ssw0rd" then it may get to the stage where enough people do that for crackers to expect it (maybe it already is, but as long as you follow his…

That's not quite true. When we're talking about the security of a password, we're talking about how long it's going to take someone to crack a possibly salted hash (Gawker's weren't) of your password. When attempting to crack a hash, the attacker begins with dictionary words, then with leetspeak permutations of dictionary words, then starts adding random numbers in with random words. It's hard to say in what order sp…

Yes, but what if he used "thIs 1s n0t my p4ssw0rd". Wouldn't that cause the cracking program to burst into flames?
Post reply on HN