Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down

blog.jgc.org

Post reply on HN
Print view View original

41–50 of 125 posts

Re: Write your passwords down

#41

Post by klochner »

My policy:

   - lame passwords for sites I don't care about (e.g., 'insecure')
   - the same password for sites with semi-sensitive information (e.g., facebook)
   - unique passwords for bank accounts, servers, etc.
So I try to strike a balance between difficulty in remembering & security.

Re: Write your passwords down

#42

Post by corin_ »

lukeschlather wrote: post #29
corin_ wrote: post #9

Personally I don't see any reason for having them completely randomly generated. 'thIs1smyp4ssw0rd19%2' isn't any less secure than another 20 character password that includes lower+upper case letters, numbers and special characters. Obviously, if you do something like 'c0r1np4ssw0rd" then it may get to the stage where enough people do that for crackers to expect it (maybe it already is, but as long as you follow his…

That's not quite true. When we're talking about the security of a password, we're talking about how long it's going to take someone to crack a possibly salted hash (Gawker's weren't) of your password. When attempting to crack a hash, the attacker begins with dictionary words, then with leetspeak permutations of dictionary words, then starts adding random numbers in with random words. It's hard to say in what order sp…

Realistically if you take into account the possibility of using up to four works, with some but not all vowels replaced with numbers, a mixture of upper/lower, and some other random numbers and special characters in an undisclosed place... that creates such a huge number of possibilities that it might as well not be dictionary based from the cracker's point of view.

Re: Write your passwords down

#44

Post by techbio »

klochner wrote: post #41

My policy: - lame passwords for sites I don't care about (e.g., 'insecure') - the same password for sites with semi-sensitive information (e.g., facebook) - unique passwords for bank accounts, servers, etc. So I try to strike a balance between difficulty in remembering & security.

Thanks for spelling that out entirely clearly.

Re: Write your passwords down

#45

Post by DenisM »

Write them down to a file, and encrypt the file with a single passphrase. You only need to remember one thing.

There are many tools that let you do that on your mobile phone of choice, including my own http://memengo.com which has a benefit of also including the online backup feature in case you lose your phone.

Re: Write your passwords down

#46

Post by gcr »

gjm11 wrote: post #37
nowarninglabel wrote: post #19

Earlier quoted context omitted.

Yes, this same thing happens on the ship I work on in the summers. There are about 300 people, and about half have to reset their password when they come on board. There is the arbitrary 8 character, at least 1 #, at least 1 special character, at least 1 capital, can't match a dictionary word, and can't be close to the previous password. Also can't contain their name. Try explaining that to 150 people over and over a…

> if we just require long passwords, no other requirement ... then I bet lots of users will choose passwords like "passwordpasswordpassword".

The wise thing is to allow for and encourage the use of passphrases. Sentences are both easier to remember and harder to guess!

Re: Write your passwords down

#47

Post by ankimal »

What happens when you lose your laptop or netbook or whatever handy device you use to browse the web? Are you then leaving it to the OS login screen to protect everything? I d rather have passwords I remember in my head. If I forget often, I click the reset button/forgot your password. Whats more, I generally visit important places more often than unimportant ones, so I wont forget my important passwords. Also, start using sites like mint.com. Instead of logging into your bank account, log into mint to check balance and expenditures.

Lets face it, none of this is every gonna keep you totally out of trouble. If you re so paranoid (aka my security professor at school), shut all your online accounts down.

Re: Write your passwords down

#48

Post by jerf »

corin_ wrote: post #42
lukeschlather wrote: post #29

Earlier quoted context omitted.

That's not quite true. When we're talking about the security of a password, we're talking about how long it's going to take someone to crack a possibly salted hash (Gawker's weren't) of your password. When attempting to crack a hash, the attacker begins with dictionary words, then with leetspeak permutations of dictionary words, then starts adding random numbers in with random words. It's hard to say in what order sp…

Realistically if you take into account the possibility of using up to four works, with some but not all vowels replaced with numbers, a mixture of upper/lower, and some other random numbers and special characters in an undisclosed place... that creates such a huge number of possibilities that it might as well not be dictionary based from the cracker's point of view.

Write your scheme down, compute the number of permutations it makes available, then divide by the total number of possibilities allowed by your password set (a straight [possible_chars]^[length] computation).

The results will surprise you. The space of things you describe is far smaller relative to the available space than you realize.

You can indeed make this big enough to work, and it's easy to make it big enough that only a dedicated cracker could get through it, if that. My point isn't that you're wrong, but that you may be less right than you realize.

Re: Write your passwords down

#49

Post by MikeCapone »

joshkaufman wrote: post #20
_b8r0 wrote: post #3

This is and isn't bad advice. Writing your passwords down and storing them in your wallet isn't necessarily a good idea. You may be able to secure your wallet, but there may be somewhere better to secure it (such as a house safe). Rather than writing the passwords down, use a decent tool like 1password ( http://agilewebsolutions.com/onepassword ) or Keepass ( http://keepass.info/ ).

This looks like a good way to generate the passwords you put into 1password or another similar password tool. If the tool fails, you can regenerate the passwords if you need to.

1Password has a random password generator. That's what I use.

Re: Write your passwords down

#50

Post by brettnak »

mikeryan wrote: post #7

Its funny I worked for a startup that got acquired by Comcast, and eventually we started having to follow the Comcast security policy which made us change domain passwords every month with requirements around using strange characters etc. I'd say about 50% of the people ended up with their current password on a post-it on their monitor or desk.

I did support for a hospital a while back. The favored ( by faculty, not IT ) strategy there was a sticky note on the back of an ID badge. My guess would be that this is common practice anywhere where people carry ID badges.
Post reply on HN