Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down

blog.jgc.org

Post reply on HN
Print view View original

51–60 of 125 posts

Re: Write your passwords down

#51

Post by nowarninglabel »

gjm11 wrote: post #37
nowarninglabel wrote: post #19

Earlier quoted context omitted.

Yes, this same thing happens on the ship I work on in the summers. There are about 300 people, and about half have to reset their password when they come on board. There is the arbitrary 8 character, at least 1 #, at least 1 special character, at least 1 capital, can't match a dictionary word, and can't be close to the previous password. Also can't contain their name. Try explaining that to 150 people over and over a…

> if we just require long passwords, no other requirement ... then I bet lots of users will choose passwords like "passwordpasswordpassword".

Possibly, but I sure would like some data on this. Theoretically, I could try this out by getting approved from the CIO first and then just checking the hash vs the hash for passwordpasswordpassword and passwordpasswordpasswordpassword as well as any password in the top 100 from the previous leak that was > 16 characters (not sure if there are any). As said, I'd like some to get some real data as opposed to stipulations, but obviously it's hard to get this kind of data.

Re: Write your passwords down

#52

Post by jhuckestein »

I like the direction, but the obvious caveat are websites or weird legacy systems that don't allow you to have certain characters in your password or otherwise restrict it.

And then there's the whole trouble of sites that require a username that you need to remember and that is usually restricted in ridiculous ways.

Re: Write your passwords down

#53

Post by brianpan »

trafficlight wrote: post #38
gjm11 wrote: post #37

Earlier quoted context omitted.

> if we just require long passwords, no other requirement ... then I bet lots of users will choose passwords like "passwordpasswordpassword".

I'd go with passwordpasswordpasswordpassword. Just to be safe.

Great idea. Everyone knows about passwordpasswordpassword.

Re: Write your passwords down

#54

Post by jgrahamc »

crocowhile wrote: post #24

> (I have a second copy of that sheet left with a friend in an envelope) I love jgc but here he's making the same mistake most people make when they speak about security: assuming all readers have the same need for security and run the same risks. They don't. There is no point for my mom to adopt this system, it's way overkilled for her. (I think there's no point for me either). One needs to explain to users two thin…

I somewhat agree, but when mass hacks occur it opens people with poor passwords up to hackers because they've got all the time in the world to see whose accounts they can get into.

BTW Do you use the same password on your Gawker account elsewhere?

Re: Write your passwords down

#55

Post by flogic »

joshkaufman wrote: post #13

An easy way to create your own... Copy this empty table: http://pastebin.com/tzbd7FCt Fill it with this random password generator: https://www.grc.com/passwords.htm Be sure to use a fixed-width font.

While I'm reasonably sure they're on the level, getting my random numbers from a source not under my control is worrying.

Re: Write your passwords down

#56

Post by giberson »

I employ what I like to call "Personal Hashing". Think of it like the human version of md5. I've come up with an easy to remember, easy to compute (work done in my head), hashing system that I use to generate passwords for all my accounts. The power of this method is that it generates strong passwords, and is easy to remember.

Take for example, and this is just a sample not my own personal hash formula, the following mechanism:

key = username

1) r = rot2(key)

2) password = vowelreplace(r) [a4,e3,i1,o0,u_]

In this example, I apply a rotation of 2 letters to the input key, then replace the vowels in the result with numbers.

A sample use case might be for an amazon account.

Username: johnsmith

Password Key: johnsmith

Password Phase 1 (rot2): lqjpuokvj

Password Phase 2 (vowelreplace): lqjp_0kvj

We are quite capable of remembering simple formulas which we can use to generate our own passwords on demand. What's best is the formula exists in our heads, and can never be discovered laying around.

Re: Write your passwords down

#57

Post by sophacles »

lukeschlather wrote: post #27
samuel wrote: post #17

So you have a paper on your wallet, which can be used to obtain every password you use, using an intricate and very specific "algorithm". Then you publish the fact itself and the algorithm in your blog(real name), which, besides, doesn't depend on a passphrase (which could turn your method in a sort of dual factor authenticator). The paper could be photocopied and returned to your wallet and you'd never know. Please,…

Why do you believe he gave you the real algorithm?

Access to the piece of paper severely reduces the attack space, even if it isn't "go diagonal from (letter2, letter3) of domain name". Heck, it is not much different if it is a trivial transform on the characters themselves. Anything that a person could easily do (making the thing convenient enough to actually use) is not going significantly alter the number of permutations. Of course, this is making a big assumption that a targeted attack will go after the paper rather than say, the keyboard (which is generally much less secure than a wallet.).

However, this being said, it is much more secure against untargeted attacks than the standard "i have an algorithms in my head" or "i use the same password" approach a lot of people use.

Re: Write your passwords down

#58

Post by Dove »

nowarninglabel wrote: post #19
mikeryan wrote: post #7

Its funny I worked for a startup that got acquired by Comcast, and eventually we started having to follow the Comcast security policy which made us change domain passwords every month with requirements around using strange characters etc. I'd say about 50% of the people ended up with their current password on a post-it on their monitor or desk.

Yes, this same thing happens on the ship I work on in the summers. There are about 300 people, and about half have to reset their password when they come on board. There is the arbitrary 8 character, at least 1 #, at least 1 special character, at least 1 capital, can't match a dictionary word, and can't be close to the previous password. Also can't contain their name. Try explaining that to 150 people over and over a…

> just require long passwords, no other requirement.

I particularly liked the suggestion (elsewhere) to set passwords to a random combination of three dictionary words. It's hard to remember 7Gw$kW_ws, but I bet I could come up with a meaning for "dog shower flange".

Re: Write your passwords down

#59

Post by sigil »

I generate a new random but semi-pronounceable password for every account using apg (http://www.adel.nursat.kz/apg/), then store it in one of several gpg-encrypted, replicated master password files.

The first few times I use a newly generated password, I have to look it up in a master file. It's weird how quickly semi-pronounceable nonsense + some symbols get stuck in your head though.

Re: Write your passwords down

#60

Post by 16s »

I've been doing this:

echo -n "A long sentence I can recall. site_name" | sha1sum

I use the sha1sum from that as my password.

site_name may be hackernews, slashdot, home, etc. I can break them in half (20 chars) or quarters (10 chars) if the site can't accept a 40 char password. Also I can add a period on the end if the site requires special chars. These are strong passwords and unique for each site. Works great on Windows Linux and Macs. All I need to do is recall my sentence (with proper punctuation).

Post reply on HN