Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down

blog.jgc.org

Post reply on HN
Print view View original

101–110 of 125 posts

Re: Write your passwords down

#101

Post by xlevus »

Abid wrote: post #18

I always have a question come to mind whenever I read these kinds of guidelines: what percentage of computer users have ever had their passwords compromised? I'm guessing there's no real way to gauge this because I've never seen a study nor heard anyone else touting one and yet, complex password protection guidelines are always being recommended. Why?

I have no idea about the percentages. But I've been hit twice. One by a leak from a sizable gaming website, and the other time by gawker. Neither time I gave a shit because thankfully I was smart about my passwords.

There's always a risk, it's not expensive to defend against, so why not?

Re: Write your passwords down

#102

Post by 16s »

Jach wrote: post #97
16s wrote: post #60

I've been doing this: echo -n "A long sentence I can recall. site_name" | sha1sum I use the sha1sum from that as my password. site_name may be hackernews, slashdot, home, etc. I can break them in half (20 chars) or quarters (10 chars) if the site can't accept a 40 char password. Also I can add a period on the end if the site requires special chars. These are strong passwords and unique for each site. Works great on W…

Your approach is great, I think I'll use it too. My current method for secure passwords on sites that have a max around 8 or 12 or so is to think of some song lyrics I know, pick n words, camel-case them, l33+-translate a couple letters, and add shift+numeral special characters to either side.

Thanks. You can cut and paste the passwords. Write an app like I did or if you trust others, download one. I like it because it's portable (no secret encryption crap) and easy to recall. Also, if one site is compromised, like gawker, and they happen to crack the password, they won't be able to use it anywhere else and won't know what your secret sentence(s) are.

Edit: One other neat thing about this approach is that you can honestly say that you don't know what the password is (if you are ever asked). You know how to create it, but you have no idea what it is. That may matter in some situations.

Re: Write your passwords down

#103

Post by kanru »

klochner wrote: post #41

My policy: - lame passwords for sites I don't care about (e.g., 'insecure') - the same password for sites with semi-sensitive information (e.g., facebook) - unique passwords for bank accounts, servers, etc. So I try to strike a balance between difficulty in remembering & security.

If once one of your password leaked, all sites with the secure level are unsafe then.

Re: Write your passwords down

#104

Post by burgerbrain »

kgo wrote: post #72
s-phi-nl wrote: post #66

Earlier quoted context omitted.

http://www.baekdal.com/tips/password-security-usability says that it would take 2,537 years to crack a password with three common words, at a rate of 100 guesses per second, and flange isn't common. That's long enough for me.

This guy picks that upper limit based on the idea that an attacker can't hit the webserver more than 100 times a minute, which makes me question how much he knows about crypto. He doesn't take into account someone who has access to the password hashes. So assume they've got something lame like SHA-1 hashes, even on commodity hardware you're talking about 100,000 hashes a second. Now you're at 2.5 years. Setup a simpl…

Use bcrypt, and chose a work function that's as high as you want. It's pretty trivial to ensure that given certain hardware, it will take a certain amount of time to hash a password.

Never Never NEVER use SHA-1 or MD5 for hashing your passwords, those algorithms are designed to be fast.

Anyway, the technique is called "Diceware", and you can pretty easily calculate how much entropy you're getting with it. (and assuming your attacker doesn't know you're using diceware, you're in even better shape.

Re: Write your passwords down

#105

Post by techiferous »

paulshort wrote: post #76

This password would be really hard to crack. T#!$ p@$$w0rd w0uld &e re@lly #@rd t0 cr@ck. T#!$p@$$w0rdw0uld&ere@lly#@rdt0cr@ck The passwords for my important stuff look much like the above. Just write a sentence that's easy to remember, replace letters with the special characters they look like and blend it all together. Works a treat.

I consider this the geek equivalent of using "password" or "123456". It is so common for tech people to do this. The real security here is the length of the password, not the special characters.

Re: Write your passwords down

#107

Post by trop »

s-phi-nl wrote: post #66
ErrantX wrote: post #64

Earlier quoted context omitted.

That's not much better entropy on the password. It wouldn't take long to go through all three word combinations based on a normal english dictionary. With a password the key is always entropy. You can use all the smarts in the world to avoid the pre-computation attacks on your password... but never forget that brute force is not limited to character by character attack :)

http://www.baekdal.com/tips/password-security-usability says that it would take 2,537 years to crack a password with three common words, at a rate of 100 guesses per second, and flange isn't common. That's long enough for me.

Reminds me of when I had to write a front-end for a web search feed. It was easy to test the standard case (millions of results, of which the first 1000 can be paged). But what about the case when there is only one page of results? The solution seemed to be, rather than finding a topic with only a few results, to keep appending common words until the # of results shrunk enough. For example, from Google:

  "antelope" has 14,100,000 results
  "antelope walrus" has 118,000 results
  "antelope walrus biscotti" has 8,100 results
  "antelope walrus biscotti eisenhower" has 1,690 results
  "antelope walrus biscotti eisenhower lambchop" has 8 results!
Bonus if you can find a word combo which produces a single page of interesting sites, not word spam. Of course now that this comment is on the web, make that 9 results for "antelope walrus biscotti eisenhower lambchop".

Re: Write your passwords down

#108

Post by joe24pack »

brianpan wrote: post #53
trafficlight wrote: post #38

Earlier quoted context omitted.

I'd go with passwordpasswordpasswordpassword. Just to be safe.

Great idea. Everyone knows about passwordpasswordpassword.

But does anyone know thisisnotapasswordthisisnotapasswordthisisnotapassword ?

... with all due apologies to PIL.

Re: Write your passwords down

#109

Post by joe24pack »

gcr wrote: post #46
gjm11 wrote: post #37

Earlier quoted context omitted.

> if we just require long passwords, no other requirement ... then I bet lots of users will choose passwords like "passwordpasswordpassword".

The wise thing is to allow for and encourage the use of passphrases. Sentences are both easier to remember and harder to guess!

and of course only an alliteratively poetic machinist would think to use "sublimeswarfswirlsslowly"

Re: Write your passwords down

#110

Post by sullof »

I think that using password schemes is bad. Because in order to be useful, the method needs to be fast, simple and replicable. Suppose that someone creates a fake website in order to grab one of your smart passwords. If he understands that you use a method, he will try to deconstruct the method based on the fact that his website surely is included in some manner in the password itself. Also, since many people who use these methods tend to divulge them to the community, there isn't even a need to create a fake website to understand your passwords. The only solution that really works is to use a password manager. My favorite obviously is Passpack, because I am a co-founder, but regardless of which software you choose the important thing is that you use it. My advice is not to relay on any clever schemes because you may be in for a bad surprise.
Post reply on HN