Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why you shoud never use your favorite password on News.YCombinator.com

rafb.net

Post reply on HN
Print view View original

81–90 of 136 posts

Re: Why you shoud never use your favorite password on News.YCombinator.com

#81

Post by axod »

eru wrote: post #80
axod wrote: post #73

Earlier quoted context omitted.

It's not like you have to remember them... I just use a script that based on a site name/keyword I give it, generates a password for me. Then the browser remembers it. Of course that means if anyone steals my laptop they have all my logins, but that's extremely unlikely.

"It's not like you have to remember them... I just use a script that based on a site name/keyword I give it, generates a password for me. Then the browser remembers it. Of course that means if anyone steals my laptop they have all my logins." Would have gone down better, I guess.

Well... I never leave the house and live in a guarded fort.

Re: Why you shoud never use your favorite password on News.YCombinator.com

#82

Post by cperciva »

eru wrote: post #78
cperciva wrote: post #67

Earlier quoted context omitted.

be aware of the fact that several of the top security firms will demerit your app for doing it Speaking as FreeBSD Security Officer: Several of the top security firms provide ratings which reflect the quality of their checklists more than the quality of the security in the systems they're assessing. The FreeBSD security team recently dealt with a case of "if you don't fix this, people using FreeBSD will lose marks on…

Care to elaborate?

There was a recent "security issue" reported to us whereby an attacker who could specify a printf format string could cause a buffer overflow. We don't consider this to be a security issue since if you're allowing an attacker to specify a printf format string, you've got much bigger problems already -- this "issue" doesn't make things any worse.

Re: Why you shoud never use your favorite password on News.YCombinator.com

#83

Post by thaumaturgy »

tptacek wrote: post #49
bct wrote: post #48

Earlier quoted context omitted.

What's silly about Digest?

It's obviously less secure than SSL.

DAA isn't intended to solve the same problem as SSL. SSL also isn't always worth the cost of the certificate, depending on the information being guarded; nor is it absolutely secure [http://eprint.iacr.org/2004/111.pdf, May 2004].

I don't understand the all-or-none attitude that appears to be prevalent in the security industry. For all the discussion spent on search spaces, and maximizing attack effort, there doesn't seem to be much acceptance for "good enough" security. There appears to be this attitude that -- to use wireless security as one example -- "WEP is broken, so you might as well just run a totally open network."

I see that when you say that anybody that can sniff traffic for stupid JavaScript hashes can also necessarily inject traffic to alter the negotiation between the host and the client. While in theory that's correct, in practice it ignores the difference in the number of people that know enough to execute either attack.

It makes sense to say, "If you're going to do password encryption, you might as well do it right", but I don't think it follows that even a stupid JavaScript MD5 hashing scheme is as insecure as plain-text password transmission.

Re: Why you shoud never use your favorite password on News.YCombinator.com

#84

Post by thaumaturgy »

jncraton wrote: post #64
tptacek wrote: post #54

Earlier quoted context omitted.

This is going to make me sound like even more of an asshole , but I'm going to say it anyways because it is true: if you have to explain to yourself what a "salt" is, or you can't spell "nonce", you shouldn't be designing security systems. That doesn't mean your app needs to be insecure; it just means you should be using someone else's authentication system to do it.

This is hacker news. I think that we are all here to learn. We all have different levels of expertise as well as areas of interest. I'm personally not working a full time coding job yet because I'm still in school and I still have quite a bit that I want to learn just hacking around on my own smaller projects. The fact that the concept of a salt isn't totally automatic to him or that he misspelled nonce only means th…

| ...only means that he shouldn't be designing security systems right now.

That is almost letter-for-letter what Thomas said.

Re: Why you shoud never use your favorite password on News.YCombinator.com

#85

Post by thaumaturgy »

jsteele wrote: post #19
kwdowicz wrote: post #12

Earlier quoted context omitted.

users have million sites where they have logins and passwords - they can't have million password - even pattern can be guessed. If the risk is to low it's ok to not use HTTPS. But some blurring would give positive results - as like some hackers commented already.

A million's a big number. As a User, I'd have to say that a hundred or so passwords sounds about right - and I live online 24/7. For most users - a dozen, tops.

| For most users - a dozen, tops.

"Most" users have trouble remembering even one password. Rightly or wrongly, it's hard to get the average computer user interested in security.

Re: Why you shoud never use your favorite password on News.YCombinator.com

#86

Post by ig1 »

sigh the correct solution for this problem is SRP (see RFC 2945) which provides a secure transfer of password data and can be (and has been) implemented in javascript.

However while that solution will prevent packet sniffing, if you want to prevent phishing attacks you still need to use SSL

Re: Why you shoud never use your favorite password on News.YCombinator.com

#87

Post by eru »

axod wrote: post #81
eru wrote: post #80

Earlier quoted context omitted.

"It's not like you have to remember them... I just use a script that based on a site name/keyword I give it, generates a password for me. Then the browser remembers it. Of course that means if anyone steals my laptop they have all my logins." Would have gone down better, I guess.

Well... I never leave the house and live in a guarded fort.

Why do you need a laptop then?

Re: Why you shoud never use your favorite password on News.YCombinator.com

#89

Post by thorax »

tptacek wrote: post #40
hsiung wrote: post #6

Earlier quoted context omitted.

There are still ways to add a little extra security for non-ssl logins. One way is by hashing the password via javascript with a random number provided by the server before posting it via HTTP. (see http://pajhome.org.uk/crypt/md5/auth.html )

That adds no security at all . Security is not an obstacle course.

Security is nothing but an obstacle course. The only time security is not merely an obstacle course is when you completely destroy the thing you're trying to protect.

This is fundamentally something everyone needs to understand about computer security-- it's all about creating bigger and harder obstacles (including literal, physical obstacles). You can never absolutely secure something while it exists.

Re: Why you shoud never use your favorite password on News.YCombinator.com

#90

Post by cmars232 »

mhartl wrote: post #33
axod wrote: post #13

1. Go read up on HTTP vs HTTPS 2. Never use the same login for 2 websites The fact this has been upvoted to top position is more worrying than any security worries.

Never use the same login for 2 websites Dude, my brain would explode.

Use PasswordMaker.
Post reply on HN