81–90 of 129 posts
I've never encountered a website that prevented me from pasting a password. Is this truly a thing?
In theory it's possible that they're trying to do some other thing by handling keyboard input on password fields, and that interferes with hotkeys—but I can't imagine what that other thing would be.
Earlier quoted context omitted.
There was a recent discussion on HN that branches into this idea about the importance of UX. I agree with you, with a twist. What you want is that the happy path for security is zero hassle, but the unhappy paths should also drop dead with zero hassle. This is the UX I really like for WebAuthn / U2F. All the interactions on the happy path are very smooth. Need a second factor, tap, go. Almost frictionless. On my phon…
Another unhappy path is very difficult. Your phone got stolen or smashed. Your 2FA is just not available. Welcome to the sea of hassle proving your identity. But a little bit of hassle beforehand, in the form of printing one-time codes and storing them even in your wallet would help dramatically.
I'm far more likely to lose my keys or wallet than 2fa.
Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Nonetheless, there's this perception that something delicious can't be good for a diet. People have this notion that to lose weight, there must be penance . An element of punishing oneself for past transgressions seems essential . Security people have the same mindset. Security must be a hassl…
It can use a different key combo, or automatically be chosen when pasting into secure fields
Earlier quoted context omitted.
I like the system where you only enter parts of your password. It means that even with a key logger or hacked site, you’d need several logins to be able to scrape the password
That means the password is held in plain text or reversable encryption. They should only have a salted hash of your password. Using a shared secret in addition to a salted password is probably acceptable, although how much extra security it gives is debatable.
Earlier quoted context omitted.
This approach also means that the password must be stored as plain text. Otherwise they would only be able to compare if the password was complete.
Not necessarily. You could store $10 \choose 5 = 252$ hashes for each user. We did something similar for call center caller authentication (you don't want the operator to get the whole PIN of the user, so he asked only for e.g. two characters). Not that this would be very useful, security-wise.
Wouldn't this be way easier to crack if the password hashes were leaked? Once you crack one 5-letter hash, you can trivially crack the one that shares 4 characters with it, and do that repeatedly until you have all 10 characters.
You're reducing the effective search space not by a factor of 252 (8 bits of entropy, which would often be acceptable) but to its square root, losing half of the entropy.
Although it seems like security theatre, the PIN solution actually sounds more useful. The typical attack on a system protected by PINs, like bank cards, is not cracking hashes offline - it's that the attacker tries the PINs on the live system and gets locked out after a small number of failures. Assuming the bad actor can't just initiate another call and ask for the other two digits.
On this point: > write passwords down in places that are easy to find (like post-it notes next to the screen) Writing passwords on post-it notes is often used as a ridicule of non-tech-savvy folks behavior. I'd like to pose this question: If you're doing this not at an office, but at home, is this really so bad? Say you run a web site on AWS and write your really long AWS password on a piece of paper at home. It woul…
Yes. Keylogger and Webcams and untrustworthy roommates/family members/landlords are all low threat but; This encourages people to use the same password for multiple sites/services so as not to get overwhelmed by sticky-notes. So whenever one of those are breached, your email:pass combo becomes public knowledge.
My piece of advie: Don't take your brain memory for granted In this era of information technology everyone is bombarded with tons of data that they don't know how to think and memorize Thinking and memorizing can strengthen your brain muscles but people hate exercising their bodies and their brains I do use keepass for managing different passwords, but I kind of memorize most of them, only open keepass for storing th…
How on earth could I remember random complex passwords I use once a year? I can memorise af58f916cc0cb22193c18f02d3c1cc3e easily, but once you work out (perhaps a keylogger) why that's my paypal password, my google password of 68b31385067f73977c6007cefcddbe74 falls quickly
Back in 2012, my facebook password was idontunderstandthepointofonlinefriends2011. I don't think it's easy to forget something like that.
Earlier quoted context omitted.
Sure, but this isn’t engaging in the above poster in good faith.
I don't have the data on sales, so I can't comment on that. Without seeing the marketing, it's hard to tell why OP's solutions are not chosen. (I don't expect it to be as easy as "it's not difficult enough")
Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Nonetheless, there's this perception that something delicious can't be good for a diet. People have this notion that to lose weight, there must be penance . An element of punishing oneself for past transgressions seems essential . Security people have the same mindset. Security must be a hassl…