Live data from Hacker News

Let them paste passwords (2017)

ncsc.gov.uk

101–110 of 129 posts

Re: Let them paste passwords (2017)

#101
post #74

Earlier quoted context omitted.

How on earth could I remember random complex passwords I use once a year? I can memorise af58f916cc0cb22193c18f02d3c1cc3e easily, but once you work out (perhaps a keylogger) why that's my paypal password, my google password of 68b31385067f73977c6007cefcddbe74 falls quickly

I think that's a bit of a stretch. You can use rememberable long phrases. Back in 2012, my facebook password was idontunderstandthepointofonlinefriends2011 . I don't think it's easy to forget something like that.

I have c.600 passwords in one manager. That's not even all of them - some I'm required not to write down, some I keep offline, some I choose to keep as memorable phrases. All those directly connected to ability to spend any money I keep offline (memory or paper).

I'll admit I'm probably an exceptional case but regular users must have 100 or more password after a couple of years online.

Re: Let them paste passwords (2017)

#102

Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Nonetheless, there's this perception that something delicious can't be good for a diet. People have this notion that to lose weight, there must be penance . An element of punishing oneself for past transgressions seems essential . Security people have the same mindset. Security must be a hassl…

There's actually a lot of scientific evidence that hyperpalatable food contributes significantly to obesity and that bland food does lead to an instantaneous drop in appetite. It's not about any penance, you got it all wrong, this is about our brain going haywire for food high in calories.

This reminds me of a Jack LaLanne quote.

"If it tastes good, spit it out!"

It's not an absolute rule obviously. Generally products masquerading as health food that taste "good" are loaded with sugar.

Re: Let them paste passwords (2017)

#103

Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Nonetheless, there's this perception that something delicious can't be good for a diet. People have this notion that to lose weight, there must be penance . An element of punishing oneself for past transgressions seems essential . Security people have the same mindset. Security must be a hassl…

> Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat.

Big side-tangent, but amusingly enough, one modern view on the etiology of metabolic syndrome is that your brain tracks satiety for different nutrient classes separately; so foods that are "tasty" in the sense of containing many different nutrient-signals (sugar, salt, fat, acid, etc.) take larger quantities of food to signal fullness (something something liver metabolism is a rate-limited queue); so if you start off hungry and eat such foods until you "feel full", you will have eaten more of them than you "should have", to the point of eventually doing excitotoxic things to your leptin receptors, inducing leptin resistance and making you feel hungry more often.

Which is to say, it's not flavor that makes you fat, but rather flavors, plural. ;)

The advice of the scientists who subscribe to this hypothesis is that you don't have to eat bland food; you just have to eat monotonous food (food only containing one primary nutrient-signal), and you'll feel full with less of it. When you sit down for a meal, eat all meat, or all bread, or all green leafy vegetables. Balance your diet by having something different each meal, not by combining foods in a single meal. Avoid foods that are themselves "combinations", like pizza. Avoid adding a secondary nutrient-signal to something to "amp up" the taste, like adding sugary+oily dressing to a mineral-y salad. Just choose foods that already taste good to you without any "amping up", and eat those, by themseleves.

This is, after all, the real "paleo diet": when animals kill prey, they eat just meat for a meal. When they find fruit, they eat just fruit for a meal. They don't bring them together to eat them all at once.

(Whatever you think of the hypothesis, studies have been done which confirm the advice: eating monotonously per meal, makes you feel full after less food intake. You hit a wall with a kind of "tired/bored of eating this, disgusted by the idea of eating more" feeling, which makes you lose the rest of your appetite. That's your body's nutrient-satiety mechanism kicking in correctly.)

Re: Let them paste passwords (2017)

#104
post #31

On this point: > write passwords down in places that are easy to find (like post-it notes next to the screen) Writing passwords on post-it notes is often used as a ridicule of non-tech-savvy folks behavior. I'd like to pose this question: If you're doing this not at an office, but at home, is this really so bad? Say you run a web site on AWS and write your really long AWS password on a piece of paper at home. It woul…

The threat model is always important. What does your home look like? Who are you protecting from? If your current home is a shared student accommodation, post-its are probably a bad idea. If you live with potentially abusive family members, it may be a bad idea. But in many cases when you don't live your life online and login everywhere with your Google account federation - sure write it on a post-it. It's not good e…

Your very right. It’s all about threat models. I would rather my grandma (or really anyone that would have a hard time dealing with a password manager) have a password journal then all her passwords be the exact same thing.

Re: Let them paste passwords (2017)

#105
post #74

Earlier quoted context omitted.

How on earth could I remember random complex passwords I use once a year? I can memorise af58f916cc0cb22193c18f02d3c1cc3e easily, but once you work out (perhaps a keylogger) why that's my paypal password, my google password of 68b31385067f73977c6007cefcddbe74 falls quickly

I think that's a bit of a stretch. You can use rememberable long phrases. Back in 2012, my facebook password was idontunderstandthepointofonlinefriends2011 . I don't think it's easy to forget something like that.

The quoted passwords are md5 sums of paypalformyusername and googleformyusername

Easy to remember, and you'd have to be very determined to get the link between them even if both were compromised, but if the plain text version was compromised then it would compromise the entire system

That's the most secure system I can think of which doesn't involve remembering thousands of complex random passwords. Sure I can remember "correcthorsebatterystaple", but can I remember which 4 words for which specific site?

Re: Let them paste passwords (2017)

#106
post #3

So much of main line security practice is cargo cultism. There is so little use of actual research and data on how compromises actually happen. Somebody just gets the idea something is good for security and it sticks. No rationale needed.

I've experienced this first hand as a developer. Our team was working on revamping an e-commerce platform and we had developed a CRUD API for the shopping cart. Everything was going smoothly until a manager decided to take issue with our use of HTTP DELETE for removing items from the cart. The person in question wasn't technical but pointed to a document which expressly prohibited the use of the DELETE verb across all applications developed by the company citing an unspecified security risk. Wasn't around long enough to dig deeper into that, but probably wouldn't have gotten far given how partial the company was to superstition.

Re: Let them paste passwords (2017)

#108

Also let them fill their credentials in a single form. Two-step login makes password managers experience terrible.

I have noticed many implementations appear to be able to capture the password and have it auto-filled, or maybe my password managers are somehow able to handle them. I’m not against it when it works like that, as there are sometimes valid reasons for the design.

Re: Let them paste passwords (2017)

#109
post #44
post #40

Earlier quoted context omitted.

apt-get install xclip xdotool, then put this in ~/bin/paste #!/bin/bash sleep 2.0 xdotool type "$(xclip -o -selection clipboard)" If a website prevents you from pasting stuff just type "paste" and then click the field and wait 2 seconds.

You underestimate the ingenuity of some sites. Take this one: https://systemschimb.telekombanking.ro/login - enter a random user id, and behold the password input field: - all characters are separated (not one password field, but 10-15 ones) - some characters are randomly grayed-out (you're not supposed to enter all the characters of your password)

Wow. Even if I didn’t use a password manager, that last point would make this unusable for me. When I do use passwords, I remember them through muscle menory, and having to not type parts of it would throw me off. I would actually change banks over that.

Re: Let them paste passwords (2017)

#110
post #51
post #31

On this point: > write passwords down in places that are easy to find (like post-it notes next to the screen) Writing passwords on post-it notes is often used as a ridicule of non-tech-savvy folks behavior. I'd like to pose this question: If you're doing this not at an office, but at home, is this really so bad? Say you run a web site on AWS and write your really long AWS password on a piece of paper at home. It woul…

I know a person with many sheets of paper filled by site makes and their passwords. Basically a password manager on paper. It's an excellent protection against password stealing malware but it's very bad if a burglar enters the house and also steal the passwords. It's also a pain to look for a site (the passwords are not on an old fashioned phone numbers agenda) and to type the passwords every time.

I do this, but also have a small prefix I add to the start of each password which I don't write down. The biggest threat is probably someone I know finding the passwords and trying to use them, so the odds of that kind of person actually brute forcing the prefix are pretty low.
Post reply on HN