Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You have exactly three passwords, don't you?

pcmag.com

Post reply on HN
Print view View original

21–30 of 86 posts

Re: You have exactly three passwords, don't you?

#21

Post by BenOfTomorrow »

mncolinlee wrote: post #16
BenOfTomorrow wrote: post #13

Earlier quoted context omitted.

I put a copy of the database in cloud storage. There might be a little set-up to open it, but it's very rare that I need to get the contents on a new machine. The nitpick with pw databases is they don't fully solve the problem; I still need to know the passwords for all my computers, cloud storage account, e-mail, the db master password. The big advantage is how much more secure lesser used accounts are (and drop in…

This is not entirely true. You only need to really "know" two passwords... your cellphone screen lock and the password to the encrypted password database on your cellphone. If your cellphone uses DropBox to store the database, then you can even lose your cellphone or simply access the database on desktops and laptops directly.

While this is true in theory, I don't maintain a copy of the database on my phone - when I converted to using a pw database I looked into it and didn't feel comfortable with the level of security on iPhone apps. I want to know exactly when and how information is being transported and when something is in memory.

The state of the art is probably more mature now, but this is information I'm not taking any chances with.

Re: You have exactly three passwords, don't you?

#22

Post by fernandotakai »

snprbob86 wrote: post #10
krakensden wrote: post #8

The problem with password managers is, when you're away from whatever machine you managed to get the thing set up on, you're locked out of all your accounts.

The 1Password iPhone app has pretty much solved that problem for me: http://itunes.apple.com/us/app/1password-pro/id319898689?mt=...

Same thing for android https://market.android.com/details?id=com.onepassword.passwo...

Also, if you share your 1password db on dropbox, you can later access it via a local web interface (always making sure that you trust the machine you're using).

Re: You have exactly three passwords, don't you?

#23

Post by waqf »

jjcm wrote: post #12
Macha wrote: post #4

Earlier quoted context omitted.

My bank is worse. They state alphanumeric, their form enforces alphabetic. 6-8 letters. Oh, and did I mention its case insensitive? The card number provides more security than the password. I can only hope that the case insensitivity is because they're running it through the COBOL equivalent of .tolower() before hashing it, bit given the track record? It's more likely than not they're storing it in plaintext. Just as…

Out of curiosity, what's keeping you from switching banks? If my bank did this, I'd switch immediately. Any bank that shows that level of concern for my finances doesn't deserve to be controlling them.

If you work in the US, you tend not to have that luxury with your 401k. Your employer picks the financial institution and you're stuck with it. See also health insurance.

Re: You have exactly three passwords, don't you?

#25

Post by Macha »

jjcm wrote: post #12
Macha wrote: post #4

Earlier quoted context omitted.

My bank is worse. They state alphanumeric, their form enforces alphabetic. 6-8 letters. Oh, and did I mention its case insensitive? The card number provides more security than the password. I can only hope that the case insensitivity is because they're running it through the COBOL equivalent of .tolower() before hashing it, bit given the track record? It's more likely than not they're storing it in plaintext. Just as…

Out of curiosity, what's keeping you from switching banks? If my bank did this, I'd switch immediately. Any bank that shows that level of concern for my finances doesn't deserve to be controlling them.

Because they're the only Irish bank to give a Visa Debit card on student accounts.

Re: You have exactly three passwords, don't you?

#26

Post by DieBuche »

Is there any reason for the often-repeated advise to change pws regularly? If I have a unique password like vdknzB4XoAiJIpjlN3PGf for every account, what would changing it protect me against? Hardly keyloggers, because then changing it twice a year is probably too late.

Re: You have exactly three passwords, don't you?

#27

Post by code_duck »

krakensden wrote: post #8

The problem with password managers is, when you're away from whatever machine you managed to get the thing set up on, you're locked out of all your accounts.

Do browsers sync these yet? I know Chrome, Firefox et al. have various syncing options, but I've never looked into how they work exactly.

Edit: looked into it, and the situation for password sync is

- Chrome: built in since V. 11

- Firefox: available through add-ons/extensions (XMarks)

- Opera: since beta 11.5 (the latest as of right now)

- Safari: available through extensions/other services (mobileme? not sure)

- IE: unclear

Re: You have exactly three passwords, don't you?

#30

Post by dpres »

marshray wrote: post #9
pavel_lishin wrote: post #2

Some systems don't require a complex password. I don't care if someone breaks into the game center thing on the iphone because my password is prettypony2 - what are they going to do, erase my high scores on Tetris? I'm sure as hell not copying and pasting a 16 character password between the LastPass app every time.

what are they going to do, erase my high scores on Tetris? Statistics show that most users use the same password everywhere, or at least at many different sites. I don't know about you in particular, but for any given compromised set of emails and passwords a large number of them are going to work at gmail, facebook, their bank, etc.

The passwords won't work at Gmail if the sheep enabled 2-step authentication.
Post reply on HN