Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You have exactly three passwords, don't you?

pcmag.com

Post reply on HN
Print view View original

51–60 of 86 posts

Re: You have exactly three passwords, don't you?

#51

Post by chrishenn »

27182818284 wrote: post #14

I started using pwgen for passwords. These are long passwords containing symbols, letters, and numbers and nothing resembling a word. What I find interesting is that I don't know what any of the passwords actually are. Instead, I simply have the muscle memory to type them. This is a problem if I have to remember that same password for the website's new app on my phone. In that case, I have to sit next to an actual ke…

I also use pwgen to generate passwords, but I tend to throw in a special character (like -, *, or #).

pwgen's ability to generate pronounceable yet random passwords is why I use it. As you said, they just seem to be easy to remember.

Re: You have exactly three passwords, don't you?

#52

Post by lazyjeff »

arjunnarayan wrote: post #38

Yes. This is why I use a password hash function. The exact Hash function is in my head (and only my head), although it requires a lookup table for random bits. The lookup table is typically a poem, (when I was younger, I would use digits of pi, but I consider that insecure now), but can really be any sequence of words about 50+ that I can reproduce pretty much instantaneously. The exact hash algorithm is my secret, b…

How do you deal with the url if it can change?

For example, you register for example.com on http://register.example.com and then login on https://login.example.com and in the future they may change it to https://examplelogin.com/auth/

Or what if the company changes name? For example, I used to log into my bank on http://wamu.com and now they are bought by Chase so it's http://chase.com

Re: You have exactly three passwords, don't you?

#53

Post by code_duck »

sid0 wrote: post #37
code_duck wrote: post #27

Earlier quoted context omitted.

Do browsers sync these yet? I know Chrome, Firefox et al. have various syncing options, but I've never looked into how they work exactly. Edit: looked into it, and the situation for password sync is - Chrome: built in since V. 11 - Firefox: available through add-ons/extensions (XMarks) - Opera: since beta 11.5 (the latest as of right now) - Safari: available through extensions/other services (mobileme? not sure) - IE…

Firefox 4 and up have built-in password syncing (along with bookmarks, history etc). Everything's encrypted client-side, so you never have to worry about unauthorized access to them.

Thanks, interesting that this didn't show up in my brief research.

Re: You have exactly three passwords, don't you?

#54

Post by Xurinos »

DieBuche wrote: post #26

Is there any reason for the often-repeated advise to change pws regularly? If I have a unique password like vdknzB4XoAiJIpjlN3PGf for every account, what would changing it protect me against? Hardly keyloggers, because then changing it twice a year is probably too late.

Yes. Very often, administrators and victims do not know when their password is compromised. The policy of changing it is to cut present access off from those who already obtained it. It is just an additional safeguard over intrusion detection systems.

Re: You have exactly three passwords, don't you?

#55

Post by tedunangst »

lazyjeff wrote: post #52
arjunnarayan wrote: post #38

Yes. This is why I use a password hash function. The exact Hash function is in my head (and only my head), although it requires a lookup table for random bits. The lookup table is typically a poem, (when I was younger, I would use digits of pi, but I consider that insecure now), but can really be any sequence of words about 50+ that I can reproduce pretty much instantaneously. The exact hash algorithm is my secret, b…

How do you deal with the url if it can change? For example, you register for example.com on http://register.example.com and then login on https://login.example.com and in the future they may change it to https://examplelogin.com/auth/ Or what if the company changes name? For example, I used to log into my bank on http://wamu.com and now they are bought by Chase so it's http://chase.com

You remember what the url used to be. This happens to work much better than browser plugins which are unaware of such changes.

Re: You have exactly three passwords, don't you?

#56

Post by keeperofdakeys »

AndyKelley wrote: post #49

I thought the second part of his conclusion was a bit hasty: "... and change all your logins every six months at least." Does he have any idea how impractical this is? If I could even remember every login I ever made, it would probably take more than 12 hours to do the manual labor of changing the password for them. No thank you!

I think it is more for your important services. Also, if you are using a password manager, you DO have every password you ever made.

Re: You have exactly three passwords, don't you?

#57

Post by city41 »

AndyKelley wrote: post #49

I thought the second part of his conclusion was a bit hasty: "... and change all your logins every six months at least." Does he have any idea how impractical this is? If I could even remember every login I ever made, it would probably take more than 12 hours to do the manual labor of changing the password for them. No thank you!

Forced changing of passwords every x months is pretty common in the workplace, especially if the company is Windows based.

The problem is it's so easy to make your passwords be +1, then +2, etc. I've worked at places that detected that pattern and didn't allow it, so I would just hold down the shift key and iterate anyway, yielding +!, then +@, +#, etc.

So even forcing your users to change their passwords will most likely cause them to find a way around it. IMO the problem is passwords are inherently a flawed concept. We need something better. Hopefully biometrics can truly solve this problem one day.

Re: You have exactly three passwords, don't you?

#58

Post by orofino »

jbk wrote: post #43
reemrevnivek wrote: post #32

Earlier quoted context omitted.

Isn't this vulnerable to someone guessing the prefix if the password is compromised? This assumes that you're up against identity theft, not automated spamming, but the algorithm you're using to hide the prefix isn't very robust. Does this matter to you?

This isn't the actual algorithm I am using, but was just an example to make my point. But true, this isn't perfect, but just makes one step more complex, without having to use an external password manager...

I do something similar, however I take a portion of the site name an intersperse it throughout the stronger password in set positions. I could modify case of the site name snippet, however I do not currently.

While this is certainly relying on obscurity, it at least makes it much more difficult to figure out what is going on. I'd think you'd need access to two of my passwords in plain text in order to really figure it out.

My lastpass password is a 29 character password comprised of 3 parts, one of which is this pattern, the other two are 'secure' passwords i've used in the past but haven't been compromised to my knowledge.

Even with all of this - if one password was compromised in plain text I would likely abandon all of my passwords and try again with something new.

Re: You have exactly three passwords, don't you?

#59

Post by [deleted] »

lazyjeff wrote: post #52
arjunnarayan wrote: post #38

Yes. This is why I use a password hash function. The exact Hash function is in my head (and only my head), although it requires a lookup table for random bits. The lookup table is typically a poem, (when I was younger, I would use digits of pi, but I consider that insecure now), but can really be any sequence of words about 50+ that I can reproduce pretty much instantaneously. The exact hash algorithm is my secret, b…

How do you deal with the url if it can change? For example, you register for example.com on http://register.example.com and then login on https://login.example.com and in the future they may change it to https://examplelogin.com/auth/ Or what if the company changes name? For example, I used to log into my bank on http://wamu.com and now they are bought by Chase so it's http://chase.com

[deleted]

Re: You have exactly three passwords, don't you?

#60

Post by andre »

bostonpete wrote: post #41
andre wrote: post #15

Earlier quoted context omitted.

this. I use Dropbox with Keepass and Truecrypt. You can get these apps anytime from the web, put on USB keychain, or just remember Dropbox and run Keepass and Truecrypt from there. Just make sure to have a very long/secure Dropbox password, as that becomes the weakest link. There's also Dropbox and Keepass for Android.

I use Keepass, but thought it took care of encryption for me. Is there a compelling reason to use additional encryption...?

The extra encryption is mostly for keys that I use with the passwords on Keepass.
Post reply on HN