Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You have exactly three passwords, don't you?

pcmag.com

Post reply on HN
Print view View original

71–80 of 86 posts

Re: You have exactly three passwords, don't you?

#71

Post by barrkel »

I have perhaps 6 passwords:

1) My email password, which is randomly generated but memorized, and reused nowhere.

2,3,4) A handful of passwords, call them grade A, B and C, which are used in conjunction with SuperGenPass to generate passwords specific to a website. Only the top level domain is used; for rare cases where the URL changes but the password doesn't (like amazon.co.uk vs amazon.com) I have chosen one TLD as the canonical one. The ratios of usage of A, B and C are approximately 1:2:50. No website I log in to ever shares its literal password with any other.

5) Computer account login password, this is changed every 3 months.

6) Encryption keys passphrase. Should I have anything that I want to keep private and not leak anywhere, or signing keys etc., I use a combination of letters, numbers and symbols, over 40 characters long.

Bank passwords (actually more usually numbers) and the like I have written down, unlabelled, in secure locations and memorized from frequent use.

Re: You have exactly three passwords, don't you?

#72

Post by godDLL »

arjunnarayan wrote: post #38

Yes. This is why I use a password hash function. The exact Hash function is in my head (and only my head), although it requires a lookup table for random bits. The lookup table is typically a poem, (when I was younger, I would use digits of pi, but I consider that insecure now), but can really be any sequence of words about 50+ that I can reproduce pretty much instantaneously. The exact hash algorithm is my secret, b…

So an example of this--if I understand correctly--would be setting the password for `secure.somewat.tld/login?r=dashboard` to, say the first few words with the same letter count as the words in the URL, but taken from a song that I know by heart; like "larger, chasing, 1, makes"?

Re: You have exactly three passwords, don't you?

#73

Post by dave1010uk »

arjunnarayan wrote: post #38

Yes. This is why I use a password hash function. The exact Hash function is in my head (and only my head), although it requires a lookup table for random bits. The lookup table is typically a poem, (when I was younger, I would use digits of pi, but I consider that insecure now), but can really be any sequence of words about 50+ that I can reproduce pretty much instantaneously. The exact hash algorithm is my secret, b…

That's looks like a really good method. How quickly can you compute f(url, poem)? My hash function is f(url, one-of-3-master-passwords) and takes about 5 seconds to calulate.

I always feel like I missed out on being able to do proper hashing functions in my head. When my 8 month old son is old enough I'm planning on training him to be able to compute MD5 and SHA hashes.

Re: You have exactly three passwords, don't you?

#74

Post by sesqu »

bluesmoon wrote: post #61
city41 wrote: post #57

Earlier quoted context omitted.

Forced changing of passwords every x months is pretty common in the workplace, especially if the company is Windows based. The problem is it's so easy to make your passwords be +1, then +2, etc. I've worked at places that detected that pattern and didn't allow it, so I would just hold down the shift key and iterate anyway, yielding +!, then +@, +#, etc. So even forcing your users to change their passwords will most l…

biometrics will still require a fallback for any general purpose system. For example, you can't require fingerprints because there's a chance you'll get users without fingers. You can't require retinal scans because there's a chance you'll get users without eyes. You could probably ask the user to spit and check their DNA, but there's a higher chance of spreading disease that way. Eventually you'll need a fallback of…

Also, fingerprints erode with certain professions and are susceptible to environmental things like sweat and dirt. Retinas change with disease and pregnancy. DNA is far too expensive to use daily, unless you restrict their accuracy to populations.

Re: You have exactly three passwords, don't you?

#75

Post by billybob »

I have a unique, random password for nearly every account I have (with a few throwaway exceptions). I store them all in a file, encrypted with a master password, and sync that file to all my machines using Dropbox. I open and modify the file with Password Gorilla on Mac and Linux and PasswordSafe on Windows.

Both programs read/write the same file format and allow you to create any internal hierarchy you want (eg Stores > Electronics > NewEgg, or News > HackerNews). Password Gorilla's UI is pretty bad, but workable. Both let me copy and paste a password without displaying it on screen.

Works great. I got the idea from Joel Spolsky: http://www.joelonsoftware.com/items/2008/09/11b.html

Re: You have exactly three passwords, don't you?

#76

Post by nametoremember »

billybob wrote: post #75

I have a unique, random password for nearly every account I have (with a few throwaway exceptions). I store them all in a file, encrypted with a master password, and sync that file to all my machines using Dropbox. I open and modify the file with Password Gorilla on Mac and Linux and PasswordSafe on Windows. Both programs read/write the same file format and allow you to create any internal hierarchy you want (eg Stor…

Do you go into the file, look up the website/account and then copy the password to paste it into the password field on the website - every time?

I don't think most people are willing to do this. I know I'm not.

Re: You have exactly three passwords, don't you?

#77

Post by JoeAltmaier »

sesqu wrote: post #74
bluesmoon wrote: post #61

Earlier quoted context omitted.

biometrics will still require a fallback for any general purpose system. For example, you can't require fingerprints because there's a chance you'll get users without fingers. You can't require retinal scans because there's a chance you'll get users without eyes. You could probably ask the user to spit and check their DNA, but there's a higher chance of spreading disease that way. Eventually you'll need a fallback of…

Also, fingerprints erode with certain professions and are susceptible to environmental things like sweat and dirt. Retinas change with disease and pregnancy. DNA is far too expensive to use daily, unless you restrict their accuracy to populations.

...and biometrics are not authentication, just simple access control. Many, many of us have the same biometrics - its a hash. Its hardly better than a garage door opener.

Re: You have exactly three passwords, don't you?

#78

Post by JoeAltmaier »

So many sites require passwords that shouldn't. I feel jerked around - Jump thru this hoop! Make up a better password! Bark like a dog!

I say, screw you. I use a lame password for all that, and a lame username too. It makes me feel better.

For real security, I can use a better password. But somebody explain how constraining passwords improves security? IF the hacker Knows it contains special characters or whatever, doesn't that Simplify the password space? Sure, simple combinatorics says there are more passwords if you use a larger alphabet. But you simultaneously Remove the space of all possible passwords that didn't happen to have 'special' characters.

Re: You have exactly three passwords, don't you?

#79

Post by tucosan »

arjunnarayan wrote: post #38

Yes. This is why I use a password hash function. The exact Hash function is in my head (and only my head), although it requires a lookup table for random bits. The lookup table is typically a poem, (when I was younger, I would use digits of pi, but I consider that insecure now), but can really be any sequence of words about 50+ that I can reproduce pretty much instantaneously. The exact hash algorithm is my secret, b…

Actually I like your idea of using a hash function.

While thinking about your solution, I remembered that pwgen on linux (I believe its also available for windows) allows you to create a recoverable password using a sha1 hash of any file and a seed. e.g.:

  pwgen -1 -H yourfile#url.tld
should allow you to create a unique password for each site, and it would be easily scriptable.
Post reply on HN