Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You have exactly three passwords, don't you?

pcmag.com

Post reply on HN
Print view View original

81–86 of 86 posts

Re: You have exactly three passwords, don't you?

#81

Post by mattmanser »

tucosan wrote: post #79
arjunnarayan wrote: post #38

Yes. This is why I use a password hash function. The exact Hash function is in my head (and only my head), although it requires a lookup table for random bits. The lookup table is typically a poem, (when I was younger, I would use digits of pi, but I consider that insecure now), but can really be any sequence of words about 50+ that I can reproduce pretty much instantaneously. The exact hash algorithm is my secret, b…

Actually I like your idea of using a hash function. While thinking about your solution, I remembered that pwgen on linux (I believe its also available for windows) allows you to create a recoverable password using a sha1 hash of any file and a seed. e.g.: pwgen -1 -H yourfile#url.tld should allow you to create a unique password for each site, and it would be easily scriptable.

The point of his method is that it's a unique password which a human can recover just by looking at the url.

No batteries required.

I have a similar method, though less secure than his.

Re: You have exactly three passwords, don't you?

#82

Post by wladimir »

nametoremember wrote: post #76
billybob wrote: post #75

I have a unique, random password for nearly every account I have (with a few throwaway exceptions). I store them all in a file, encrypted with a master password, and sync that file to all my machines using Dropbox. I open and modify the file with Password Gorilla on Mac and Linux and PasswordSafe on Windows. Both programs read/write the same file format and allow you to create any internal hierarchy you want (eg Stor…

Do you go into the file, look up the website/account and then copy the password to paste it into the password field on the website - every time? I don't think most people are willing to do this. I know I'm not.

Nope. I just click "remember password" in my browser after the first time.

At least for most sites. For banks and really important stuff I usually do memorize the password myself or copy it from the encrypted file.

Re: You have exactly three passwords, don't you?

#83

Post by pavel_lishin »

lambada wrote: post #19
pavel_lishin wrote: post #2

Some systems don't require a complex password. I don't care if someone breaks into the game center thing on the iphone because my password is prettypony2 - what are they going to do, erase my high scores on Tetris? I'm sure as hell not copying and pasting a 16 character password between the LastPass app every time.

Given that the gamecenter password is the same as your iTunes / Apple account password, they could wipe out your account balance by buying / renting things. If you have any card details stored then they could go onto the Apple Store and order using those. They could see your billing address, and so intercept your mail, thus gaining more documents to eventually steal your identity. Of course, if you only buy using the…

Hm, I didn't realize that it was the same as my Apple account. I think I'll go change that, now. :)

Re: You have exactly three passwords, don't you?

#84

Post by pavel_lishin »

marshray wrote: post #9
pavel_lishin wrote: post #2

Some systems don't require a complex password. I don't care if someone breaks into the game center thing on the iphone because my password is prettypony2 - what are they going to do, erase my high scores on Tetris? I'm sure as hell not copying and pasting a 16 character password between the LastPass app every time.

what are they going to do, erase my high scores on Tetris? Statistics show that most users use the same password everywhere, or at least at many different sites. I don't know about you in particular, but for any given compromised set of emails and passwords a large number of them are going to work at gmail, facebook, their bank, etc.

Me in particular uses different passwords for different accounts, but you're right - most people probably use "bob123" for everything from their bank account to their email.

Re: You have exactly three passwords, don't you?

#85

Post by ap22213 »

arjunnarayan wrote: post #38

Yes. This is why I use a password hash function. The exact Hash function is in my head (and only my head), although it requires a lookup table for random bits. The lookup table is typically a poem, (when I was younger, I would use digits of pi, but I consider that insecure now), but can really be any sequence of words about 50+ that I can reproduce pretty much instantaneously. The exact hash algorithm is my secret, b…

Yes! I've been using this method for years. But, similar to the article's premise, I actually have four different hash functions, of increasing complexity. Then, all I have to remember is what's the URL, what's its general level of data security, and what's the hash function for that level of security. The simplest hash is trivial to apply and can be done in real-time, but the most complex hash actually requires me to spend a minute or so to calculate.

Re: You have exactly three passwords, don't you?

#86

Post by lambada »

terinjokes wrote: post #46
lambada wrote: post #19

Earlier quoted context omitted.

Given that the gamecenter password is the same as your iTunes / Apple account password, they could wipe out your account balance by buying / renting things. If you have any card details stored then they could go onto the Apple Store and order using those. They could see your billing address, and so intercept your mail, thus gaining more documents to eventually steal your identity. Of course, if you only buy using the…

Not entirely true, Game Center can be setup to use a separate Apple Account than the rest of the phone…

Really? Hmm, mut have missed that option when setting it up; although I suspect the vast majority of people dont realise that either.
Post reply on HN