Write your passwords down (2010) • Hacker News Board

Re: Write your passwords down (2010)

#21

Post by hirundo » Mon, Aug 07, 2023, 1:48 PM UTC

ethbr0 wrote: post #11

Algorithmically generated passwords for different sites was a mind-blower. There are so many differentiation algorithms that are trivially runnable in your head. If most sites are salting and hashing passwords correctly (this is 2023...), then that drastically decreases your compromised credential blast radius. -- And it makes me sad that "store your passwords on dead-tree paper" became GOTO. It has serious weaknesse…

The KeePass unhosted ecosystem seems to fit your requirements. I recently switched to it from 1Password and am happy with it. I distribute the database to my various devices with (open source) Syncthing.

Re: Write your passwords down (2010)

#22

Post by teddyh » Mon, Aug 07, 2023, 1:49 PM UTC

gostsamo wrote: post #2

Don't use fancy combinations. Word phrases are even more random and much easier to remember. E.G. "touch-some-grass" is rander longer than any recommended minimum and hardly could be connected to any website.

Your example is misleading; “touch-some-grass” is hardly random. “horse-battery-staple-correct" is presumably randomly chosen, and is therefore a better example phrase.

Re: Write your passwords down (2010)

#23

Post by choonway » Mon, Aug 07, 2023, 1:49 PM UTC

this is 2023, use KeepassX. If you're really paranoid, store it on a offline laptop.

but if you want real security, use a security token (e.g. yubikey) or some other smartcard solution.

Re: Write your passwords down (2010)

#24

Post by ethbr0 » Mon, Aug 07, 2023, 1:49 PM UTC

ComplexSystems wrote: post #19

What do you do if some website requires you to change your password for some reason? Of course you could use an alternate method - like reading vertically instead of diagonally for that one website - but now you need to remember how many passwords each site has made you generate.

Iterate a pre/suffix number?

I've never had a site do any substring historical matching.

Re: Write your passwords down (2010)

#25

Post by pajko » Mon, Aug 07, 2023, 1:49 PM UTC

gostsamo wrote: post #2

Don't use fancy combinations. Word phrases are even more random and much easier to remember. E.G. "touch-some-grass" is rander longer than any recommended minimum and hardly could be connected to any website.

There's an xkxd for this: https://xkcd.com/936/

And yet our infrastructure demands so obscure passwords I keep forgetting them all the time.

Re: Write your passwords down (2010)

#26

Post by Obscurity4340 » Mon, Aug 07, 2023, 1:50 PM UTC

ethbr0 wrote: post #11

Algorithmically generated passwords for different sites was a mind-blower. There are so many differentiation algorithms that are trivially runnable in your head. If most sites are salting and hashing passwords correctly (this is 2023...), then that drastically decreases your compromised credential blast radius. -- And it makes me sad that "store your passwords on dead-tree paper" became GOTO. It has serious weaknesse…

Bitwarden. Its dead simple and cross-platform + regularly audited. And either FREE or $10 a year for 2FA and some other nice to haves.

Obviously there's other choices for those who want more control over it but you can't go wrong with BW.

Re: Write your passwords down (2010)

#27

Post by tjoff » Mon, Aug 07, 2023, 1:50 PM UTC

sigmonsays wrote: post #8

amelius wrote: post #5

What if the website doesn't allow the characters that you used in the table? What if there are multiple websites with the same 2nd and 3rd characters?

what if the password needs to be changed and previous ones can't be reused (You then must remember that)?

Then for such sites you add the date, maybe in the form of [year][password][courter].

Probably modified somewhat so it isn't obvious what is is.

Re: Write your passwords down (2010)

#28

Post by badcppdev » Mon, Aug 07, 2023, 1:50 PM UTC

Write down your usernames and account numbers as well.

Today my banking app decided to 'forget' my login details. I have the account number available at home but I'm in the office today and so I can't log back into my account. So I can't check balances or approve payments (luckily I'm too busy to spend money)

Re: Write your passwords down (2010)

#29

Post by mcny » Mon, Aug 07, 2023, 1:53 PM UTC

AtNightWeCode wrote: post #18

jug wrote: post #9

Earlier quoted context omitted.

Max lengths are so sketchy because this makes it more likely the crazy guys are actually storing your password rather than the fixed size hash.

Passwords are sent to the server though in most cases. So there must be some limit.

What should this limit be? Personally, I think the limit should be nothing smaller than a thousand characters. Or even allowing something like a hundred characters or more would be better.

I remember at some point Hotmail had a maximum length limit of sixteen characters.

https://arstechnica.com/information-technology/2012/09/secre...

Re: Write your passwords down (2010)

#30

Post by nvahalik » Mon, Aug 07, 2023, 1:54 PM UTC

Zak wrote: post #7

I find it surprising this article doesn't mention password managers, though some comments do. They were already in widespread use in 2010.

> They were already in widespread use in 2010.

I'm interested in knowing the stats of this, but 1Password's first release was mid-2006. I know personally I started using 1Password in late 2008, 2009. But I'd argue even then that they were not "widespread" then and even now are not entirely widespread. (Unless you count Cloud Keychain).

Arguably I think the more security conscious were using them, but even now, after several years, I STILL have to remind my wife about it and to put passwords in there.