Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down (2010)

blog.jgc.org

Post reply on HN
Print view View original

31–40 of 196 posts

Re: Write your passwords down (2010)

#31

Post by rkangel »

Obscurity4340 wrote: post #26
ethbr0 wrote: post #11

Algorithmically generated passwords for different sites was a mind-blower. There are so many differentiation algorithms that are trivially runnable in your head. If most sites are salting and hashing passwords correctly (this is 2023...), then that drastically decreases your compromised credential blast radius. -- And it makes me sad that "store your passwords on dead-tree paper" became GOTO. It has serious weaknesse…

Bitwarden. Its dead simple and cross-platform + regularly audited. And either FREE or $10 a year for 2FA and some other nice to haves. Obviously there's other choices for those who want more control over it but you can't go wrong with BW.

I am currently trialling Bitwarden. I have found that it's not that great at picking up that you are creating an account, offering to generate and then saving the result (using Firefox with Bitwarden extension). I am looking at the other options as they are reportedly better at that sort of thing.

It's a shame though because Bitwarden is philosophically what I'm looking for.

Re: Write your passwords down (2010)

#32

Post by TedDoesntTalk »

AtNightWeCode wrote: post #18
jug wrote: post #9

Earlier quoted context omitted.

Max lengths are so sketchy because this makes it more likely the crazy guys are actually storing your password rather than the fixed size hash.

Passwords are sent to the server though in most cases. So there must be some limit.

A few MB is acceptable for https POST these days. This gets hashed down to 64 chars or whatever.

Re: Write your passwords down (2010)

#33

Post by Eric_WVGG »

pajko wrote: post #25
gostsamo wrote: post #2

Don't use fancy combinations. Word phrases are even more random and much easier to remember. E.G. "touch-some-grass" is rander longer than any recommended minimum and hardly could be connected to any website.

There's an xkxd for this: https://xkcd.com/936/ And yet our infrastructure demands so obscure passwords I keep forgetting them all the time.

There's an understated bonus to "correct horse battery staple" passwords — they're easier to type on iPhone and Android keyboards.

So besides being of questionable security benefits, 0bScur3 passwords also bonk that advantage of nice-long-easy-to-remember passwords.

Re: Write your passwords down (2010)

#34

Post by monsieurbanana »

AtNightWeCode wrote: post #18
jug wrote: post #9

Earlier quoted context omitted.

Max lengths are so sketchy because this makes it more likely the crazy guys are actually storing your password rather than the fixed size hash.

Passwords are sent to the server though in most cases. So there must be some limit.

Yes but that's not what they're discussing, it's about the sites that have some low limit like 8-16 characters.

And if someone knows why banks are specially prone to having crapshit password requirements... Flashback to my french bank that had a password that needed to be exactly 8 digits, no letters or other, and that you could only type by clicking on a digital numpad that had the numbers randomly sorted.

Re: Write your passwords down (2010)

#35

Post by cubefox »

teddyh wrote: post #22
gostsamo wrote: post #2

Don't use fancy combinations. Word phrases are even more random and much easier to remember. E.G. "touch-some-grass" is rander longer than any recommended minimum and hardly could be connected to any website.

Your example is misleading; “touch-some-grass” is hardly random. “horse-battery-staple-correct" is presumably randomly chosen, and is therefore a better example phrase.

I'm not sure how safe this is against dictionary attacks. And it's still not overly easy to remember.

Re: Write your passwords down (2010)

#37

Post by legitster »

Unless you are a high profile target, the risk of someone burglarizing your house without you knowing it and actually making use of a password book is virtually nil.

Plus, you should really keep a physical copy of your passwords anyway in case something were to happen to you and your loved ones need access to your accounts, insurance, banking, photos, etc.

Re: Write your passwords down (2010)

#40

Post by Mordisquitos »

badcppdev wrote: post #28

Write down your usernames and account numbers as well. Today my banking app decided to 'forget' my login details. I have the account number available at home but I'm in the office today and so I can't log back into my account. So I can't check balances or approve payments (luckily I'm too busy to spend money)

> Write down your usernames and account numbers as well.

...but not in the same notebook as your passwords! Ideally, don't even store them in two locations which could potentially be compromised simultaneously due to burglary or theft.

Post reply on HN