Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down (2010)

blog.jgc.org

Post reply on HN
Print view View original

51–60 of 196 posts

Re: Write your passwords down (2010)

#51

Post by moron4hire »

lobsterthief wrote: post #16
EdTechAndrew wrote: post #4

Question for security experts: Is this really that much more secure than a local only password manager, like KeePass? It is fun, but the inconvenience of it feels like its not worth the benefits.

Also, wallets are commonly lost and stolen. And houses burn down and are burglarized. Unless you plan on keeping your passwords in a fireproof safe, which isn’t exactly convenient—especially in our modern mobile world. In 2010, when this article was written, far fewer people did this much computing from a smartphone.

Times in the last 40 years that...

  My wallet has been stolen: 0
  My house has burned down: 0
  LastPass has been breached: 2+
  LastPass' browser extension has caused me headaches: 9000+

Re: Write your passwords down (2010)

#53

Post by gostsamo »

teddyh wrote: post #22
gostsamo wrote: post #2

Don't use fancy combinations. Word phrases are even more random and much easier to remember. E.G. "touch-some-grass" is rander longer than any recommended minimum and hardly could be connected to any website.

Your example is misleading; “touch-some-grass” is hardly random. “horse-battery-staple-correct" is presumably randomly chosen, and is therefore a better example phrase.

Yep, lazy example, but even grammatically correct sentences are a lot. The idea though is for the passphrase to be something invoking a distinct image for the owner and I'm coming from a vacation. :)

Re: Write your passwords down (2010)

#54

Post by michaelt »

AtNightWeCode wrote: post #18
jug wrote: post #9

Earlier quoted context omitted.

Max lengths are so sketchy because this makes it more likely the crazy guys are actually storing your password rather than the fixed size hash.

Passwords are sent to the server though in most cases. So there must be some limit.

If you don't let your users upload a 3GB Shrek dvdrip as their password, do you even care about security?

Re: Write your passwords down (2010)

#55

Post by ndriscoll »

cubefox wrote: post #35
teddyh wrote: post #22

Earlier quoted context omitted.

Your example is misleading; “touch-some-grass” is hardly random. “horse-battery-staple-correct" is presumably randomly chosen, and is therefore a better example phrase.

I'm not sure how safe this is against dictionary attacks. And it's still not overly easy to remember.

It's 100% safe from dictionary attacks. You can even make it grammatically correct. Just choose something like adjective-noun-adverb-transitive_verb-adjective-noun.

If you choose each of six words randomly from a list of the 2k most common words with that part of speech, you get 66 bits of entropy, which is slightly more entropy than a random 11 character alphanumeric password with upper and lower case, but vastly easier to remember, type, and say out loud if you need to tell someone.

Think of the words as just a view/rendering of a random bit string. You generate random numbers and then use that to index into your word lists to display those numbers. If you use an injective function for your view, you can choose it to have whatever "nice" (for humans) properties you want (e.g. grammatical validity), and no entropy will be lost (or gained).

Re: Write your passwords down (2010)

#56

Post by falcolas »

gochi wrote: post #43
hirundo wrote: post #21

Earlier quoted context omitted.

The KeePass unhosted ecosystem seems to fit your requirements. I recently switched to it from 1Password and am happy with it. I distribute the database to my various devices with (open source) Syncthing.

The distributed part is crucial, especially to avoid potential hardware failure. Happened to me, older machine ram (might be misremembering, that old machine had several parts replaced) failure made keypass unable to validate, claiming a corrupt database.

A problem solved by a backup strategy, not a cloud service.

I firmly believe you can't expect cloud services to do anything but serve up exactly what you give them. If you give them a corrupt database, they will happily serve you up a corrupted database.

Re: Write your passwords down (2010)

#57

Post by falcolas »

mcny wrote: post #29
AtNightWeCode wrote: post #18

Earlier quoted context omitted.

Passwords are sent to the server though in most cases. So there must be some limit.

What should this limit be? Personally, I think the limit should be nothing smaller than a thousand characters. Or even allowing something like a hundred characters or more would be better. I remember at some point Hotmail had a maximum length limit of sixteen characters. https://arstechnica.com/information-technology/2012/09/secre...

100Kb is a perfectly reasonable length IMO. Only takes seconds to send even over terrible links.

Re: Write your passwords down (2010)

#58

Post by ethbr0 »

yomlica8 wrote: post #50
ethbr0 wrote: post #24

Earlier quoted context omitted.

Iterate a pre/suffix number? I've never had a site do any substring historical matching.

> I've never had a site do any substring historical matching. Would this even be possible if the password is properly stored after salt+hash?

Good point. No. (Slurps more coffee)

Re: Write your passwords down (2010)

#59

Post by tstrimple »

moron4hire wrote: post #51
lobsterthief wrote: post #16

Earlier quoted context omitted.

Also, wallets are commonly lost and stolen. And houses burn down and are burglarized. Unless you plan on keeping your passwords in a fireproof safe, which isn’t exactly convenient—especially in our modern mobile world. In 2010, when this article was written, far fewer people did this much computing from a smartphone.

Times in the last 40 years that... My wallet has been stolen: 0 My house has burned down: 0 LastPass has been breached: 2+ LastPass' browser extension has caused me headaches: 9000+

The piece of paper in wallet browser extension is even worse. No auto-fill or auto-update options at all and you've got to take care of your own backups and recovery.

Re: Write your passwords down (2010)

#60

Post by ethbr0 »

rkangel wrote: post #31
Obscurity4340 wrote: post #26

Earlier quoted context omitted.

Bitwarden. Its dead simple and cross-platform + regularly audited. And either FREE or $10 a year for 2FA and some other nice to haves. Obviously there's other choices for those who want more control over it but you can't go wrong with BW.

I am currently trialling Bitwarden. I have found that it's not that great at picking up that you are creating an account, offering to generate and then saving the result (using Firefox with Bitwarden extension). I am looking at the other options as they are reportedly better at that sort of thing. It's a shame though because Bitwarden is philosophically what I'm looking for.

Think you might have missed a not in there, if I'm reading sentiment correctly. "...found that it's that great..."
Post reply on HN