Live data from Hacker News

Write your passwords down (2010)

blog.jgc.org

61–70 of 196 posts

Re: Write your passwords down (2010)

#61
post #29

Earlier quoted context omitted.

Passwords are sent to the server though in most cases. So there must be some limit.

What should this limit be? Personally, I think the limit should be nothing smaller than a thousand characters. Or even allowing something like a hundred characters or more would be better. I remember at some point Hotmail had a maximum length limit of sixteen characters. https://arstechnica.com/information-technology/2012/09/secre...

256 is fine in most user scenarios. No one will type in more chars than that anyway. And if a pw manager is used the length is not really a problem.

For services there are often better alternatives.

Re: Write your passwords down (2010)

#62
post #22

Earlier quoted context omitted.

Your example is misleading; “touch-some-grass” is hardly random. “horse-battery-staple-correct" is presumably randomly chosen, and is therefore a better example phrase.

Yep, lazy example, but even grammatically correct sentences are a lot. The idea though is for the passphrase to be something invoking a distinct image for the owner and I'm coming from a vacation. :)

Yes, it’s all fine if it is actually randomly chosen, with enough bits: https://news.ycombinator.com/item?id=14970652>

Re: Write your passwords down (2010)

#63

Earlier quoted context omitted.

Passwords are sent to the server though in most cases. So there must be some limit.

If you don't let your users upload a 3GB Shrek dvdrip as their password, do you even care about security?

What? I always use my daily backup of the Internet as the pw every time I sign up for something.

Re: Write your passwords down (2010)

#64
post #11

Algorithmically generated passwords for different sites was a mind-blower. There are so many differentiation algorithms that are trivially runnable in your head. If most sites are salting and hashing passwords correctly (this is 2023...), then that drastically decreases your compromised credential blast radius. -- And it makes me sad that "store your passwords on dead-tree paper" became GOTO. It has serious weaknesse…

> If most sites are salting and hashing passwords correctly

Wouldn't it have to be "if all sites are salting and hashing passwords correctly "? I suspect most "differentiation algorithms that are trivially runnable in your head" would be easily cracked with a couple examples.

Re: Write your passwords down (2010)

#65
To be honest, I think that the method described in TFA is overkill and unnecessarily limiting. I would instead recommend simply writing your passwords down manually and keeping them (unlabelled) in a safe place. That is, unless there are specific reasons not to do so such as you cannot trust your live-in partner or housemates, or your threat model honestly includes a targeted burglary to your home.

As long as you write down your passwords without the account name, without the title "Passwords", and ideally without even explicitly referencing what service they are the passwords for (as long as you don't need to keep track of too many of them), you are perfectly fine. And even of you do need to clarify which one is Google, which one is AWS, which one is banking, you can always come up with personal mnemonics that only you would understand how they relate to each account (e.g. "The one with the hug from Paul", "Green beans", "The one that tried to get away", etc.).

A burglar will almost certainly not even bother taking a bit of paper or notebook with random gibberish, and even if they do they won't have the slightest inclination to try to hack into your accounts (which accounts? they are not in the notebook!).

And if you're still worried about this hypothetical scenario, just agree with yourself to "salt" every password you write down by concatenating for instance 3 irrelevant random characters (or words, if using passphrases) on one end. If somebody breaking into your home, stealing your notebook, finding your Google account handle, and trying every single one of the j39yb1!L8q#4$1-like strings they found in it, and trying every version after removing the first/last n characters is a more realistic scenario than losing access to your digitally-stores passwords you live a much more exiciting life than most HN commenters.

Re: Write your passwords down (2010)

#66
post #2

Don't use fancy combinations. Word phrases are even more random and much easier to remember. E.G. "touch-some-grass" is rander longer than any recommended minimum and hardly could be connected to any website.

But with transformer models it would probably be trivial to predict the top 10 next words if your passphrase is grammatically correct. Interesting password cracker idea …

Re: Write your passwords down (2010)

#67

Question for security experts: Is this really that much more secure than a local only password manager, like KeePass? It is fun, but the inconvenience of it feels like its not worth the benefits.

I am not a security expert. But this method I think I could teach my aging parents. Password managers don't work with them, too confusing. Just a simple OAUTH dialog causes a 30 minute phone call with them.

Re: Write your passwords down (2010)

#68
All I got out of this blog entry is that if I were a thief and I managed to steal this fellow's wallet, I would find the piece of paper in his wallet along with his ID card. I would then Google his name to find this blog post, which will helpfully allow me to decrypt his passwords.

Re: Write your passwords down (2010)

#69

Question for security experts: Is this really that much more secure than a local only password manager, like KeePass? It is fun, but the inconvenience of it feels like its not worth the benefits.

Also, wallets are commonly lost and stolen. And houses burn down and are burglarized. Unless you plan on keeping your passwords in a fireproof safe, which isn’t exactly convenient—especially in our modern mobile world. In 2010, when this article was written, far fewer people did this much computing from a smartphone.

Oh come ON.

Nowhere NEAR as common, in terms of people affected, as "breaches due to crap companies/software promising safety and not delivering."

Re: Write your passwords down (2010)

#70
post #24

Earlier quoted context omitted.

Iterate a pre/suffix number? I've never had a site do any substring historical matching.

> I've never had a site do any substring historical matching. Would this even be possible if the password is properly stored after salt+hash?

Technically yes, you could hash every substring of the new password and check them against the database. But is probably too much trouble for what is worth it
Post reply on HN