81–90 of 196 posts
Earlier quoted context omitted.
Passwords are sent to the server though in most cases. So there must be some limit.
A few MB is acceptable for https POST these days. This gets hashed down to 64 chars or whatever.
EDIT: Down voters. What pw hashing algo are you using instead of BCrypt or similair?
Don't use fancy combinations. Word phrases are even more random and much easier to remember. E.G. "touch-some-grass" is rander longer than any recommended minimum and hardly could be connected to any website.
There's an xkxd for this: https://xkcd.com/936/ And yet our infrastructure demands so obscure passwords I keep forgetting them all the time.
"The specific type of hybrid attack that cracked that password is known as a combinator attack. It combines each word in a dictionary with every other word in the dictionary. Because these attacks are capable of generating a huge number of guesses—the square of the number of words in the dict—crackers often work with smaller word lists or simply terminate a run in progress once things start slowing down. Other times, they combine words from one big dictionary with words from a smaller one. Steube was able to crack "momof3g8kids" because he had "momof3g" in his 111 million dict and "8kids" in a smaller dict.
"The combinator attack got it! It's cool," he said. Then referring to the oft-cited xkcd comic, he added: "This is an answer to the batteryhorsestaple thing.""
The entropy factors I see listed as in the xkcd comic are only valid if the cracking entity is doing a brute force attack. But skilled attacks won't be doing this. There's still nothing that beats a truly random string. But as others pointed out, it's also the most inconvenient to try to manage and remember.
Earlier quoted context omitted.
Max lengths are so sketchy because this makes it more likely the crazy guys are actually storing your password rather than the fixed size hash.
Passwords are sent to the server though in most cases. So there must be some limit.
Do not write your real password. Instead modify it in certain way which is easy to remember: E.g real password is "xB6fqmd$a90". Apply algo: swap 2nd and last char. So store it as: "x06fqmd$a9B" This algo should be easy to remember and there infinite ways to come up with your own algo. Even if your passwords are exposed there is additional protection. In other words you have your own simple symetric encryption with a…
He carefully wrote them in the back of his planner which he keeps in his pocket. Then he realized he needed extra security and added some extra digits before and after.
Then promptly forgot which digits to remove and which to keep.
His new approach is: 1. Pick a “famous” battle 2. Hand me a card and ask me to go to an ATM for him 3. Tell me the PIN is the battle of whatever 4. Yell at me for being an idiot for never having heard of the battle, let alone know the date.
Earlier quoted context omitted.
Bitwarden. Its dead simple and cross-platform + regularly audited. And either FREE or $10 a year for 2FA and some other nice to haves. Obviously there's other choices for those who want more control over it but you can't go wrong with BW.
I am currently trialling Bitwarden. I have found that it's not that great at picking up that you are creating an account, offering to generate and then saving the result (using Firefox with Bitwarden extension). I am looking at the other options as they are reportedly better at that sort of thing. It's a shame though because Bitwarden is philosophically what I'm looking for.
Earlier quoted context omitted.
Passwords are sent to the server though in most cases. So there must be some limit.
The sensible thing to do here is hash the password before sending it, not impose a character limit on the field. Ideally, browsers could even support this directly as part of the input element if they weren't busy adding things no sane person wants like webUSB or browser notifications.
Earlier quoted context omitted.
I am currently trialling Bitwarden. I have found that it's not that great at picking up that you are creating an account, offering to generate and then saving the result (using Firefox with Bitwarden extension). I am looking at the other options as they are reportedly better at that sort of thing. It's a shame though because Bitwarden is philosophically what I'm looking for.
Think you might have missed a not in there, if I'm reading sentiment correctly. "...found that it's that great..."
Question for security experts: Is this really that much more secure than a local only password manager, like KeePass? It is fun, but the inconvenience of it feels like its not worth the benefits.
Earlier quoted context omitted.
I am currently trialling Bitwarden. I have found that it's not that great at picking up that you are creating an account, offering to generate and then saving the result (using Firefox with Bitwarden extension). I am looking at the other options as they are reportedly better at that sort of thing. It's a shame though because Bitwarden is philosophically what I'm looking for.
I noticed that as well, the fix for me is pretty easy: just create the account in bitwarder first and then autofill it in the actual account creation page. No extra work, and becomes habit quite quickly.
Do not do this. It's just crappy security practice. Password managers give you versions & history (you need to rotate passwords occasionally), a TOTP generator+seed store, configurable password generator using a schemes of characters (some websites only allow specific characters), is encrypted at rest & in memory so it's more secure than a piece of paper in your wallet, is backed up online, and of course you only hav…
>Password managers give you versions & history (you need to rotate passwords occasionally), a TOTP generator+seed store, configurable password generator using a schemes of characters (some websites only allow specific characters), is encrypted at rest & in memory so it's more secure than a piece of paper in your wallet, is backed up online, and of course you only have to memorize one master password. (use BitWarden or 1Password, the rest have downsides/limitations)
This depends a lot on your threat model. You basically have three options for password managin, paper, cloud (eg. bitwarden), local (eg. keepass).
Paper is mainly vulnerable to people in your life, government, etc. But your passwords can is safe from malware, digital exploits and so on. The vulnerabilities can be reduced by using a second factor that must be combined with the information in the notebook. The biggest problem with the paper approach is probably accidental loss. It's much more difficult to make backups.
Cloud password managers have plenty of issues. I'll let the LastPass security incident section on Wikipedia speak for itself[0]
Local password managers work, but there are plenty of potential vulnerabilities: Rogue developers, attacks on the development supply chain, local malware, etc. Some of this could be reduced by accessing passwords only in sandboxed OSes. However, nobody does that.
In the end most people end up relying on not being a big target. These methods all work for most people, as long as they aren't the target of a nation state or other big actor.
[0]: https://en.wikipedia.org/wiki/LastPass#Security_incidents