Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down (2010)

blog.jgc.org

Post reply on HN
Print view View original

91–100 of 196 posts

Re: Write your passwords down (2010)

#91

Post by iLoveOncall »

falcolas wrote: post #57
mcny wrote: post #29

Earlier quoted context omitted.

What should this limit be? Personally, I think the limit should be nothing smaller than a thousand characters. Or even allowing something like a hundred characters or more would be better. I remember at some point Hotmail had a maximum length limit of sixteen characters. https://arstechnica.com/information-technology/2012/09/secre...

100Kb is a perfectly reasonable length IMO. Only takes seconds to send even over terrible links.

It becomes problematic when it needs to be hashed, you can essentially DDOS servers by sending extremely long passwords that need to be hashed.

Re: Write your passwords down (2010)

#93

Post by conkeisterdoor »

normalaccess wrote: post #77

There is a slightly more powerful approach developed by Steve Gibson (from the security now podcast) called "Off the Grid" if anyone is interested. It has a few more features baked in and a nice generator to play with. I highly recommend giving it a look. https://www.grc.com/offthegrid.htm

This is super cool, I love it and am going to give it a try. Thanks for sharing!

Re: Write your passwords down (2010)

#94

Post by NikkiA »

skerit wrote: post #3
gostsamo wrote: post #2

Don't use fancy combinations. Word phrases are even more random and much easier to remember. E.G. "touch-some-grass" is rander longer than any recommended minimum and hardly could be connected to any website.

Exactly, using phrases is so much nicer and better in every way. It annoys me when sites demand a password should have a special character or upper case letter in it. Or even worse: a max length.

Until you hit a site that silently drops everything after the first space in your, now 5-6 character, pass phrase.

Re: Write your passwords down (2010)

#95

Post by NikkiA »

tjoff wrote: post #27
sigmonsays wrote: post #8

Earlier quoted context omitted.

what if the password needs to be changed and previous ones can't be reused (You then must remember that)?

Then for such sites you add the date, maybe in the form of [year][password][courter]. Probably modified somewhat so it isn't obvious what is is.

This reminds me of a time I was working for a company that motorola contracted, they sent us a system to install some software on, but forgot to set the root password to something shared with us.

When told, they said 'sigh you'll have to ship it back to us so we can passwd it, then ship it back, even though our passwords are system specific and changed frequently - telling you the password would expose our password choice algorithm'

We theorised it was probably "AlorotoMAug"

Re: Write your passwords down (2010)

#96

Post by ndriscoll »

ckozlowski wrote: post #82
pajko wrote: post #25

Earlier quoted context omitted.

There's an xkxd for this: https://xkcd.com/936/ And yet our infrastructure demands so obscure passwords I keep forgetting them all the time.

There was an arstechnica article a while back with a password cracker (person) who had an answer for this: https://arstechnica.com/information-technology/2013/05/how-c... "The specific type of hybrid attack that cracked that password is known as a combinator attack. It combines each word in a dictionary with every other word in the dictionary. Because these attacks are capable of generating a huge number of guesses—t…

The xkcd method is a truly random string with 44 bits in the example (4 words each chosen from a 2k dictionary). There is no better way to crack it than brute force. The words are just a rendering of a 44 bit random number. You could also render it as 44 digit binary number or an 11 digit decimal number or as an 8 digit base 64 string. It doesn't matter; it's still a 44 bit number and requires exactly as much work to crack.

Re: Write your passwords down (2010)

#97

Post by gochi »

falcolas wrote: post #56
gochi wrote: post #43

Earlier quoted context omitted.

The distributed part is crucial, especially to avoid potential hardware failure. Happened to me, older machine ram (might be misremembering, that old machine had several parts replaced) failure made keypass unable to validate, claiming a corrupt database.

A problem solved by a backup strategy, not a cloud service. I firmly believe you can't expect cloud services to do anything but serve up exactly what you give them. If you give them a corrupt database, they will happily serve you up a corrupted database.

Technically, the problem is solved by either one. A service like 1password is in the business of not serving you up a corrupt database. A backup solution also works here if you don't want to rely on other services.

Re: Write your passwords down (2010)

#98

Post by ndriscoll »

ipython wrote: post #66
gostsamo wrote: post #2

Don't use fancy combinations. Word phrases are even more random and much easier to remember. E.G. "touch-some-grass" is rander longer than any recommended minimum and hardly could be connected to any website.

But with transformer models it would probably be trivial to predict the top 10 next words if your passphrase is grammatically correct. Interesting password cracker idea …

Done correctly, you choose words (uniformly) randomly from some dictionary, so the best a model can do is predict that all words from the dictionary are equally likely. All a model does is approximate probabilitly distributions, but the distribution isn't a secret; it's uniform. The dictionary doesn't need to be a secret either. The strength comes from the dictionary size and number of words.

Re: Write your passwords down (2010)

#99

Post by pkulak »

ComplexSystems wrote: post #19

What do you do if some website requires you to change your password for some reason? Of course you could use an alternate method - like reading vertically instead of diagonally for that one website - but now you need to remember how many passwords each site has made you generate.

Or if your random selection happens to be all lowercase chars and the site flips out? Companies are too stupid about password requirements to make a scheme like this work, unfortunately. I've tried it, but a good password manager is what's actually worked in the real world.

Re: Write your passwords down (2010)

#100

Post by bradyd »

jug wrote: post #9
skerit wrote: post #3

Earlier quoted context omitted.

Exactly, using phrases is so much nicer and better in every way. It annoys me when sites demand a password should have a special character or upper case letter in it. Or even worse: a max length.

Max lengths are so sketchy because this makes it more likely the crazy guys are actually storing your password rather than the fixed size hash.

Some of the password hashing algorithms have maximum input lengths. For example bcrypt only allows up to a 72 byte string.

https://en.wikipedia.org/wiki/Bcrypt

Post reply on HN