Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down (2010)

blog.jgc.org

Post reply on HN
Print view View original

121–130 of 196 posts

Re: Write your passwords down (2010)

#121

Post by JohnFen »

skerit wrote: post #3
gostsamo wrote: post #2

Don't use fancy combinations. Word phrases are even more random and much easier to remember. E.G. "touch-some-grass" is rander longer than any recommended minimum and hardly could be connected to any website.

Exactly, using phrases is so much nicer and better in every way. It annoys me when sites demand a password should have a special character or upper case letter in it. Or even worse: a max length.

> using phrases is so much nicer and better in every way.

Except for with me. I find phrases much more difficult to remember and use than passwords, personally. Although in either case, I'll need to have the ones I don't use daily somewhere where I can look them up, because there's no chance I'll remember them.

Re: Write your passwords down (2010)

#122

Post by vlz »

legitster wrote: post #37

Unless you are a high profile target, the risk of someone burglarizing your house without you knowing it and actually making use of a password book is virtually nil. Plus, you should really keep a physical copy of your passwords anyway in case something were to happen to you and your loved ones need access to your accounts, insurance, banking, photos, etc.

A password manager helps even there. Keep a copy of your main vault’s password and instruction on how to get to that together with your testament/last will and you do not have to worry about updating these. Your heirs will be able to access any future accounts you might create.

Re: Write your passwords down (2010)

#123

Post by Longhanks »

syllablehq wrote: post #119

It makes me so sad that it's 2023 and we haven't fixed passwords. There's no need for any of this. Your email account (+ multi-factor as desired) will always be the weak link, so just reduce everything to that. Get rid of passwords. Create a new standard that falls back to passwords to work with legacy systems, but going forward will enable a password keepers to just authenticate you with a generated random password…

I absolutely despise everything in this comment. I have a user name and I know the associated password, let me in. Leave me alone with your proprietary authenticators that will lock me out the moment I lose my phone or Google/MS just _decide_ they feel like locking me out.

GitHub force-disabling password authentication for git push has actively made me contribute less to GitHub-hosted projects. And when I really feel it, I just create a full access authentication token anyway and copy the contents to the device. Great. This is the 90‘s "password on a sticky note at the desk" all over again, just even more cumbersome and even less secure. Great job, everyone.

And no, passkeys/webauthn/vendor lock in #1864 won’t fix this.

Re: Write your passwords down (2010)

#124

Post by deltarholamda »

jmcphers wrote: post #116
ethbr0 wrote: post #11

Algorithmically generated passwords for different sites was a mind-blower. There are so many differentiation algorithms that are trivially runnable in your head. If most sites are salting and hashing passwords correctly (this is 2023...), then that drastically decreases your compromised credential blast radius. -- And it makes me sad that "store your passwords on dead-tree paper" became GOTO. It has serious weaknesse…

I like pass, the "Unix standard password manager": https://www.passwordstore.org/ It is very barebones -- basically a collection of GPG encrypted text files stored in Git. For that reason it's trivial to make clients for it and selfhost the repository if you're so inclined.

I second this. If you keep it in a container or a jail or something, you can run it on a server you control, set sshd to do password authentication, have one really good passphrase, and now you can access it anywhere you can get to a shell with ssh and Internet access. (This is obviously less secure, but the convenience is great if you need it.)

I've also done a version of this where it's stored on a Pi Zero, but the Zero (and SD cards) isn't the most reliable thing in the world and lost it a couple of times before I gave up, but it may work for others better.

It's more fiddly than a more featureful service, but I like it because I understand all of it and control all of it.

Re: Write your passwords down (2010)

#125

Post by Zak »

nvahalik wrote: post #30
Zak wrote: post #7

I find it surprising this article doesn't mention password managers, though some comments do. They were already in widespread use in 2010.

> They were already in widespread use in 2010. I'm interested in knowing the stats of this, but 1Password's first release was mid-2006. I know personally I started using 1Password in late 2008, 2009. But I'd argue even then that they were not "widespread" then and even now are not entirely widespread. (Unless you count Cloud Keychain). Arguably I think the more security conscious were using them, but even now, after…

The author is presumably among the more security conscious, which makes it even more surprising he didn't mention password managers even if only to dismiss them.

https://en.wikipedia.org/wiki/John_Graham-Cumming

Re: Write your passwords down (2010)

#126

Post by alistairSH »

badcppdev wrote: post #28

Write down your usernames and account numbers as well. Today my banking app decided to 'forget' my login details. I have the account number available at home but I'm in the office today and so I can't log back into my account. So I can't check balances or approve payments (luckily I'm too busy to spend money)

Interesting. All my banking apps use the same login as the plain website. So, if the app forgot my login, I'd just re-enter it, pass MFA, and be done. Account #s not required.

Re: Write your passwords down (2010)

#127

Post by ndriscoll »

TedDoesntTalk wrote: post #113
ndriscoll wrote: post #83

Earlier quoted context omitted.

The sensible thing to do here is hash the password before sending it, not impose a character limit on the field. Ideally, browsers could even support this directly as part of the input element if they weren't busy adding things no sane person wants like webUSB or browser notifications.

They do support it directly. There has been a WebCrypto API with carrots hashing algorithms for years.

You can do hashing in javascript, but I mean something more like
By default, salt with the domain. Have an optional `hash-domain` attribute to override it if needed. Have an optional hash-extra-salt field that you can use to target e.g. a username input. Make it quick and easy to do the right thing, and for a linter to check that you did the right thing (e.g. warn if a password input is missing hash options).

For all the development that goes into browsers, HTML is really missing some basic stuff that tons of people need. Stuff like this or e.g. graphs. Why do you need to pull in huge javascript libraries and write code to draw a line chart? Why is drawing a pie chart harder than making a table?

In contrast, I can think of literally 0 websites that could even come up with the most contrived reason to need USB. The best I can think of is some incredibly bespoke CAD thing that uses a hardware dongle for DRM, and then why isn't it just an actual application? Why would the enablement for that go into a web browser? Or the vibration API. Or the sensors API. Who in their right mind would ever want these things to even be possible for websites to use? You know instantly that they will only be abused. Why is WHATWG working on this stuff and not taking common reasons people reach for javascript and adding standardized, declarative versions into HTML?

Re: Write your passwords down (2010)

#128

Post by falcolas »

iLoveOncall wrote: post #91
falcolas wrote: post #57

Earlier quoted context omitted.

100Kb is a perfectly reasonable length IMO. Only takes seconds to send even over terrible links.

It becomes problematic when it needs to be hashed, you can essentially DDOS servers by sending extremely long passwords that need to be hashed.

Realistically speaking, the hash would be your smallest problem if you're being DDoSed.

Bcrypt for example would require at most ~6.4Mb of memory to do the hash, and more realistically only the 100k plus some constant. And modern CPUs are pretty efficient at doing the encryption steps, meaning little additional load for encrypting a larger value.

Re: Write your passwords down (2010)

#129

Post by falcolas »

gochi wrote: post #97
falcolas wrote: post #56

Earlier quoted context omitted.

A problem solved by a backup strategy, not a cloud service. I firmly believe you can't expect cloud services to do anything but serve up exactly what you give them. If you give them a corrupt database, they will happily serve you up a corrupted database.

Technically, the problem is solved by either one. A service like 1password is in the business of not serving you up a corrupt database. A backup solution also works here if you don't want to rely on other services.

Sure, if 1Password's cloud service can inspect and validate the structure of the vault. I kind of hope they can't since the vault should be encrypted, but I'm also not quite that naive.

Re: Write your passwords down (2010)

#130

Post by alternatex »

Longhanks wrote: post #123
syllablehq wrote: post #119

It makes me so sad that it's 2023 and we haven't fixed passwords. There's no need for any of this. Your email account (+ multi-factor as desired) will always be the weak link, so just reduce everything to that. Get rid of passwords. Create a new standard that falls back to passwords to work with legacy systems, but going forward will enable a password keepers to just authenticate you with a generated random password…

I absolutely despise everything in this comment. I have a user name and I know the associated password, let me in. Leave me alone with your proprietary authenticators that will lock me out the moment I lose my phone or Google/MS just _decide_ they feel like locking me out. GitHub force-disabling password authentication for git push has actively made me contribute less to GitHub-hosted projects. And when I really feel…

First time I'm seeing anyone suggest that MFA and biometrics are less secure than a password.

Also you have to consider that companies like Google, Apple, Microsoft, are making decisions based on what's good for most users, not a single user.

Post reply on HN