Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down (2010)

blog.jgc.org

Post reply on HN
Print view View original

131–140 of 196 posts

Re: Write your passwords down (2010)

#131

Post by WorldMaker »

syllablehq wrote: post #119

It makes me so sad that it's 2023 and we haven't fixed passwords. There's no need for any of this. Your email account (+ multi-factor as desired) will always be the weak link, so just reduce everything to that. Get rid of passwords. Create a new standard that falls back to passwords to work with legacy systems, but going forward will enable a password keepers to just authenticate you with a generated random password…

For better and worse that is basically what Passkeys are trying to do. Using public key cryptography is a little more complicated than (symmetrically) encrypted cookies, but not by much. (And is overall harder to easily exfiltrate so works for more threat models.)

Re: Write your passwords down (2010)

#132

Post by f1shy »

Longhanks wrote: post #123
syllablehq wrote: post #119

It makes me so sad that it's 2023 and we haven't fixed passwords. There's no need for any of this. Your email account (+ multi-factor as desired) will always be the weak link, so just reduce everything to that. Get rid of passwords. Create a new standard that falls back to passwords to work with legacy systems, but going forward will enable a password keepers to just authenticate you with a generated random password…

I absolutely despise everything in this comment. I have a user name and I know the associated password, let me in. Leave me alone with your proprietary authenticators that will lock me out the moment I lose my phone or Google/MS just _decide_ they feel like locking me out. GitHub force-disabling password authentication for git push has actively made me contribute less to GitHub-hosted projects. And when I really feel…

I really do bot understand the policy of github. Before I could have a 40 char password in my head. Now it MUST be somewhere in my disc. I was totally surprised as I learned is the only way to login. Seems a 50 year old idea

Re: Write your passwords down (2010)

#133

Post by f1shy »

alternatex wrote: post #130
Longhanks wrote: post #123

Earlier quoted context omitted.

I absolutely despise everything in this comment. I have a user name and I know the associated password, let me in. Leave me alone with your proprietary authenticators that will lock me out the moment I lose my phone or Google/MS just _decide_ they feel like locking me out. GitHub force-disabling password authentication for git push has actively made me contribute less to GitHub-hosted projects. And when I really feel…

First time I'm seeing anyone suggest that MFA and biometrics are less secure than a password. Also you have to consider that companies like Google, Apple, Microsoft, are making decisions based on what's good for most users, not a single user.

I think they make decisions based on what is best for business (which may include locking you as much as possible in their platform) Very unsure that the named companies really do things for users good.

Re: Write your passwords down (2010)

#134

Post by WorldMaker »

mgfist wrote: post #106
pkulak wrote: post #101

Earlier quoted context omitted.

And 1 out of 100 websites will accept that password, unfortunately.

You can just append whatever character requirements they have. So instead of "correcthorsebatterystaple", you can do "CorrectHorseBatteryStaple123!". Should meet most requirements. Although I just use a password manager but to each their own.

Also, spaces sometimes count as "special character" requirements, so sometimes just "sentence form" passes: "Correct, 1 horse battery staple!"

Re: Write your passwords down (2010)

#135

Post by 0xbadcafebee »

_Algernon_ wrote: post #90
0xbadcafebee wrote: post #20

Do not do this. It's just crappy security practice. Password managers give you versions & history (you need to rotate passwords occasionally), a TOTP generator+seed store, configurable password generator using a schemes of characters (some websites only allow specific characters), is encrypted at rest & in memory so it's more secure than a piece of paper in your wallet, is backed up online, and of course you only hav…

>Do not do this. It's just crappy security practice. >Password managers give you versions & history (you need to rotate passwords occasionally), a TOTP generator+seed store, configurable password generator using a schemes of characters (some websites only allow specific characters), is encrypted at rest & in memory so it's more secure than a piece of paper in your wallet, is backed up online, and of course you only h…

Regardless of the threat model, a password manager is better, period. It addresses more threats, provides better security, is more reliable.

> your passwords can is safe from malware, digital exploits and so on

No they're not. They can still be compromised by malware and digital exploits when you type them into your device. If you have malware you're largely just fucked. That's why people have been trying to get rid of passwords forever, because they still are vulnerable to a number of attacks in various circumstances.

> The vulnerabilities can be reduced by using a second factor that must be combined with the information in the notebook

This is the same threat model as a password manager. Always use a second factor regardless of the primary method.

> The biggest problem with the paper approach is probably accidental loss

No, the biggest problem with the paper method is you should never leave your password unencrypted at rest, including some clunky matrix map that could be decoded by a clever person even in the 16th century. There are many other problems with paper method that password manager makes obsolete.

> Cloud password managers have plenty of issues

Only shitty ones. Security researchers were raising the alarm about LastPass long ago. 1Password and BitWarden are perfectly fine, secure and reliable. They all use zero-knowledge so as long as your master password is long and complex, there's no risk to your vaults.

> Local password managers work, but there are plenty of potential vulnerabilities

For the shitty ones. They're certainly better than no manager at all, if you use them correctly and they aren't designed terribly.

> In the end most people end up relying on not being a big target

It's not about being a target, it's about the entire security practice contributing to better outcomes as a whole. The features of a password manager add up to overall much better security.

The only circumstance in which writing down a password is better than a password manager is when you have no computing device at all with which to run the password manager. No computer, no tablet, no phone, no internet cafe, nothing.

And actually, even then memorization is better than writing it down. Come up with a mnemonic for a long password phrase and some memory tricks to remember the phrase in case you forget it.

Re: Write your passwords down (2010)

#136

Post by Izkata »

nvahalik wrote: post #30
Zak wrote: post #7

I find it surprising this article doesn't mention password managers, though some comments do. They were already in widespread use in 2010.

> They were already in widespread use in 2010. I'm interested in knowing the stats of this, but 1Password's first release was mid-2006. I know personally I started using 1Password in late 2008, 2009. But I'd argue even then that they were not "widespread" then and even now are not entirely widespread. (Unless you count Cloud Keychain). Arguably I think the more security conscious were using them, but even now, after…

Even aside from external managers that existed at the time, Firefox already had its built-in password manager at least as far back as 2006.

Re: Write your passwords down (2010)

#137

Post by AtNightWeCode »

falcolas wrote: post #128
iLoveOncall wrote: post #91

Earlier quoted context omitted.

It becomes problematic when it needs to be hashed, you can essentially DDOS servers by sending extremely long passwords that need to be hashed.

Realistically speaking, the hash would be your smallest problem if you're being DDoSed. Bcrypt for example would require at most ~6.4Mb of memory to do the hash, and more realistically only the 100k plus some constant. And modern CPUs are pretty efficient at doing the encryption steps, meaning little additional load for encrypting a larger value.

[flagged]

Re: Write your passwords down (2010)

#138

Post by 0xbadcafebee »

0xbadcafebee wrote: post #20

Do not do this. It's just crappy security practice. Password managers give you versions & history (you need to rotate passwords occasionally), a TOTP generator+seed store, configurable password generator using a schemes of characters (some websites only allow specific characters), is encrypted at rest & in memory so it's more secure than a piece of paper in your wallet, is backed up online, and of course you only hav…

The people downvoting this don't understand security. Do not believe whatever you read on HN just because it's upvoted. Listen to real security professionals.

Re: Write your passwords down (2010)

#139

Post by ndriscoll »

AtNightWeCode wrote: post #81
TedDoesntTalk wrote: post #32

Earlier quoted context omitted.

A few MB is acceptable for https POST these days. This gets hashed down to 64 chars or whatever.

Are you aware of that secure pw hashing comes with a cost factor and that the cost is linear with the size of the input to the hashing algorithm? EDIT: Down voters. What pw hashing algo are you using instead of BCrypt or similair?

I'm not particularly familiar with this stuff, but aren't the cost factors for hash algorithms essentially the number of times to nest the hash function? i.e. `hash(hash(hash(hash(hash(input)))))` type of thing. So it would cost more, but only for the first round? After that the size is reduced to the size of the image of the hash for future rounds?

That said, a few MB is a lot for one client to post if you have a significant amount of traffic. Just hash client side first.

Re: Write your passwords down (2010)

#140

Post by function_seven »

hnbear wrote: post #84
devnull3 wrote: post #12

Do not write your real password. Instead modify it in certain way which is easy to remember: E.g real password is "xB6fqmd$a90". Apply algo: swap 2nd and last char. So store it as: "x06fqmd$a9B" This algo should be easy to remember and there infinite ways to come up with your own algo. Even if your passwords are exposed there is additional protection. In other words you have your own simple symetric encryption with a…

My Dad tried this when we first taught him to use an ATM and setup his PINs. He carefully wrote them in the back of his planner which he keeps in his pocket. Then he realized he needed extra security and added some extra digits before and after. Then promptly forgot which digits to remove and which to keep. His new approach is: 1. Pick a “famous” battle 2. Hand me a card and ask me to go to an ATM for him 3. Tell me…

“Dad I’m at the ATM but I forgot the PIN. What is it?”

“You forgot?? I distinctly remember telling you: Battle of Hastings minus the length of the Thirty Years’ War, plus the Battle of Ipsos. C’mon kid, pay attention”

“...”

“Sigh. 1337. That’s the PIN”

Post reply on HN