Live data from Hacker News

I Know What Your Password Was Last Summer

labs.lares.com

21–30 of 103 posts

Re: I Know What Your Password Was Last Summer

#21
post #5

Not mentioned in the article, but I bet seasonal/time-related passwords are due to password rotation policies. I work for a company too slow or stupid to have understood how counterproductive such policy is, and all my passwords are an update of the former. Because we humans cannot remember multiple strong passwords.

It’s not necessarily management.

When you run large IT systems, external auditors come into your systems and say :

1) no password rotation = bad

2) no password format enforcement = bad

Though it’s absurd to force people to have a password between 6 and 8 chars for example, because it limits the amount of possibilities.

Re: I Know What Your Password Was Last Summer

#22
post #7

Love the recommendation for diceware style passwords. You can easily remember 4 to 6 random words. You really will be surprised how quickly it is to memorize and type after a day or two. Mixing them up with what separator (if any) that you use, and if you number/special character substitute that adds dozens of possible permutations on a single password. And just using 4-letter words (over 100,000 in the English langu…

+1 You can even make proper sentences which makes it easier to memorize them more quickly For KeePassXC I have something like: ilikeeatingicecreamonsundaysaftermovies

Much safer than anything like Xak1k99u??.1 which no one can remember efficiently

Re: I Know What Your Password Was Last Summer

#24
post #6

I always wonder why employers don't just set passwords for their users and only give them the option to randomize them. Seems like an ideal solution, if using passwords is a requirement.

Some employers just buy a 1Password license for their staff.

You still need a proper master password

Re: I Know What Your Password Was Last Summer

#25
Parts of this article appear to be AI-generated.

1. The section beginning with "If you are interested in the respective hashcat masks for the passwords cracked above," is most obviously AI-generated as it makes no sense. Quote:

> > > Mask: ?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1 > > Explanation: This mask is for a pattern that starts and ends with angle brackets. Inside, it follows a pattern of "Passw0rd" followed by a digit, repeated twice. However, Hashcat doesn't directly support angle brackets in its mask. An option would be to handle these characters separately or use a custom charset (?1) to represent them.

Angle brackets aren't special characters in masks: https://hashcat.net/wiki/doku.php?id=mask_attack

If angle brackets were special characters in masks and had to be represented by ?1 as a workaround, this mask is unrelated to the explanation, since it would match passwords consisting only of angle brackets.

"handle these characters separately" isn't a thing.

The mask doesn't have anything to do with matching "Passw0rd".

Several other masks from the page do not match their accompanying passwords.

Most of them are just showing the uppercase letters, lowercase letters and digits in the password. E.g. "We matched Hello123World with a mask matching 1 uppercase letter, 4 lowercase letters, 3 digits, 1 uppercase letter, and 4 lowercase letters." This doesn't explain why anyone should use that mask instead of, say, 1 uppercase letter, 4 lowercase letters, 2 digits, 1 uppercase letter, and 5 lowercase letters. This is obviously not the mask they used, but an AI working backwards from the password.

2. The password "Cloudy-Envelope-Rainbow-Dinosaur" is 32 characters long, including the hyphens, not 29 as the article says. The password "Sunset$Guitar$Puzzle$Journey" consists of 28 characters, including the dollar signs, not 27 as the article says.

3. The "Conclusion" section smells strongly of AI. Windows was only mentioned in passing, yet the conclusion says the whole article is about Windows. MFA wasn't mentioned at all until this point. Defence in depth wasn't mentioned.

Re: I Know What Your Password Was Last Summer

#26

This reminds me of my teenage years. I used to use passwords that do not rely on personal facts (i.e birthday) or social relationzs (i.e my city..etc) but tried to be smart and relied on creating passwords that is related to what I feel because I thought that it is harder for people to know that. So I had a password "Ihate_My_Math_Teacher" for anything that is related to study for a while.

I tried doing this with "forgot password?" reminders, and ended up getting locked out of an email account in high school, because of course I had no idea what the answer to "who is the girl you love most" was - I set it in middle school! Not only was that a few years ago, that answer probably changed on a weekly basis!

Re: I Know What Your Password Was Last Summer

#27
post #6

I always wonder why employers don't just set passwords for their users and only give them the option to randomize them. Seems like an ideal solution, if using passwords is a requirement.

You lose nonrepudiation if more than one person has knowledge of your employee's passwords. Typically, that's how it works though from what I've seen. An organization will set a users initial password and the user will have to change it on next login. There are some solutions that will look for known compromised hashes and weak combinations and alert on them or force the user to act, though.

Re: I Know What Your Password Was Last Summer

#30
I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a rule for which to use for certain types of websites.

Like, I really don't get it. Why not just use a password manager. I always tell these people to just sign up for a password manager and they always resist and say no. I must be missing something obvious.

Edit: And just as I posted this comment, another bizarre personal strategy for creating passwords: https://news.ycombinator.com/item?id=39335853

Just use a password manager! Basically all password managers will generate a random string for a password when you add a new credential. You never even have to look at it or know what it is.

Post reply on HN