Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Know What Your Password Was Last Summer

labs.lares.com

Post reply on HN
Print view View original

41–50 of 103 posts

Re: I Know What Your Password Was Last Summer

#41

Post by jstanley »

lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

> I always tell these people to just sign up for a password manager and they always resist and say no. I must be missing something obvious.

Maybe they don't want to be relying on a random third-party for all their passwords?

Rather than getting them to sign up for a password manager, what about getting them to install a password manager? I use https://www.passwordstore.org/ - it encrypts your passwords with GPG, and shares the storage via a Git repository for synchronisation between different machines.

Re: I Know What Your Password Was Last Summer

#42

Post by DeathArrow »

lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

>Just use a password manager!

What if I don't have access to the password manager at some point but I do need to log into some website? I.e. visiting friends house, forgot my phone at home but I need to log in my banking app to do a transfer? Or visiting a foreign country, someone steals my papers and my phone and I need to login to mail at a public cafe to let my family know I am well.

Re: I Know What Your Password Was Last Summer

#43

Post by graypegg »

lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

I use a password manager, but USED to do that “human hash” of a website.

It’s because password managers are annoying at the worst possible times. The dread of “oh god… this device doesn’t support my password manager/im only going to log in once here, so I have to carefully type out random numbers and letters” is not fun.

Examples: office zoom meeting room tablet. Standalone VR headset. Smart TV. Trying to share an account for video streaming. (Solved by that being mostly impossible now) The wifi password every single person will ask you for when they’re at your home.

That sucks. People immediately imagine those scenarios when you bring it up to them.

Re: I Know What Your Password Was Last Summer

#44

Post by k8svet »

lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

It's like people way to into conspiracy theories. They want to seem smart. I never don't have my phone. I've been aggressively using a password manager for nearly s decade and it's never once been an issue.

Re: I Know What Your Password Was Last Summer

#45

Post by williamscales »

DeathArrow wrote: post #42
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

>Just use a password manager! What if I don't have access to the password manager at some point but I do need to log into some website? I.e. visiting friends house, forgot my phone at home but I need to log in my banking app to do a transfer? Or visiting a foreign country, someone steals my papers and my phone and I need to login to mail at a public cafe to let my family know I am well.

In the first case most password managers I’m aware of let you log in online. So I’d just log in and use my hardware token on my keyring for 2FA.

Re: I Know What Your Password Was Last Summer

#46

Post by [deleted] »

bruce343434 wrote: post #34
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

A password manager relies on a single point of failure secret (master password), while the website-hash approach relies on a single point of failure secret (master key derivation algorithm). It's really no different, so I think there must be some human biased thinking at play. Except the password manager requires a central or synchronizing computer system, while the in-head key derivation approach requires no such th…

[deleted]

Re: I Know What Your Password Was Last Summer

#47

Post by mpol »

lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

I was like this some years ago. My assumption was that nobody can guess my password, because it is not straightforward. Untill someone explained that if someone new one password, he would know them all. Only then did I start using Keepassxc.

Another factor is inconvenience. On the road, most passwords are out of reach for me now. In a way I prefer it that way, I prefer to not be glued to my phone. As a compromise, there are a few passwords in a note taking app on my phone ;)

Re: I Know What Your Password Was Last Summer

#48

Post by k8svet »

smokel wrote: post #18

Do I understand things correctly if they claim to have cracked 31,200 passwords of which 481 were "TooBlue2022", and they then go on to think that this is a password used by multiple people? (To be more precise, this is not claimed directly for the top 10, but it is implied for the season words.) Is it nog a bit more likely that there was some duplication in the hashes? Or that this password is used by one prolific a…

> Is it nog a bit more likely that there was some duplication in the hashes?

Depending on the type of hashes... Absolutely not.

Re: I Know What Your Password Was Last Summer

#49

Post by mgfist »

serf wrote: post #36
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

I use password managers myself, but the 'all my eggs in one basket' dimension is a burden and requires planning.

In the 4 or so years I've been using a password manager I can't remember ever having it feel like a burden or require more planning (besides the upfront work). On the other hand, I can't count how many times it has either saved me or been an incredible convenience. So many random websites require accounts these days (eg. health practitioners) and password managers make it infinitely easier to handle.

Re: I Know What Your Password Was Last Summer

#50

Post by an_ko »

broast wrote: post #29

My personal favorite method for passwords is come up with a passphrase I can remember, encode it to base 64, and use the encoded string as the password. If its not too long, the encoded version is usually not hard to memorize either.

Thanks, I'll add base64 as one of the trivial transformations to my ongoing brute-forcing effort of all your passwords, multiplying total search effort by a tiny constant.

I'm joking. But what if I weren't? Especially if you're going to announce this on the internet, it sounds far more effective to add 1 character to the end of your passphrase instead, since each exponentiates any brute force effort, and isn't defeatable by a simple pattern.

(Or announce on the internet that you're doing something far more complex, like running bcrypt on all your passphrases to generate your passwords. That would make an attacker's life significantly more difficult than base64.)

(Or always lie on the internet about how you generate your passwords. I hope that's what you're already actually doing.)

Post reply on HN