Live data from Hacker News

I Know What Your Password Was Last Summer

labs.lares.com

51–60 of 103 posts

Re: I Know What Your Password Was Last Summer

#51
post #38
post #29

My personal favorite method for passwords is come up with a passphrase I can remember, encode it to base 64, and use the encoded string as the password. If its not too long, the encoded version is usually not hard to memorize either.

I usually do this: tr -cd "[:alnum:]" Then I use an encrypted text file via Emacs to store my passwords

pwgen -s 20

Re: I Know What Your Password Was Last Summer

#52

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

I use a password manager, but USED to do that “human hash” of a website. It’s because password managers are annoying at the worst possible times. The dread of “oh god… this device doesn’t support my password manager/im only going to log in once here, so I have to carefully type out random numbers and letters” is not fun. Examples: office zoom meeting room tablet. Standalone VR headset. Smart TV. Trying to share an ac…

One thing you can do is make human readable passwords for sites like Netflix. You can still make it long and save it in the password manager, and it becomes much easier to type out if you need to.

Re: I Know What Your Password Was Last Summer

#53
post #38
post #29

My personal favorite method for passwords is come up with a passphrase I can remember, encode it to base 64, and use the encoded string as the password. If its not too long, the encoded version is usually not hard to memorize either.

I usually do this: tr -cd "[:alnum:]" Then I use an encrypted text file via Emacs to store my passwords

I do something similar:

    strings -10 /dev/urandom | head
It's less efficient but easier to type, and also helps with websites that requires non-alphanumeric symbols.

Re: I Know What Your Password Was Last Summer

#54
post #40
post #6

I always wonder why employers don't just set passwords for their users and only give them the option to randomize them. Seems like an ideal solution, if using passwords is a requirement.

The better option for employers is to just get rid of passwords and move to something like FIDO2.

Passkeys are still very rough around the edges and not widely supported but a first-class onboarding and management experience for public key cryptography as account passwords a la FIDO2, webauthn, and/or Passkeys will be amazing for solving the issues with phishing and weak passwords.

Re: I Know What Your Password Was Last Summer

#55
post #17

Earlier quoted context omitted.

Can someone message Dang to ban this account?

If anybody is curious about what the account commented, this is the other comment from the same account: --- I created a portfolio with Mrs Marlena she has awesome trading strategy and it's been a life-changer for me! If you want to level up your trading game and start making right speculation on trading gains, sign up by following her on INSrTA g ram @** and we'll both get some sweet perks. Let's conquer the market…

I’ve been noticing a handful of these types of comments from a couple of different accounts.

Why is someone trying to scam/advertise managed crypto trading accounts?

Re: I Know What Your Password Was Last Summer

#56

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

For one, a password manager was in the news recently for a data breach, doesn't help the public perception

The best password manager is an offline password manager.

Re: I Know What Your Password Was Last Summer

#57
post #40
post #6

I always wonder why employers don't just set passwords for their users and only give them the option to randomize them. Seems like an ideal solution, if using passwords is a requirement.

The better option for employers is to just get rid of passwords and move to something like FIDO2.

Completely agree, at least in an idealistic scenario.

Re: I Know What Your Password Was Last Summer

#58

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

Using a password manager means your password are handled by someone else's code and you need to trust them not to fuck up. Also, they are really juicy targets.

Also, here's why people don't want to use a password manager:

https://arstechnica.com/information-technology/2023/02/lastp...

Re: I Know What Your Password Was Last Summer

#59

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

And one day your managed password manager will get hacked and some smug user on HN will tell you how you should have self hosted it ;). Or you'll get locked out of all your accounts one day.

Let's not pretend like password managers are a silver bullet.

Re: I Know What Your Password Was Last Summer

#60

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

A password manager relies on a single point of failure secret (master password), while the website-hash approach relies on a single point of failure secret (master key derivation algorithm). It's really no different, so I think there must be some human biased thinking at play. Except the password manager requires a central or synchronizing computer system, while the in-head key derivation approach requires no such th…

You missed a few glaring failure modes in the mental model one - one of the most extreme is if someone pops your password on two sites, they can likely derive all your other passwords.
Post reply on HN