Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Know What Your Password Was Last Summer

labs.lares.com

Post reply on HN
Print view View original

61–70 of 103 posts

Re: I Know What Your Password Was Last Summer

#61

Post by hobs »

doix wrote: post #59
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

And one day your managed password manager will get hacked and some smug user on HN will tell you how you should have self hosted it ;). Or you'll get locked out of all your accounts one day. Let's not pretend like password managers are a silver bullet.

They are a lot more powerful of a bullet than just ... nothing at all! (and I self host my password manager because of course you should)

Re: I Know What Your Password Was Last Summer

#62

Post by pseufaux »

batch12 wrote: post #27
pseufaux wrote: post #6

I always wonder why employers don't just set passwords for their users and only give them the option to randomize them. Seems like an ideal solution, if using passwords is a requirement.

You lose nonrepudiation if more than one person has knowledge of your employee's passwords. Typically, that's how it works though from what I've seen. An organization will set a users initial password and the user will have to change it on next login. There are some solutions that will look for known compromised hashes and weak combinations and alert on them or force the user to act, though.

True, but why would the organization need to store the password? Wouldn't it be simpler to just generate a random 4 words (or something similar) then treat it the same as a user supplied one.

Re: I Know What Your Password Was Last Summer

#63

Post by pseufaux »

mewpmewp2 wrote: post #8
pseufaux wrote: post #6

I always wonder why employers don't just set passwords for their users and only give them the option to randomize them. Seems like an ideal solution, if using passwords is a requirement.

Maybe it would be fine if it was random 4 words like in the XKCD, but otherwise it would cause people to plaster sticky notes everywhere and hardcode it in their computers, no?

Agreed though I'd argue sticky notes happen even with user supplied passwords. When I worked at a university, I cannot tell you how often I found a sticky not on the bottom of a keyboard with a list of passwords.

Re: I Know What Your Password Was Last Summer

#64

Post by yieldcrv »

doix wrote: post #59
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

And one day your managed password manager will get hacked and some smug user on HN will tell you how you should have self hosted it ;). Or you'll get locked out of all your accounts one day. Let's not pretend like password managers are a silver bullet.

I agree with self hosting. I hate that they went to the cloud

I will sync via icloud or another encrypted backup at my discretion

But everything convenient did something dumb

Re: I Know What Your Password Was Last Summer

#65

Post by temporarara »

lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

No. I will never put all my passwords into some black box, no matter how it is pitched to me, and certainly I won't pay for that "privilege". I have all my passwords written down in a sheet of paper slightly obfuscated to make them pretty much worthless even if someone found them (actually I have multiple copies, stored in multiple places). They are all mnemonic to begin with. So if my computer dies, for example, my life continues just like before.

I don't have "real" social media accounts to begin with, so my life won't be ruined even if someone cracked all my passwords. Mostly it's just accounts for various online shops I've used during the years. I really don't care if someone hacks those. And access to my bank is pretty much worthless if you don't have my phone and the pin code sheet too. Well I don't have big money in bank anyway, so the crime doesn't pay well in any case.

Re: I Know What Your Password Was Last Summer

#66

Post by yieldcrv »

graypegg wrote: post #43
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

I use a password manager, but USED to do that “human hash” of a website. It’s because password managers are annoying at the worst possible times. The dread of “oh god… this device doesn’t support my password manager/im only going to log in once here, so I have to carefully type out random numbers and letters” is not fun. Examples: office zoom meeting room tablet. Standalone VR headset. Smart TV. Trying to share an ac…

How all thats been solved in my world:

every service on my TV pops up a big QR code for your second device (a phone) to access and log in with

iphones prompt you to share the password when your iphone using friend tries to connect to a wifi network you are on

Regarding VR, hm knowing an Apple Vision Pro will be connected to my icloud account makes me know I wont have to do that stuff. Other standalone headsets I wonder how or if they solve that problem. My Playstation VR headset dual renders on screen so the qr code solution is already there.

Re: I Know What Your Password Was Last Summer

#67

Post by therealpygon »

Aardwolf wrote: post #35
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

For one, a password manager was in the news recently for a data breach, doesn't help the public perception

People in general also tend not to make backups, frequently have computers that get viruses and have to be wiped, and generally just don’t “trust” computers that, in their view, constantly break

I think it would be like suggesting people give their life savings to their unreliable neighbor to hold on to. It might be safe, and might be secure, but at the end of the day they are being asked to bet everything on something they don’t find to be reliable.

In the end, perception is reality and I can’t say I entirely disagree with the perception. I use a password manager, but unless you are running the infrastructure and backups yourself, which a normal person isn’t going to do, you are at the mercy of “corporations” that we know to make mistakes, have data breaches, lose data, change their policies on a whim, break the law, and even cause people’s deaths, all while suffering few if any consequences.

I’d say the average person’s hesitancy toward using a password manager is probably pretty justified, even if it would be far more secure.

Re: I Know What Your Password Was Last Summer

#68

Post by yieldcrv »

DeathArrow wrote: post #42
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

>Just use a password manager! What if I don't have access to the password manager at some point but I do need to log into some website? I.e. visiting friends house, forgot my phone at home but I need to log in my banking app to do a transfer? Or visiting a foreign country, someone steals my papers and my phone and I need to login to mail at a public cafe to let my family know I am well.

you can read your passwords in a password manager, memorize a couple of them for the risks you think you have

what I typically would do in both of those scenarios is a password reset. I would know my email password and do a password reset of everything else and get that in my email.

privilege escalate on yourself.

realistically, I’ve been at Apple Stores multiple times where I needed to login manually to my icloud account while my phone was being RMA’d. nothing to remind you there.

Re: I Know What Your Password Was Last Summer

#69

Post by para_parolu »

bruce343434 wrote: post #34
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

A password manager relies on a single point of failure secret (master password), while the website-hash approach relies on a single point of failure secret (master key derivation algorithm). It's really no different, so I think there must be some human biased thinking at play. Except the password manager requires a central or synchronizing computer system, while the in-head key derivation approach requires no such th…

Hash method is prone to websites that rotates passwords, have limits in passwords, have certain rules known passwords. Also, if website database is breached then you may want to create a different password.

Plus, username needs to be stored as well sometimes.

Re: I Know What Your Password Was Last Summer

#70

Post by DisgracePlacard »

lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

If the endgame of passwords is for everyone to use password managers for their passwords, and never to actually learn their passwords, then why bother with passwords at all? It seems to endgame would be for every service to give up passwords, and switch to OTP codes entirely. I'd prefer that world, honestly. Yet I haven't seen many people talk about the possibility, so maybe I'm missing something obvious? I don't know.
Post reply on HN