Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Know What Your Password Was Last Summer

labs.lares.com

Post reply on HN
Print view View original

71–80 of 103 posts

Re: I Know What Your Password Was Last Summer

#71

Post by noman-land »

k8svet wrote: post #44
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

It's like people way to into conspiracy theories. They want to seem smart. I never don't have my phone. I've been aggressively using a password manager for nearly s decade and it's never once been an issue.

I dropped my phone at night in a foreign country and the screen went blank. I couldn't get into anything, not even my hotel.

Re: I Know What Your Password Was Last Summer

#72

Post by chrisnight »

lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

> Like, I really don't get it. Why not just use a password manager. I always tell these people to just sign up for a password manager and they always resist and say no. I must be missing something obvious.

Simple, I don’t trust a cloud service to keep the data secure, and I don’t trust myself to self host and keep the data safe (and not get corrupted) while simultaneously getting that data on all devices and synced.

The flaw of password managers is that you don’t know the passwords you’re using for your sites. That is, if the data was lost, you’d have to do an account recovery, which for some sites is fine, for others it can be a nightmare though.

Alongside this, it is a hard problem to have to simultaneously get all of these copied-pasted passwords on each device without inherently putting them on the Internet (albeit with a password in front of them). Given a threat model of password managers being inherently valuable targets, data going in and out of them is inherently vulnerable for when an exploit is inevitably found.

I’m not saying any of these problems makes mental hash algorithms or rotating passwords better, but password managers do have inherent flaws that make them still an unideal tool.

Also, I find it ironic in the modern day that a simple sticky note next to your computer is probably one of the better solutions to password management, if people invading your physical space isn’t part of your threat model (which is usually the case).

Re: I Know What Your Password Was Last Summer

#73

Post by CharlesW »

DisgracePlacard wrote: post #70
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

If the endgame of passwords is for everyone to use password managers for their passwords, and never to actually learn their passwords, then why bother with passwords at all? It seems to endgame would be for every service to give up passwords, and switch to OTP codes entirely. I'd prefer that world, honestly. Yet I haven't seen many people talk about the possibility, so maybe I'm missing something obvious? I don't kno…

> If the endgame of passwords is for everyone to use password managers for their passwords, and never to actually learn their passwords, then why bother with passwords at all?

Exactly, they'll be a memory in 10 years. https://fidoalliance.org/passkeys/

Re: I Know What Your Password Was Last Summer

#74

Post by instagib »

rollulus wrote: post #5

Not mentioned in the article, but I bet seasonal/time-related passwords are due to password rotation policies. I work for a company too slow or stupid to have understood how counterproductive such policy is, and all my passwords are an update of the former. Because we humans cannot remember multiple strong passwords.

We had a randomly rotating admin position for security theater and network admin to keep things separate. Legally you can save passwords on the most secure network and realistically only remember one password. You have to memorize a lot of passwords otherwise. No phones.

The NSA password reset questionnaire is hilariously a great life memory quiz.

Almost everyone needs to reset some passwords daily even though we had the phone number keypads with special characters around. How to remember passwords was a routine conversation because certain systems had admin passwords to remember or passwords that would change at odd intervals or single account multiple user passwords.

It came down to “how long after a password reset do you actually need to change the password? Does it check for past passwords?” There were passwords written down in not so secret places because the admin would not always be at work.

Eventually we had to adopt token authorization which is a mess to implement also. I loved the security meetings only to discuss how screwed we were once they started enforcing policies.

Re: I Know What Your Password Was Last Summer

#75

Post by akerl_ »

kemotep wrote: post #54
akerl_ wrote: post #40

Earlier quoted context omitted.

The better option for employers is to just get rid of passwords and move to something like FIDO2.

Passkeys are still very rough around the edges and not widely supported but a first-class onboarding and management experience for public key cryptography as account passwords a la FIDO2, webauthn, and/or Passkeys will be amazing for solving the issues with phishing and weak passwords.

This is generally way easier for employers, since they can pick a FIDO2-enabled SSO platform, and then tie everything to that. So you don’t need each service to have sane FIDO2 support, you just need them to support SAML/OIDC/etc.

You also get mostly out of the key management business, because you can say “if you get locked out, call the help desk”, vs personal usage where backup keys / account recovery requires a per-service recovery flow.

Re: I Know What Your Password Was Last Summer

#76

Post by k8svet »

noman-land wrote: post #71
k8svet wrote: post #44

Earlier quoted context omitted.

It's like people way to into conspiracy theories. They want to seem smart. I never don't have my phone. I've been aggressively using a password manager for nearly s decade and it's never once been an issue.

I dropped my phone at night in a foreign country and the screen went blank. I couldn't get into anything, not even my hotel.

Yeah, I amended my thoughts reading the thread. I left out a pretty important detail. I do have one, other, high entropy password that is memorized for my Google account. I don't use social login, but Google = Gmail = everything.

So yes, I was too dismissive. Given the nature of "security", I think it's impossible to have a silver bullet of secure + easy.

Re: I Know What Your Password Was Last Summer

#77

Post by CharlesW »

chrisnight wrote: post #72
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

> Like, I really don't get it. Why not just use a password manager. I always tell these people to just sign up for a password manager and they always resist and say no. I must be missing something obvious. Simple, I don’t trust a cloud service to keep the data secure, and I don’t trust myself to self host and keep the data safe (and not get corrupted) while simultaneously getting that data on all devices and synced.…

> The flaw of password managers is that you don’t know the passwords you’re using for your sites. That is, if the data was lost, you’d have to do an account recovery, which for some sites is fine, for others it can be a nightmare though.

It's typically a 5-minute process, which I know because services regularly force password resets quite often.

> …I don’t trust a cloud service to keep the data secure.

Fair enough, there are definitely shady SaaS vendors. My password manager is a SaaS with a long history (2006), which has no access to my account passwords or Secret Keys and could not reset or recover them for me if I asked. I'm personally satisfied with that.

Have you considered the benefits? For example, I know I currently have 1,161 account logins on various sites/services, 278 of which have "fantastic" passwords, and 144 which have "fair" passwords that I should really go back and update (surely from my pre-password-manager days). I know there are 5 accounts that now support 2FA, and many more which now support passkeys. I know when I've last used each so I can easily close old accounts, which I gradually do.

That kind of awareness/security hygiene enablement would be tough (if not impossible) to replicate manually.

Re: I Know What Your Password Was Last Summer

#78

Post by CharlesW »

temporarara wrote: post #65
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

No. I will never put all my passwords into some black box, no matter how it is pitched to me, and certainly I won't pay for that "privilege". I have all my passwords written down in a sheet of paper slightly obfuscated to make them pretty much worthless even if someone found them (actually I have multiple copies, stored in multiple places). They are all mnemonic to begin with. So if my computer dies, for example, my…

> I will never put all my passwords into some black box […]. I have all my passwords written down in a sheet of paper slightly obfuscated to make them pretty much worthless even if someone found them (actually I have multiple copies, stored in multiple places).

Is this satire?

Re: I Know What Your Password Was Last Summer

#79

Post by throw310822 »

hobs wrote: post #60
bruce343434 wrote: post #34

Earlier quoted context omitted.

A password manager relies on a single point of failure secret (master password), while the website-hash approach relies on a single point of failure secret (master key derivation algorithm). It's really no different, so I think there must be some human biased thinking at play. Except the password manager requires a central or synchronizing computer system, while the in-head key derivation approach requires no such th…

You missed a few glaring failure modes in the mental model one - one of the most extreme is if someone pops your password on two sites, they can likely derive all your other passwords.

Sure, although I wonder how often anyone is actually looking at single passwords, rather than just pushing tons of them through automated systems.

Re: I Know What Your Password Was Last Summer

#80

Post by l72 »

We (tech professionals) really need to be hosting things like vaultwarden for our extended family. That is what I do, and have had good success.

I even keep my vaultwarden on a private network and have an always on wireguard vpn on all my family's devices.

Post reply on HN