Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Know What Your Password Was Last Summer

labs.lares.com

Post reply on HN
Print view View original

81–90 of 103 posts

Re: I Know What Your Password Was Last Summer

#81

Post by paulryanrogers »

hobs wrote: post #60
bruce343434 wrote: post #34

Earlier quoted context omitted.

A password manager relies on a single point of failure secret (master password), while the website-hash approach relies on a single point of failure secret (master key derivation algorithm). It's really no different, so I think there must be some human biased thinking at play. Except the password manager requires a central or synchronizing computer system, while the in-head key derivation approach requires no such th…

You missed a few glaring failure modes in the mental model one - one of the most extreme is if someone pops your password on two sites, they can likely derive all your other passwords.

I'd go further and point out that derived secret systems put all your future passwords at risk. Whereas a password manager is only your current and past passwords.

Re: I Know What Your Password Was Last Summer

#82

Post by bongodongobob »

rvnx wrote: post #21
rollulus wrote: post #5

Not mentioned in the article, but I bet seasonal/time-related passwords are due to password rotation policies. I work for a company too slow or stupid to have understood how counterproductive such policy is, and all my passwords are an update of the former. Because we humans cannot remember multiple strong passwords.

It’s not necessarily management. When you run large IT systems, external auditors come into your systems and say : 1) no password rotation = bad 2) no password format enforcement = bad Though it’s absurd to force people to have a password between 6 and 8 chars for example, because it limits the amount of possibilities.

No, password rotation has not been standard best practice for quite some time now. Best practice is long passwords with no rotation.

For humans. Service/admin accounts should be rotating constantly.

Re: I Know What Your Password Was Last Summer

#83

Post by zwirbl »

roflmaostc wrote: post #22
kemotep wrote: post #7

Love the recommendation for diceware style passwords. You can easily remember 4 to 6 random words. You really will be surprised how quickly it is to memorize and type after a day or two. Mixing them up with what separator (if any) that you use, and if you number/special character substitute that adds dozens of possible permutations on a single password. And just using 4-letter words (over 100,000 in the English langu…

+1 You can even make proper sentences which makes it easier to memorize them more quickly For KeePassXC I have something like: ilikeeatingicecreamonsundaysaftermovies Much safer than anything like Xak1k99u??.1 which no one can remember efficiently

I usually make up a sentence in my local German dialect. Where I live it's not at all unusual to write texts or chat in it and it oftentimes barely resembles German. Once while playing Counterstrike 1.6 and using public chat some Germans asked if we were Swedish because of that. It definitely messes up dictionary attacks

Re: I Know What Your Password Was Last Summer

#84

Post by mewpmewp2 »

reifyx wrote: post #12
mewpmewp2 wrote: post #8

Earlier quoted context omitted.

Maybe it would be fine if it was random 4 words like in the XKCD, but otherwise it would cause people to plaster sticky notes everywhere and hardcode it in their computers, no?

if you work from home, a sticky note with a strong password might be safer than a memorized employee-chosen password

But then imagine once in a while they have to go out to work, they might have to take this along with them and then both laptop and the sticky note together are vulnerable for either accidental theft or intentional.

Re: I Know What Your Password Was Last Summer

#85

Post by evilduck »

throw310822 wrote: post #79
hobs wrote: post #60

Earlier quoted context omitted.

You missed a few glaring failure modes in the mental model one - one of the most extreme is if someone pops your password on two sites, they can likely derive all your other passwords.

Sure, although I wonder how often anyone is actually looking at single passwords, rather than just pushing tons of them through automated systems.

Depends on your threat model.

Public figures likely have their passwords individually scrutinized when their accounts are found out.

Re: I Know What Your Password Was Last Summer

#86

Post by sotix »

l72 wrote: post #80

We (tech professionals) really need to be hosting things like vaultwarden for our extended family. That is what I do, and have had good success. I even keep my vaultwarden on a private network and have an always on wireguard vpn on all my family's devices.

I tried to do this, but vaultwarden wouldn’t let me set it up because I wasn’t using https even though it’s a local network only accessed via WireGuard. Any tips on how to set that up?

Re: I Know What Your Password Was Last Summer

#87

Post by ianburrell »

yieldcrv wrote: post #68
DeathArrow wrote: post #42

Earlier quoted context omitted.

>Just use a password manager! What if I don't have access to the password manager at some point but I do need to log into some website? I.e. visiting friends house, forgot my phone at home but I need to log in my banking app to do a transfer? Or visiting a foreign country, someone steals my papers and my phone and I need to login to mail at a public cafe to let my family know I am well.

you can read your passwords in a password manager, memorize a couple of them for the risks you think you have what I typically would do in both of those scenarios is a password reset. I would know my email password and do a password reset of everything else and get that in my email. privilege escalate on yourself. realistically, I’ve been at Apple Stores multiple times where I needed to login manually to my icloud ac…

I think it is important to have a few passwords that have memorized. The most important one for me is Google, cause then can reset passwords with Gmail. I don't store them in password manager.

Re: I Know What Your Password Was Last Summer

#88

Post by I_like_pigeons »

jstanley wrote: post #41
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

> I always tell these people to just sign up for a password manager and they always resist and say no. I must be missing something obvious. Maybe they don't want to be relying on a random third-party for all their passwords? Rather than getting them to sign up for a password manager, what about getting them to install a password manager? I use https://www.passwordstore.org/ - it encrypts your passwords with GPG, and…

I suppose the biggest advantage of a online password manager for non-tech savvy users is the syncing between devices.

Re: I Know What Your Password Was Last Summer

#89

Post by jstanley »

I_like_pigeons wrote: post #88
jstanley wrote: post #41

Earlier quoted context omitted.

> I always tell these people to just sign up for a password manager and they always resist and say no. I must be missing something obvious. Maybe they don't want to be relying on a random third-party for all their passwords? Rather than getting them to sign up for a password manager, what about getting them to install a password manager? I use https://www.passwordstore.org/ - it encrypts your passwords with GPG, and…

I suppose the biggest advantage of a online password manager for non-tech savvy users is the syncing between devices.

But pass does that too, you could even use github for the backing if you wanted.

Re: I Know What Your Password Was Last Summer

#90

Post by rvnx »

bongodongobob wrote: post #82
rvnx wrote: post #21

Earlier quoted context omitted.

It’s not necessarily management. When you run large IT systems, external auditors come into your systems and say : 1) no password rotation = bad 2) no password format enforcement = bad Though it’s absurd to force people to have a password between 6 and 8 chars for example, because it limits the amount of possibilities.

No, password rotation has not been standard best practice for quite some time now. Best practice is long passwords with no rotation. For humans . Service/admin accounts should be rotating constantly.

Apparently EY or KPMG are not aware of that, yet they make the rules
Post reply on HN