Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Know What Your Password Was Last Summer

labs.lares.com

Post reply on HN
Print view View original

91–100 of 103 posts

Re: I Know What Your Password Was Last Summer

#91

Post by BenjiWiebe »

mpol wrote: post #47
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

I was like this some years ago. My assumption was that nobody can guess my password, because it is not straightforward. Untill someone explained that if someone new one password, he would know them all. Only then did I start using Keepassxc. Another factor is inconvenience. On the road, most passwords are out of reach for me now. In a way I prefer it that way, I prefer to not be glued to my phone. As a compromise, th…

I use VNC over SSH to access my home PC (and it's password manager) from my phone when the need is severe.

Re: I Know What Your Password Was Last Summer

#92

Post by paulmd »

bruce343434 wrote: post #34
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

A password manager relies on a single point of failure secret (master password), while the website-hash approach relies on a single point of failure secret (master key derivation algorithm). It's really no different, so I think there must be some human biased thinking at play. Except the password manager requires a central or synchronizing computer system, while the in-head key derivation approach requires no such th…

Your mental password-generation scheme is equally susceptible to the “master password” being lost or forgotten. Why do you assume you can remember a bunch of rules plus a password, if you can’t remember the password itself?

Synchronizing is easy, put it in a network share or Dropbox/google drive/iCloud. If for some reason it’s inaccessible, keepass/dropbox will synchronize any local changes the next time you open the manager while you’re at home. This is a solved problem.

Re: I Know What Your Password Was Last Summer

#93

Post by paulmd »

temporarara wrote: post #65
lopkeny12ko wrote: post #30

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a ru…

No. I will never put all my passwords into some black box, no matter how it is pitched to me, and certainly I won't pay for that "privilege". I have all my passwords written down in a sheet of paper slightly obfuscated to make them pretty much worthless even if someone found them (actually I have multiple copies, stored in multiple places). They are all mnemonic to begin with. So if my computer dies, for example, my…

wow I never knew pass(1) cost money, how does that work? isn’t it GPL and all????

(keepass2/keepass xc are more user-friendly and free, strongbox is another good front-end for keepass files as well.)

Re: I Know What Your Password Was Last Summer

#94

Post by ifyoubuildit »

CharlesW wrote: post #78
temporarara wrote: post #65

Earlier quoted context omitted.

No. I will never put all my passwords into some black box, no matter how it is pitched to me, and certainly I won't pay for that "privilege". I have all my passwords written down in a sheet of paper slightly obfuscated to make them pretty much worthless even if someone found them (actually I have multiple copies, stored in multiple places). They are all mnemonic to begin with. So if my computer dies, for example, my…

> I will never put all my passwords into some black box […]. I have all my passwords written down in a sheet of paper slightly obfuscated to make them pretty much worthless even if someone found them (actually I have multiple copies, stored in multiple places). Is this satire?

Well, his sheets of paper could be obtained by 10s to 100s of people with physical access who then might figure out the obfuscation (or burn down in a fire, but copies mitigate that).

Some fancy password manager service can be attacked by anyone with a network connection or the budget to buy the company. And there's an actual incentive to attack the password service because it doesn't just have parent's passwords, it has many passwords.

I think the only downside to the sheet of paper is that people with physical access are probably more likely to be specifically interested in you, and therefore willing to put in the effort to figure it out. But they'd probably figure it out anyway if they're that interested (install a keylogger or camera or something).

Re: I Know What Your Password Was Last Summer

#95

Post by broast »

an_ko wrote: post #50
broast wrote: post #29

My personal favorite method for passwords is come up with a passphrase I can remember, encode it to base 64, and use the encoded string as the password. If its not too long, the encoded version is usually not hard to memorize either.

Thanks, I'll add base64 as one of the trivial transformations to my ongoing brute-forcing effort of all your passwords, multiplying total search effort by a tiny constant. I'm joking. But what if I weren't? Especially if you're going to announce this on the internet, it sounds far more effective to add 1 character to the end of your passphrase instead, since each exponentiates any brute force effort, and isn't defeat…

I personally can appreciate multiplying an attackers standard dictionary with a transformation. I find the decoded passphrase is already high entropy so it just adds a little bit of trouble. I might consider bcrypt, thanks for the idea.

Re: I Know What Your Password Was Last Summer

#96

Post by CharlesW »

ifyoubuildit wrote: post #94
CharlesW wrote: post #78

Earlier quoted context omitted.

> I will never put all my passwords into some black box […]. I have all my passwords written down in a sheet of paper slightly obfuscated to make them pretty much worthless even if someone found them (actually I have multiple copies, stored in multiple places). Is this satire?

Well, his sheets of paper could be obtained by 10s to 100s of people with physical access who then might figure out the obfuscation (or burn down in a fire, but copies mitigate that). Some fancy password manager service can be attacked by anyone with a network connection or the budget to buy the company. And there's an actual incentive to attack the password service because it doesn't just have parent's passwords, it…

> And there's an actual incentive to attack the password service because it doesn't just have parent's passwords, it has many passwords.

For sure, but hopefully folks are using solutions where the provider can't decrypt their data, much less attackers.

Re: I Know What Your Password Was Last Summer

#97

Post by seoulmetro »

an_ko wrote: post #50
broast wrote: post #29

My personal favorite method for passwords is come up with a passphrase I can remember, encode it to base 64, and use the encoded string as the password. If its not too long, the encoded version is usually not hard to memorize either.

Thanks, I'll add base64 as one of the trivial transformations to my ongoing brute-forcing effort of all your passwords, multiplying total search effort by a tiny constant. I'm joking. But what if I weren't? Especially if you're going to announce this on the internet, it sounds far more effective to add 1 character to the end of your passphrase instead, since each exponentiates any brute force effort, and isn't defeat…

Wouldn't it be adding whatever the sum of your brute forcing list is onto itself? Which seems like a lot?

Re: I Know What Your Password Was Last Summer

#98

Post by subtra3t »

kemotep wrote: post #55
subtra3t wrote: post #31

Earlier quoted context omitted.

If anybody is curious about what the account commented, this is the other comment from the same account: --- I created a portfolio with Mrs Marlena she has awesome trading strategy and it's been a life-changer for me! If you want to level up your trading game and start making right speculation on trading gains, sign up by following her on INSrTA g ram @** and we'll both get some sweet perks. Let's conquer the market…

I’ve been noticing a handful of these types of comments from a couple of different accounts. Why is someone trying to scam/advertise managed crypto trading accounts?

These comments have always been prevalent in YT/Instagram/Reddit.

Re: I Know What Your Password Was Last Summer

#99

Post by ifyoubuildit »

CharlesW wrote: post #96
ifyoubuildit wrote: post #94

Earlier quoted context omitted.

Well, his sheets of paper could be obtained by 10s to 100s of people with physical access who then might figure out the obfuscation (or burn down in a fire, but copies mitigate that). Some fancy password manager service can be attacked by anyone with a network connection or the budget to buy the company. And there's an actual incentive to attack the password service because it doesn't just have parent's passwords, it…

> And there's an actual incentive to attack the password service because it doesn't just have parent's passwords, it has many passwords. For sure, but hopefully folks are using solutions where the provider can't decrypt their data, much less attackers.

A lot of these cloud services you really have to rely on the hope that things are done in a sane way, now and into the future.

Have you ever had to hope that your lined paper wasn't going to fuck you over?

Re: I Know What Your Password Was Last Summer

#100

Post by l72 »

sotix wrote: post #86
l72 wrote: post #80

We (tech professionals) really need to be hosting things like vaultwarden for our extended family. That is what I do, and have had good success. I even keep my vaultwarden on a private network and have an always on wireguard vpn on all my family's devices.

I tried to do this, but vaultwarden wouldn’t let me set it up because I wasn’t using https even though it’s a local network only accessed via WireGuard. Any tips on how to set that up?

I run vaultwarden in docker and use jwilder/nginx-proxy and jrcs/letsencrypt-nginx-proxy-companion to add an SSL proxy.

It is nice, because it has the option to keep http open on the subdomain for doing let's encrypt stuff, but the actually SSL site will be internal only.

Post reply on HN