Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Change your Last.fm password

thenextweb.com

Post reply on HN
Print view View original

141–150 of 152 posts

Re: Change your Last.fm password

#141

Post by __alexs »

bigiain wrote: post #119
chrismsnz wrote: post #113

Earlier quoted context omitted.

That's what I did when I migrated our application to bcrypt some time ago. I had some questions about whether using an md5sum as the bcrypt input, with much less keyspace (only hex characters) had any impact on security but nobody could/would answer. I'm guessing that knowing that the plaintext for the bcrypt hash is always going to be 16 characters of 0-9,a-f might have some impact on crypto analysis but considering…

Yeah sure, bcrypt(salt, md5/sha1(password)) is in general less "secure" than bcrypt(salt,password)#, it's still more secure than md5/sha1(password). # Note though, that you need at least 20 printable ascii chars to get the 128 bits of entropy possible in an MD5 hash, so for _most_ passwords, you could optimize your cracker by only bruteforcing bcrypt(salt, md5/sha1(password)) using shorter strings as password guesses…

Only for users with >128/160-bits of entropy in their password, which probably means your password is well over 20 chars long.

Re: Change your Last.fm password

#142

Post by pbhjpbhj »

sliverstorm wrote: post #52
anigbrowl wrote: post #47

Jeepers, I just changed my linked in password. I had the source for PGP back in 1993, I don't recycle passwords for anything remotely important, I use gnarly long passphrases, two factor authentication and what-all else, and I AM SICK OF IT. I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. I'm tired of the maintenance security imposes on me, the lack of a meaningful indu…

I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. Fundamental flaw with that- you can't change your fingerprint if/when it is compromised.

Some people dont have fingerprints. How will you handle them?

Re: Change your Last.fm password

#143

Post by nitrogen »

obituary_latte wrote: post #53
anigbrowl wrote: post #47

Jeepers, I just changed my linked in password. I had the source for PGP back in 1993, I don't recycle passwords for anything remotely important, I use gnarly long passphrases, two factor authentication and what-all else, and I AM SICK OF IT. I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. I'm tired of the maintenance security imposes on me, the lack of a meaningful indu…

Funnily enough I opened a new bank account the other day (Chase) and to my surprise they don't allow special characters to be used in the passwords. It indeed appears that the entire system is broken beyond repair. It seems like it is becoming the norm to expect to be exploited at some point so the de-facto preemption is to have someone to blame. As the manager of a datacenter we recently moved into said "we're here…

Funnily enough I opened a new bank account the other day (Chase) and to my surprise they don't allow special characters to be used in the passwords.

Special characters don't make as much of a difference as password length: http://xkcd.com/936/ (a comic that must appear on any password-related thread). According to the XKCD analysis, an 8 character password based mostly on letters with some numbers and symbols has ~28 bits of entropy, while a random four word password has 44 bits. [Edit to add: http://news.ycombinator.com/item?id=4083381 claims over 3 billion MD5 hashes a second for $1000, meaning your 28-bit password could be cracked effectively instantaneously by a high school kid buying phishing gear with stolen credit cards or a summer job].

If you're an international web site, it might make sense to disallow symbols, as your customers may not be able to enter their chosen symbols when traveling internationally.

Re: Change your Last.fm password

#144

Post by nitrogen »

gioele wrote: post #138

It is OK to suggest users to change their passwords, but shouldn't they stop sending their session cookies over plain HTTP? Session hijacking is now widespread and an easy way to get into non-important accounts and then escalate to more interesting accounts. [1] https://www.owasp.org/index.php/Session_hijacking_attack PS: I'm leaving this comment without any reference to the site name, so I can copy and paste it verb…

PS: I'm leaving this comment without any reference to the site name, so I can copy and paste it verbatim in the future; it looks like this kind of breaches will not stop soon.

Be aware that there is the possibility[0] that HN's (or other sites') anti-spam features may detect a copy-pasted post as duplicate or artificial content, and kill it and/or your account. It's probably better to add a link to the original post, with some article-specific text.

[0] Based on speculation and inference, not actual knowledge.

Re: Change your Last.fm password

#145

Post by markkum »

jackalope wrote: post #57
markkum wrote: post #7

Earlier quoted context omitted.

If you want something better for your site; check out MePIN https://www.mepin.com/

How do they prevent unauthorized locks, unlocks or transfers? There's virtually no documentation on the site.

Hi, a new developer section for the site is in the works. Stay tuned.

Re: Change your Last.fm password

#146

Post by astrodust »

tzs wrote: post #110
anigbrowl wrote: post #47

Jeepers, I just changed my linked in password. I had the source for PGP back in 1993, I don't recycle passwords for anything remotely important, I use gnarly long passphrases, two factor authentication and what-all else, and I AM SICK OF IT. I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. I'm tired of the maintenance security imposes on me, the lack of a meaningful indu…

> I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. MythBusters looked at fingerprint scanners in episode 59, "Crimes and Myth-Demeanors 2". They were able to easily bypass both the cheap consumer models and an expensive professional one with advanced features that supposedly check for body heat and a pulse to make sure you aren't using a fake finger. Another problem with…

All they needed was a photocopy of your thumb-print that was licked, stuck to your thumb, and applied to the scanner. If it was 'warm' enough and had some kind of pulse, you were in.

The "Jell-O finger", made much the same way, using a standard electronic board etched to make an inverse thumb-print also worked freakishly well.

Re: Change your Last.fm password

#147

Post by mnicole »

ricardobeat wrote: post #121
mnicole wrote: post #71

Earlier quoted context omitted.

Ditto. 196k since '05 here. The ability to see how my musical taste synced with the ebb and flow of my life is something I really cherish.

29k since September 2004, and I listen to an album almost every day. You're scrobbling songs during your whole work day, right? I disable it at work, since I don't pay much attention and end up with lots of plays I don't care much about. (edit: my average is really 10 songs/day!).

I am listening to music all the time. I have it hooked up with all of the mobile services I've used (Spotify, Rdio), SoundCloud, and online radio services that support it in addition to regular old iTunes and Winamp on my computers. I'd say I listen to the equivalent of 3-4 albums per day. There's a lot of random one-offs that get tossed in there, but there have also been months where I either turned off the service out of embarrassment over something I wanted to listen to and forgot to turn back on, or just plain didn't download it or sign into it through another service. I figure that the fluff evens those times out.

Re: Change your Last.fm password

#148

Post by Arelius »

ricardobeat wrote: post #122

I doubt my new password will be any safer, so I can't really use one which follows my current pseudo-random patterns. I'm now convinced that password managers, with random generated passwords, are the way to go. At least they have a strong incentive to focus on protecting user data. Still scared of not knowing my own passwords, and giving them to a third party, though.

Agreed, I would never trust my passwords to a private third-party with closed code-base. And KeePass still seems a little meh, especially regarding device support. So for now I'm using an encrypted file synced with DropBox.

Re: Change your Last.fm password

#149

Post by astine »

Groxx wrote: post #131
astine wrote: post #103

Earlier quoted context omitted.

Just switch fingers.

And the 11th time? I think I've had significantly > 10 sites I use have major password leaks. And I just turned 26 - my 10 fingers (ok, 20 with toes) would need to last a lifetime for this to be a viable solution.

I'd be more concerned about government mandated fingerprinting. Using public key authentication, it would be possible to make biometric keys nigh impossible to steal (such that they don't ever exist on disk in any form whatsoever.) However, they're really easy to steal if you can ever get physical access to the person or any personal records that happens to record said information.

Re: Change your Last.fm password

#150

Post by presto8 »

nitrogen wrote: post #143
obituary_latte wrote: post #53

Earlier quoted context omitted.

Funnily enough I opened a new bank account the other day (Chase) and to my surprise they don't allow special characters to be used in the passwords. It indeed appears that the entire system is broken beyond repair. It seems like it is becoming the norm to expect to be exploited at some point so the de-facto preemption is to have someone to blame. As the manager of a datacenter we recently moved into said "we're here…

Funnily enough I opened a new bank account the other day (Chase) and to my surprise they don't allow special characters to be used in the passwords. Special characters don't make as much of a difference as password length: http://xkcd.com/936/ (a comic that must appear on any password-related thread). According to the XKCD analysis, an 8 character password based mostly on letters with some numbers and symbols has ~28…

Do you know how they are calculating the approximate entropy score of the characters used in the passwords?

I entered the password from the xkcd comic in this web site: http://rumkin.com/tools/password/passchk.php

And got an entropy of 51.8 bits.

Long passwords are great (especially if one is using a password manager), but not many places accept them.

Post reply on HN