Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I salt my own passwords and sleep a little better at night

peebs.org

Post reply on HN
Print view View original

31–40 of 42 posts

Re: How I salt my own passwords and sleep a little better at night

#31

Post by mistercow »

stcredzero wrote: post #28
morsch wrote: post #14

This is not good protection against a targeted effort -- when somebody wants to get your account as opposed to any account, when they have one instance of a "salted" password they might be able to reverse-engineer your salting effort and apply it to another site. And they don't have to completely reverse it, either, it might be enough to significantly reduce the difficulty of brute force. But it sure beats using an i…

...it can still be done completely in your head, as opposed to other schemes ("real" hashing schemes, password managers) I'm using a free password manager (KeePassX) with the file hosted on Dropbox for a couple of years now. I've not had any major trouble with it. People might like to note, though, that my 16 character randomly password (lowercase letters and numbers for over 128 bits of entropy) was still cracked du…

Isn't that putting a lot of trust into Dropbox, and into your own ability to make sure that you never accidentally leave a computer logged in on Dropbox?

Re: How I salt my own passwords and sleep a little better at night

#32

Post by bigiain »

tjoff wrote: post #26

This is, in my opinion, the best way (by far) to handle passwords for non-security-critical accounts. Came across this forum that you last visited 7 years ago? Remember the password? With this technique you will, without resorting to password managers - and still have a unique password on every site. Remember not to make your salt obvious though. In other words don't just append the domain name in front of the passwo…

" … without resorting to password managers"

What do you find so hard about "resorting to password managers"?

For me, I reckon adopting 1Password has _reduced_ the amount of hassle dealing with passwords causes me. 95+% of every website login has become command-slash-return. Registering for new sites has added a single click to the "do you want to save this login" popup.

Since I always carry my smartphone, I've _always_ got my passwords securely stored in my pocket, as well as on my Pad, laptop, and work machine. I find it hard to understand why people _don't_ use some sort of password safe software…

Re: How I salt my own passwords and sleep a little better at night

#33

Post by stcredzero »

mistercow wrote: post #31
stcredzero wrote: post #28

Earlier quoted context omitted.

...it can still be done completely in your head, as opposed to other schemes ("real" hashing schemes, password managers) I'm using a free password manager (KeePassX) with the file hosted on Dropbox for a couple of years now. I've not had any major trouble with it. People might like to note, though, that my 16 character randomly password (lowercase letters and numbers for over 128 bits of entropy) was still cracked du…

Isn't that putting a lot of trust into Dropbox, and into your own ability to make sure that you never accidentally leave a computer logged in on Dropbox?

The KeePass file has its own encryption. Just devise one password with enough entropy.

Re: How I salt my own passwords and sleep a little better at night

#34

Post by mistercow »

stcredzero wrote: post #33
mistercow wrote: post #31

Earlier quoted context omitted.

Isn't that putting a lot of trust into Dropbox, and into your own ability to make sure that you never accidentally leave a computer logged in on Dropbox?

The KeePass file has its own encryption. Just devise one password with enough entropy.

Oh, that makes sense.

Re: How I salt my own passwords and sleep a little better at night

#36

Post by krrrh »

nemesisj wrote: post #6
jameswyse wrote: post #2

This is just a way to create a slightly more complex password, if it's stored as a fast hash (like md5) then it's still going to be very easy to crack. The problem with this method is that if one of your passwords is leaked and cracked then it wouldn't be too hard to guess how your scheme works. This gets even easier if they have 2 or more of your passwords. It seems to me that a scheme like this would have to be muc…

It's definitely not a fool proof or airtight system, but it's going to be at least a little time consuming to figure out the mechanism. Sure, a concerted effort will still break it, but you can protect yourself a bit more from a "0-day" hack than the alternatives: same password everywhere. We definitely need better authentication methods. For example, why couldn't Google open up their 2 factor authentication method?…

Googles two-factor authentication system is open sourced.

https://code.google.com/p/google-authenticator/

They include a JavaScript implementation and a PAM module. In fact, Dreamhost just implemented two factor auth that uses the Google Authenticator app last week. It works really well.

http://wiki.dreamhost.com/Enabling_Multifactor_Authenticatio...

In addition, Clavid OpenID integrates with the Google Authenticator app if you're an openID user.

I've been looking at the Yubikey+LastPass combo, which can also integrate with Google two-factor if you install a helper app. It seems like a nice solution, except that I'm really not a fan of the LastPass user experience.

Re: How I salt my own passwords and sleep a little better at night

#37

Post by tjoff »

bigiain wrote: post #32
tjoff wrote: post #26

This is, in my opinion, the best way (by far) to handle passwords for non-security-critical accounts. Came across this forum that you last visited 7 years ago? Remember the password? With this technique you will, without resorting to password managers - and still have a unique password on every site. Remember not to make your salt obvious though. In other words don't just append the domain name in front of the passwo…

" … without resorting to password managers" What do you find so hard about "resorting to password managers"? For me, I reckon adopting 1Password has _reduced_ the amount of hassle dealing with passwords causes me. 95+% of every website login has become command-slash-return. Registering for new sites has added a single click to the "do you want to save this login" popup. Since I always carry my smartphone, I've _alway…

So you write your password off your smartphone? And you call that reducing the amount of hassle?

"command-slash-return" isn't acceptable security either, I must be able to lend out my computer without reducing the barrier to my online accounts.

Also if I lost my phone (it breaks or get stolen) I must still have the freedom to be able to use the internet...

Everyone I've ever met that to my knowledge uses a password manager has, in my presence, been limited by it. No way on earth I'd put up with that.

Re: How I salt my own passwords and sleep a little better at night

#38

Post by mistercow »

fexl wrote: post #19

Use five random words from diceware.com to create a password, and you will have 65 bits of strength. No more tossing and turning.

That's good advice but it doesn't protect you from your password having the same hash on multiple sites.

Re: How I salt my own passwords and sleep a little better at night

#39

Post by bigiain »

tjoff wrote: post #37
bigiain wrote: post #32

Earlier quoted context omitted.

" … without resorting to password managers" What do you find so hard about "resorting to password managers"? For me, I reckon adopting 1Password has _reduced_ the amount of hassle dealing with passwords causes me. 95+% of every website login has become command-slash-return. Registering for new sites has added a single click to the "do you want to save this login" popup. Since I always carry my smartphone, I've _alway…

So you write your password off your smartphone? And you call that reducing the amount of hassle? "command-slash-return" isn't acceptable security either, I must be able to lend out my computer without reducing the barrier to my online accounts. Also if I lost my phone (it breaks or get stolen) I must still have the freedom to be able to use the internet... Everyone I've ever met that to my knowledge uses a password m…

No no, sorry - I wasn't clear enough. Let me clarify.

Transcribing passwords off my phone is always available as a last resort (most commonly used at the terminal in the datacenter, so extremely rarely). Almost all password entry is autofilled (via browser extensions) or cut/pasted from the 1Passwrod app.

"command-slash-return" - also needs my password safe passphrase (unless I've entered it in that last 5 mins and the machine hasnt slept or entered screensaver mode).

My phone is only one of devices with synced copies of my password safe data.

The only "limit" I've ever felt I've had since getting properly invested in using 1Password is that I now occasionally waste time having to "back down"from my default 16 random char passwords when somewhere won't accpet that length or charset.

Re: How I salt my own passwords and sleep a little better at night

#40

Post by tjoff »

bigiain wrote: post #39
tjoff wrote: post #37

Earlier quoted context omitted.

So you write your password off your smartphone? And you call that reducing the amount of hassle? "command-slash-return" isn't acceptable security either, I must be able to lend out my computer without reducing the barrier to my online accounts. Also if I lost my phone (it breaks or get stolen) I must still have the freedom to be able to use the internet... Everyone I've ever met that to my knowledge uses a password m…

No no, sorry - I wasn't clear enough. Let me clarify. Transcribing passwords off my phone is always available as a last resort (most commonly used at the terminal in the datacenter, so extremely rarely). Almost all password entry is autofilled (via browser extensions) or cut/pasted from the 1Passwrod app. "command-slash-return" - also needs my password safe passphrase (unless I've entered it in that last 5 mins and t…

Well, in cases where you can't (or don't want to) install browser extensions it is an astronomical limitation.

Even without the cases of your phone being stolen/lost/battery-empty the hassle is just waay too much to even consider it.

Post reply on HN