Cloud flare is an ooc spof, this will need addressing sooner or later
Out-of-control single point of failure?
Password reuse is rampant: nearly half of observed user logins are compromised
31–40 of 51 posts
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#32I have a rule that modifies a base password depending on the name of the site the password is for. That way I only have to remember the base password and the rule.
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#33Earlier quoted context omitted.
What do you mean? Is cloudflare causing 3rd parties to read our passwords?
Could. A HTTP post request along the wire is unencrypted. I'm talking about a submit button not HTTPS as that just encrypts the connection session and not the data sent from say a form. If you're using or utilising CF for something where the data is being posted to an API unless you have client side encryption anything receiving that data will be received in plain text. Someone only needs to compromise the service wo…
I highly doubt that this is true. HTTPS POST data is encrypted just like any other HTTPS data. But, if one is using CloudFlare or any other proxy, by nature, that data needs to be decrypted and then encrypted again on it's way to the destination server. So, yes, of course, each and every proxy can see the data. And, no, HTTPS POST data can't be snooped over the wire otherwise.
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#34I have a rule that modifies a base password depending on the name of the site the password is for. That way I only have to remember the base password and the rule.
I have three of your passwords and the domain each is associated with. The pattern is obvious, so now I have all your other passwords too.
Also, you don’t need to remember only the base password and the rule. You also need to have an exceptions process for when your “generated” password is incompatible with the esoteric requirements of a new site (length, character restrictions, etc.). And you need to remember this at login time, when you aren’t presented with the same information about those requirements as you were when you registered.
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#35I have a rule that modifies a base password depending on the name of the site the password is for. That way I only have to remember the base password and the rule.
I used to do this (10+ years ago), but once a few get leaked, everything else would get exposed if someone wanted to target you.
Much easier to just manage randomized passwords through 1Password.
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#36Earlier quoted context omitted.
Could. A HTTP post request along the wire is unencrypted. I'm talking about a submit button not HTTPS as that just encrypts the connection session and not the data sent from say a form. If you're using or utilising CF for something where the data is being posted to an API unless you have client side encryption anything receiving that data will be received in plain text. Someone only needs to compromise the service wo…
I highly doubt that this is true. HTTPS POST data is encrypted just like any other HTTPS data. But, if one is using CloudFlare or any other proxy, by nature, that data needs to be decrypted and then encrypted again on it's way to the destination server. So, yes, of course, each and every proxy can see the data. And, no, HTTPS POST data can't be snooped over the wire otherwise.
What's not true? I may of mumbled my post.
The data from the form, HTTPS POST data is not encrypted. It's plain text encapsulated in a secure socket.
Setup a PHP page with a form and capture the $_POST. All will return in plaintext.
POST is data is sent in headers which yes are encrypted by SSL but the servers receiving will receive it in plain text.
By using third party you lose full control of the data flow encrypted or not. All it takes is one weak link in the chain and your data is screwed.
You're relying on the 3rd party infrastructure not being exploited.
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#37I have a rule that modifies a base password depending on the name of the site the password is for. That way I only have to remember the base password and the rule.
I used to do this but stopped a very long time ago. I use KeePassXC instead. It’s much more secure and much better at handling websites with special password requirements.
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#38Passwords are a pain in the ass, I just wished that having a cryptographic key installed in your device (and linked to it) to login to stuff or having an external crypto-device to login was easier and more common. For local access, biometrical is fine, and a "super-secure" password for if something happens that can only be used once would be the way.
Biometrics are really not fine. They're somehow supposed to be some permanent marker of who you are, but that's really not how it works in the real world. You physically change. I've broken any biometrics recognising me in a dozen different ways, this year alone. Cut open my finger, changing my fingerprint. Head surgery for melanoma gave me a scar so facial recognition doesn't work anymore, blood vessel burst in my e…
Again, biometrics are fine for local access. If you cut your finger or scar your face just use your backup method (maybe a pin, maybe a different finger) to get in and update the scan. And if someone steals your fingerprint they can't use it without having physical access to your device, because again, this is for local access.
For remote authentication you use a private key accessed via the local system (which you are already authenticated to using biometrics).
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#39I have a rule that modifies a base password depending on the name of the site the password is for. That way I only have to remember the base password and the rule.
I have three of your passwords and the domain each is associated with. The pattern is obvious, so now I have all your other passwords too. Also, you don’t need to remember only the base password and the rule. You also need to have an exceptions process for when your “generated” password is incompatible with the esoteric requirements of a new site (length, character restrictions, etc.). And you need to remember this a…
When I used to do this (and I feel safe talking about it because I haven't done this in many years), I also kept a document that listed any such exceptions. Generally the document would just say something like "mixed case, number, symbol" which was enough to remind me what I did.
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#40I have a standard password that I know has been leaked, and I don't care. I use it only for accounts with no value. Accounts that don't hurt me if they get hacked. Obviously my email, bank and primary social media use strong passwords.
Maybe someone should investigate how many sites require a password but really shouldn't.