Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Enforcing Different Passwords for Different Sites

diegobasch.com

Post reply on HN
Print view View original

31–40 of 56 posts

Re: Enforcing Different Passwords for Different Sites

#31

Post by res0nat0r »

diego wrote: post #29
drivebyacct2 wrote: post #27

I cry everytime I read these threads on HN. I've never seen such stubborness than people desperately convinced that they need to be able to memorize their passwords, or that password managers are the devil. I'll say it again, just use a password manager. It generates random, complex passwords. It memorizes them for you. It pre-populates forms. They are locally encrypted and can be synced by themselves or with other t…

See all my other comments on this thread. Why does your mother use LastPass? How did she learn about it? How about the other 99% of the people? How do you make them use LastPass? This is not about us.

> Tell the user: your password must contain the following word: “hzru”

Enforcing this kind of thing on the masses won't make for stronger passwords, it will just have them opening up notepad.exe and saving this sites too-hard-to-remember-because-it-has-too-many-rules password on ~/Desktop/logins.txt

Re: Enforcing Different Passwords for Different Sites

#32

Post by anonycoward »

mudil wrote: post #19

After Gawker was hacked (and my account with it), I have created a website that tells average folks how to solve these issues: http://www.passmix.com/ . It's not a perfect solution, but it's way better than the same password for different websites.

From what I've read this (and methods like it) seems to be a common way to generate passwords. This seems to be a somewhat weak implementation though - imagine you used this method with the same base everywhere, and 2 sites were hacked, let's called them InLinked and Kergaw. Using the examples from passmix.com with base 'house cat' I might end up with: 'housei!n8cat' and 'housek!e6cat'. Say I'm targeting you specifically, I look at these two passwords, and I see that they both follow 'houseX!Y#cat' format. It's only a moment longer before I've a good guess at how the password is constructed, and then try it against your email. Once I've cracked your email I can just use the forgot password feature of any other site to reset your password there.

It would be quite easy to write a script to detect the similarity with the two passwords (9 characters in common, same positions, same length = 12).

You should never use the same password across sites, nor should you use the same password system unless that system is secure. Assuming you can keep your algorithm for password generation private, passing this through a one-way hash function might then strengthen your password a bit (at least a hacker couldn't easily visually derive your password algorithm, or that you are using one) but this still isn't perfect.

Generally it's not a good idea to tell people how to construct passwords unless you're an expert in cryptography. I'm not, so please don't take any of this as advice on how to construct a password. It's advice on how not to, if anything.

Re: Enforcing Different Passwords for Different Sites

#33

Post by Zikes »

diego wrote: post #29
drivebyacct2 wrote: post #27

I cry everytime I read these threads on HN. I've never seen such stubborness than people desperately convinced that they need to be able to memorize their passwords, or that password managers are the devil. I'll say it again, just use a password manager. It generates random, complex passwords. It memorizes them for you. It pre-populates forms. They are locally encrypted and can be synced by themselves or with other t…

See all my other comments on this thread. Why does your mother use LastPass? How did she learn about it? How about the other 99% of the people? How do you make them use LastPass? This is not about us.

One could forgo this password policy and advertise LastPass in the sign-up form for which this article's hypothetical readership is responsible.

Re: Enforcing Different Passwords for Different Sites

#34

Post by drivebyacct2 »

diego wrote: post #29
drivebyacct2 wrote: post #27

I cry everytime I read these threads on HN. I've never seen such stubborness than people desperately convinced that they need to be able to memorize their passwords, or that password managers are the devil. I'll say it again, just use a password manager. It generates random, complex passwords. It memorizes them for you. It pre-populates forms. They are locally encrypted and can be synced by themselves or with other t…

See all my other comments on this thread. Why does your mother use LastPass? How did she learn about it? How about the other 99% of the people? How do you make them use LastPass? This is not about us.

Ok, I'll put it another way. I'm some extremely large number percent more likely to be an early adopter of your product than my mother. I will never, ever sign up with such a restriction on my password.

I don't care what we do about the rest of them. Make a bigger black list, require more complex passwords, implement better protections against brute force.

The easiest one (to use and implement) is two-factor auth, but many people lack smartphones still so it's hard to make that the easy call.

Re: Enforcing Different Passwords for Different Sites

#35

Post by justjohn »

sp332 wrote: post #21
jtm45 wrote: post #15

This sparked an idea for me that I think I'll implement going forward - if you sign up with your email address and password, my server will try to login to your email account with those credentials, and if successful, say something like "hey, did you see that email [snippet of first email in inbox]". I feel this might encourage the user to use a different password.

Reading someone's email without permission is a crime. Nice idea though :)

You just have to add a clause to the TOS, nobody reads it anyway so you could grant yourself a licence to do anything with their email!

Re: Enforcing Different Passwords for Different Sites

#38

Post by diego »

res0nat0r wrote: post #31
diego wrote: post #29

Earlier quoted context omitted.

See all my other comments on this thread. Why does your mother use LastPass? How did she learn about it? How about the other 99% of the people? How do you make them use LastPass? This is not about us.

> Tell the user: your password must contain the following word: “hzru” Enforcing this kind of thing on the masses won't make for stronger passwords, it will just have them opening up notepad.exe and saving this sites too-hard-to-remember-because-it-has-too-many-rules password on ~/Desktop/logins.txt

Now you'd have to prove that having passwords stored in a file is worse than massive password leaks. I suspect that it isn't. People already carry laptops with browsers that save passwords automatically. Losing your laptop already implies a password-change-fest.

Re: Enforcing Different Passwords for Different Sites

#39

Post by joeguilmette »

I am the only person I know who uses a unique, memorable and strong password for every site I use. I store all of them in my head.

I have a base password and I add the first several characters of the site to the middle.

For example:

Facebook - sdfb231a2

Hacker News - sdyc231a2

Yahoo - sdya231a2

For strong passwords I can add a suffix to further strengthen the password.

PayPal - sdpa231a2a4

I use the same suffix for all "strong" passwords. If a site requires a capital letter I always capitalize the first letter.

I've gone to create an account with a site, been told I already have an account and I get the password in 1 guess because I'm so consistent with creating them.

I don't know why everyone doesn't do this.

Re: Enforcing Different Passwords for Different Sites

#40

Post by ken »

sp332 wrote: post #21
jtm45 wrote: post #15

This sparked an idea for me that I think I'll implement going forward - if you sign up with your email address and password, my server will try to login to your email account with those credentials, and if successful, say something like "hey, did you see that email [snippet of first email in inbox]". I feel this might encourage the user to use a different password.

Reading someone's email without permission is a crime. Nice idea though :)

Add some fine print in the user agreement, "During sign-up (only) for service X, I hereby authorize web service X to open my inbox and read one (1) email message, if I choose to provide my email account's password as my password for website X."

No longer a federal crime, maybe? Probably still get an angry mob with pitchforks outside your window.

Post reply on HN