Xkcd: Encryptic • Hacker News Board

Re: Xkcd: Encryptic

#61

Post by bigiain » Mon, Nov 04, 2013, 9:21 PM UTC

Flenser wrote: post #59

arb99 wrote: post #46

Earlier quoted context omitted.

Good points, but: >4) Always create a separate email (or an alias) while signing up for cloud services, so you can eliminate guess work during a crisis. So, instead of signing up with example@gmail.com for Adobe or someone else, use example+adobe@gmail.com (this will redirect to example@gmail.com) or rather create adobe.example@gmail.com or something (gmail is just an example). This way, you can always trace out the…

> Doesn't stop someone just removing the + tag on the email address. It won't stop spam but the biggest risk with these leaks is from automated testing of a password found from a leak on one service you use with the same email address on another. As long as you use a separate + address for both you'll be safe as they are unlikely to automate testing of different + addresses since most users don't do that. > A better…

Is it too much of a reach to assume that any half-talented identity thief or exposed-user-list-scammer might be smart enough to know about rfc5233, and would write hs scripts/bots to automatically try the obvious variations of an email address of the form localpart+tag@example.com?

If I were attempting to exploit the Adobe list, every email address I saw like name+adobe@example.com, I'd try the exposed password using not just name+adobe@example.com and name@example.com, but also name+othertarget@example.com, where "othertarget" might be something like twitter, facebook, paypal - depending on where I'm attempting to misuse the exposed credential.

Re: Xkcd: Encryptic

#62

Post by bigiain » Mon, Nov 04, 2013, 9:25 PM UTC

Sami_Lehtinen wrote: post #56

arb99 wrote: post #46

Earlier quoted context omitted.

Good points, but: >4) Always create a separate email (or an alias) while signing up for cloud services, so you can eliminate guess work during a crisis. So, instead of signing up with example@gmail.com for Adobe or someone else, use example+adobe@gmail.com (this will redirect to example@gmail.com) or rather create adobe.example@gmail.com or something (gmail is just an example). This way, you can always trace out the…

For most it's just easier to use trashmail.net or mailinator.

Not sure that's a workable solution here - you wouldn't use a trashmail address to sign up for a many hundred dollar a year subscription like Creative Cloud. It works fine for stuff you only care about for the next few hours (like maybe the vpn service you register for so you can bittorrent cs6).

Re: Xkcd: Encryptic

#63

Post by bigiain » Mon, Nov 04, 2013, 9:30 PM UTC

sz4kerto wrote: post #8

RyanZAG wrote: post #6

Earlier quoted context omitted.

He missed a group of people: any designer who did not entrust their entire professional workflow to a single, for-profit company whose best interests are in moving your workflow in ways that benefit the company over the user. Being dependent on something like Photoshop for your only income is a terrible position to be in, yet it is how I'd describe most designers today.

That situation cannot be (or should not be) avoided if a product is significantly better that any other competitor on the market. You can choose between - depending on the for-profit company - having disadvantage on the marketplace because of inferior tools I think the former is often preferable.

FWIW, I think people are doing their careers a great dis-service if they're selling themselves just as "Photoshop Technicians".

Re: Xkcd: Encryptic

#64

Post by shawabawa3 » Tue, Nov 05, 2013, 9:59 AM UTC

rmc wrote: post #57

shawabawa3 wrote: post #54

Earlier quoted context omitted.

1. That's probably illegal so if there was one it wouldn't be publicly advertised 2. If adobe weren't completely stupid (a big if admittedly) it will be infeasible to brute force (>100 bits of entropy)

> it will be infeasible to brute force (>100 bits of entropy) Really? Even a massively distributed attempt?

100 bits of entropy takes around 10^26 seconds to crack [1]

Even if you somehow managed to get a botnet of 100 million machines, it would still take longer than the age of the universe to brute force it.

Security of 3DES is effectively 112 bits [2] if random keys are used. Although as I said, this is assuming adobe weren't completely stupid (and reused one or more of the keys, or used non-random keys)

   [1] https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.html

   [2] http://en.wikipedia.org/wiki/Triple_DES