101–110 of 120 posts
For sensitive sites like this, users should not be given the option to use the same username/password as other websites: The username should be issued by the site in the form Sally379687 or Fred965912
Then people are just likely to write it down, or forget it, etc. Need to provide for humans too :)
The question for us, as technologists, is what are we doing about this? 2FA is nice, but not the end all, be all. OAuth has largely failed to gain any reasonable traction. Using Facebook login means Facebook gets to track me as I move around the web. Our users reuse passwords, primarily due to the proliferation of dozens or often hundreds of online accounts that a single individual has. We can't expect people to use…
Don't impose any restrictions on what the password should be, e.g. "Must not contain any special chars. Must contain a number..."
Use the word "pass phrase" instead of "password". Encourage people to use memorable phrases and quotes as their pass phrase. The English language has approx. 250,000 words. If a pass phrase contains 4 words, that's 1.62764322e+20 permutations. That's a naive view since "habit osteopath circumference telephone" isn't a particularly memorable password. With this in mind, You could use statistics to reduce the number of permutations, but that's no small feat.
Use email addresses instead of user-names.
Finally, use Bcrypt.
The question for us, as technologists, is what are we doing about this? 2FA is nice, but not the end all, be all. OAuth has largely failed to gain any reasonable traction. Using Facebook login means Facebook gets to track me as I move around the web. Our users reuse passwords, primarily due to the proliferation of dozens or often hundreds of online accounts that a single individual has. We can't expect people to use…
> Where are we with replacing the password? The state of the art of the technology, in my opinion, is GRC's SQRL: https://www.grc.com/sqrl/sqrl.htm However I think you have captured something essential in the idea that Mozilla Persona "failed to catch on", and it wasn't, as far as I can tell, for technical reasons. The real problem is that any change from the username/password system has a cost (in programmer hours,…
Hey all, Teddy from Namecheap here. Happy to answer any questions here or at ted@namecheap.com. As always, we advise turning on 2-factor authentication on your account.
We've been waiting for ages for another 2FA option from Namecheap, either Authy or Google Auth. Now I'm just registering my domains elsewhere and when my Namecheap domains come up for renewal I'm jus transferring out.
Earlier quoted context omitted.
Why did you have to bring up the specific "CyberVor" incident that has been called out as bullshit by several people in the security industry?
While cheerfully acknowledging there is controversy, I dispute your immediate dismissal of these reports. For other readers, then: http://krebsonsecurity.com/2014/08/qa-on-the-reported-theft-... https://www.schneier.com/blog/archives/2014/08/over_a_billio... As to why it may be on-topic here: the activity reported by NameCheap in the OP lines up pretty well with the reports of a large collection of compromised accoun…
Earlier quoted context omitted.
Why not just use: https://lastpass.com/ https://agilebits.com/onepassword http://keepass.info/
Isn't there greater risk in using these than my method? My logic: If one of these solutions e.g. LastPass is compromised then I am compromised across all sites. They may even bypass 2 factor authentication that goes via my email/messaging. Whereas using my method if one website gets hacked then I only give access to a segment. If it is worst case and a financial site is compromised they still don't have the password…
The question for us, as technologists, is what are we doing about this? 2FA is nice, but not the end all, be all. OAuth has largely failed to gain any reasonable traction. Using Facebook login means Facebook gets to track me as I move around the web. Our users reuse passwords, primarily due to the proliferation of dozens or often hundreds of online accounts that a single individual has. We can't expect people to use…
> Where are we with replacing the password? The state of the art of the technology, in my opinion, is GRC's SQRL: https://www.grc.com/sqrl/sqrl.htm However I think you have captured something essential in the idea that Mozilla Persona "failed to catch on", and it wasn't, as far as I can tell, for technical reasons. The real problem is that any change from the username/password system has a cost (in programmer hours,…
This idea SERIOUSLY needs more attention, Steve is basically presenting a complete blueprint for how to do web login security right on everything from smartphones to desktops. A startup could run this implementation-wise and if the hype was right it could be a massive hit.
Earlier quoted context omitted.
You should have no such expectation. This isn't a namecheap-specific security issue - they are reporting their perspective of a global security issue.
They are reporting a specific attack on Namecheap accounts based upon a previous attack.
At last count, I have several hundred logins with various online services. I do not want a note every time one of them is subject to a dictionary attack, no matter the scale.
Earlier quoted context omitted.
As someone who plays online games, I get really, really annoyed when I'm forced to create a password to log in. ALL non-secure online sites that need to identify users should allow for Google or Facebook authentication, or I will never try to access the game from my phone or tablet. I refuse to use the same password everywhere, but that means I have a password vault on my computer . If I need to create a password and…
Find a better vault solution. Keepassx is available for every platform out there, and when combined with a file sync solution like dropbox, box, etc can be trivially used on iOS or android.
I know the Keepass file is nominally password protected, but once I upload a Keepass file with all my important passwords to a site like Dropbox, there's no way to ever recall it reliably.
So if there's a Dropbox security hole, someone can potentially grab a copy. And then if there's a Keepass security hole (or if they otherwise acquire my password), then all my important passwords are compromised.
To me it's a form of "two factor" authentication for my passwords: One factor is the passphrase, the other is the physical file itself. And one of those is defeated if I upload the file to some cloud service.
Earlier quoted context omitted.
As someone who plays online games, I get really, really annoyed when I'm forced to create a password to log in. ALL non-secure online sites that need to identify users should allow for Google or Facebook authentication, or I will never try to access the game from my phone or tablet. I refuse to use the same password everywhere, but that means I have a password vault on my computer . If I need to create a password and…
Some of us use password managers like 1Password and get really, really annoyed when we're forced to use Google or Facebook to log in. There are two sides to this - some prefer convenience and are happy to give up some control. Others do not want to depend on a third party and want to have control themselves.
OAUTH is a far better solution in general. If there were a standard privacy-respecting third-party to replace the Google and Facebook options, I'd be all over it. But I'll happily let Google know that I'm playing a game in exchange for not having to manage yet-another-password.