11–20 of 557 posts
So, asking the HNers who crack passwords or follow the tech closely and have a good feel:
Salted sha1 can be brute forced much quicker, but in practical terms what kind of complexity of password is vulnerable today if it was stored salted sha1 vs bcrypt?
And how can this be projected to change in the next couple of years?
> My wife uses a password manager. If your significant other doesn't (and I'm assuming you do by virtue of being here and being interested in security), go and get them one now! 1Password now has a subscription service for $3 a month and you get the first 6 months for free.
How about...not? There are tiny open source tools for every OS. You can do it locally, save it on a stick or on your damn phone...why taking more risks especially facing this massive fail here?
Since lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well. I recommend Authy as your 2FA app, as it lets you set a backup password, which you can use to move your 2FA tokens between devices. For your critical services, keeping encrypted copies of your backup codes is a must.
I still feel squeamish about Authy having all the tokens - what happens when they get breached?
A successful attack would require both an Authy breach and that the attacker have passwords for the services that they want to compromise.
This should buy you enough time to regenerate your 2FA tokens to mitigate the threat.
Since lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well. I recommend Authy as your 2FA app, as it lets you set a backup password, which you can use to move your 2FA tokens between devices. For your critical services, keeping encrypted copies of your backup codes is a must.
Note the hack was in 2012. Hopefully most people have rotated passwords by now.
Repeating from the other thread: I highly recommend Troy's HIBP service, hiding your e-mail from showing up in public searches (important for opsec), and donating whatever you can to Troy. He's doing excellent work. This is the first time it's notified me and it was great, because I completely forgot I signed up. I appreciate a service that low maintenance. HIBP is a truly essential service and I'd be happy to pay mo…
@dang Can we please change the URL to not have the query parameters?
Earlier quoted context omitted.
It really is about time we stopped using passwords.
Honestly curious, what should we use?
Earlier quoted context omitted.
Honestly curious, what should we use?
Public-key crypto. Client side X.509 certificates for the web. S/MIME and OpenPGP keys for email. OpenSSH keys for SSH. etc
It was a complete nightmare unless you understood what public key crypto is, how it works, and how to configure your browser for it.
Don't get me started about having to move your certificate/keys around.
It doesn't work for the masses.