Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down

blog.jgc.org

Post reply on HN
Print view View original

11–20 of 125 posts

Re: Write your passwords down

#11

Post by DanI-S »

Although this method may be great for you, it doesn't seem worth it to me.

Having your passwords hacked or guessed is bad because it's a hassle, and it can lead to you losing time and money.

This method of password generation/storage is also a hassle, and definitely leads to losing time (which may translate to money).

I find it far easier to come up with a reasonably long and complex 'base' password, then tag an extra bit to the end depending on which site you're accessing. Since our memory is strongly context dependent, it's easy to remember the extra little bit for the site you're currently on.

Re: Write your passwords down

#12

Post by corin_ »

jakehow wrote: post #10
corin_ wrote: post #9

Personally I don't see any reason for having them completely randomly generated. 'thIs1smyp4ssw0rd19%2' isn't any less secure than another 20 character password that includes lower+upper case letters, numbers and special characters. Obviously, if you do something like 'c0r1np4ssw0rd" then it may get to the stage where enough people do that for crackers to expect it (maybe it already is, but as long as you follow his…

The problem with this approach is that you can only remember a few passwords like this, which means that you are going to reuse passwords on multiple sites. One site compromise can compromise multiple accounts for you.

I don't have any problem remembering them personally (then again, I still remember root passwords I used when I was thirteen and they were completely random characters).

Sites like HN and Reddit I'm happy to use the same password (I'd be minorly annoyed, but realistically I wouldn't be that fussed if I lost control of either account, I can either recover it or even create a new one), but any site where someone finding my password could cause a problem has its own password, and I can remember them all.

Occasionally I forget which password goes with which site, but not often - actually I find it harder to remember which username/email goes with each site.

Re: Write your passwords down

#14

Post by aquinn »

I read a story on HN a while back about a guy who used an algorithm to generate his passwords. Don't have the link but something like combining easy to remember bits of personal information. e.g mother's name, kids birthday, maybe changing the case of these. Also adding something site specific like the last three letters of the url backwards. It's easy to remember passwords this way but if one gets out they're all vulnerable if someone looks closely.

Re: Write your passwords down

#15

Post by ali001 »

I think that a better solution is to use pwdhash. Check it out here:

http://pwdhash.com

It's a browser extension for Chrome and for Firefox that seamlessly hashes the concatenation of your master password and the domain name of the site you're logging into. This produces a different password for each site, and requires you to remember only your master password.

The extensions were created by Blake Ross (big name in the firefox community), as well as Collin Jackson and Dan Boneh who are highly regarded security experts at Stanford.

Also, if you're interested, I've created a command line utility for Mac OS X that exposes the same functionality: https://github.com/ali01/pwdhash.py

Re: Write your passwords down

#16

Post by tudorachim »

joshkaufman wrote: post #13

An easy way to create your own... Copy this empty table: http://pastebin.com/tzbd7FCt Fill it with this random password generator: https://www.grc.com/passwords.htm Be sure to use a fixed-width font.

From the random generator's website: "Every one is completely random (maximum entropy) without any pattern, and the cryptographically-strong pseudo random number generator we use guarantees that no similar strings will ever be produced again."

Interesting guarantee for a random number generator to provide...

Re: Write your passwords down

#17

Post by samuel »

So you have a paper on your wallet, which can be used to obtain every password you use, using an intricate and very specific "algorithm".

Then you publish the fact itself and the algorithm in your blog(real name), which, besides, doesn't depend on a passphrase (which could turn your method in a sort of dual factor authenticator).

The paper could be photocopied and returned to your wallet and you'd never know.

Please, don't talk me about how many bits of entropy your passwords have. They aren't secure.

Re: Write your passwords down

#18

Post by Abid »

I always have a question come to mind whenever I read these kinds of guidelines: what percentage of computer users have ever had their passwords compromised?

I'm guessing there's no real way to gauge this because I've never seen a study nor heard anyone else touting one and yet, complex password protection guidelines are always being recommended. Why?

Re: Write your passwords down

#19

Post by nowarninglabel »

mikeryan wrote: post #7

Its funny I worked for a startup that got acquired by Comcast, and eventually we started having to follow the Comcast security policy which made us change domain passwords every month with requirements around using strange characters etc. I'd say about 50% of the people ended up with their current password on a post-it on their monitor or desk.

Yes, this same thing happens on the ship I work on in the summers. There are about 300 people, and about half have to reset their password when they come on board. There is the arbitrary 8 character, at least 1 #, at least 1 special character, at least 1 capital, can't match a dictionary word, and can't be close to the previous password. Also can't contain their name. Try explaining that to 150 people over and over again...it is so painful to watch some people try half a dozen, even a dozen times and still not get a password that will work, and then the vast majority will either write it down in a public place, share it, or forget it.

I'd based on the available data that could have just as much security, without all the user hassle, if we just require long passwords, no other requirement. Can you see how much easier it is to just say, your password has to be 16 characters or longer. Just think of a passphrase. For instance: IWa1kmydogonSaturdays Easy to remember, and I would argue, though would want to try to provide some evidence, that this would be just as, if not more secure than 8 characters with ridiculous requirements.

Re: Write your passwords down

#20

Post by joshkaufman »

_b8r0 wrote: post #3

This is and isn't bad advice. Writing your passwords down and storing them in your wallet isn't necessarily a good idea. You may be able to secure your wallet, but there may be somewhere better to secure it (such as a house safe). Rather than writing the passwords down, use a decent tool like 1password ( http://agilewebsolutions.com/onepassword ) or Keepass ( http://keepass.info/ ).

This looks like a good way to generate the passwords you put into 1password or another similar password tool. If the tool fails, you can regenerate the passwords if you need to.
Post reply on HN