Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You have exactly three passwords, don't you?

pcmag.com

Post reply on HN
Print view View original

11–20 of 86 posts

Re: You have exactly three passwords, don't you?

#11

Post by mncolinlee »

krakensden wrote: post #8

The problem with password managers is, when you're away from whatever machine you managed to get the thing set up on, you're locked out of all your accounts.

This is why I always keep my encrypted keyfile on DropBox (usually a KeePass safe and a standalone installation of PasswordSafe USB mode).

This way, you can access your passwords from home, work, or your phone as long as you trust the machine you're logged into enough to log into DropBox and type your password safe password. If you can't tell if the machine is free of keyloggers, you probably shouldn't be logging into anything of personal value.

Re: You have exactly three passwords, don't you?

#12

Post by jjcm »

Macha wrote: post #4
zargon wrote: post #3

The bank managing my 401k requires a password between 6 and 8 alphanumeric characters. Non-letter, non-digit characters are not allowed.

My bank is worse. They state alphanumeric, their form enforces alphabetic. 6-8 letters. Oh, and did I mention its case insensitive? The card number provides more security than the password. I can only hope that the case insensitivity is because they're running it through the COBOL equivalent of .tolower() before hashing it, bit given the track record? It's more likely than not they're storing it in plaintext. Just as…

Out of curiosity, what's keeping you from switching banks? If my bank did this, I'd switch immediately. Any bank that shows that level of concern for my finances doesn't deserve to be controlling them.

Re: You have exactly three passwords, don't you?

#13

Post by BenOfTomorrow »

krakensden wrote: post #8

The problem with password managers is, when you're away from whatever machine you managed to get the thing set up on, you're locked out of all your accounts.

I put a copy of the database in cloud storage. There might be a little set-up to open it, but it's very rare that I need to get the contents on a new machine.

The nitpick with pw databases is they don't fully solve the problem; I still need to know the passwords for all my computers, cloud storage account, e-mail, the db master password.

The big advantage is how much more secure lesser used accounts are (and drop in frequency of password reset requests on those accounts).

Re: You have exactly three passwords, don't you?

#14

Post by 27182818284 »

I started using pwgen for passwords. These are long passwords containing symbols, letters, and numbers and nothing resembling a word.

What I find interesting is that I don't know what any of the passwords actually are. Instead, I simply have the muscle memory to type them. This is a problem if I have to remember that same password for the website's new app on my phone. In that case, I have to sit next to an actual keyboard to recall the password and type it into my phone.

Re: You have exactly three passwords, don't you?

#15

Post by andre »

mncolinlee wrote: post #11
krakensden wrote: post #8

The problem with password managers is, when you're away from whatever machine you managed to get the thing set up on, you're locked out of all your accounts.

This is why I always keep my encrypted keyfile on DropBox (usually a KeePass safe and a standalone installation of PasswordSafe USB mode). This way, you can access your passwords from home, work, or your phone as long as you trust the machine you're logged into enough to log into DropBox and type your password safe password. If you can't tell if the machine is free of keyloggers, you probably shouldn't be logging int…

this. I use Dropbox with Keepass and Truecrypt. You can get these apps anytime from the web, put on USB keychain, or just remember Dropbox and run Keepass and Truecrypt from there. Just make sure to have a very long/secure Dropbox password, as that becomes the weakest link.

There's also Dropbox and Keepass for Android.

Re: You have exactly three passwords, don't you?

#16

Post by mncolinlee »

BenOfTomorrow wrote: post #13
krakensden wrote: post #8

The problem with password managers is, when you're away from whatever machine you managed to get the thing set up on, you're locked out of all your accounts.

I put a copy of the database in cloud storage. There might be a little set-up to open it, but it's very rare that I need to get the contents on a new machine. The nitpick with pw databases is they don't fully solve the problem; I still need to know the passwords for all my computers, cloud storage account, e-mail, the db master password. The big advantage is how much more secure lesser used accounts are (and drop in…

This is not entirely true. You only need to really "know" two passwords... your cellphone screen lock and the password to the encrypted password database on your cellphone.

If your cellphone uses DropBox to store the database, then you can even lose your cellphone or simply access the database on desktops and laptops directly.

Re: You have exactly three passwords, don't you?

#17

Post by zedpm »

Good grief, no. I have dozens of passwords. The 10 or so that I use regularly are committed to memory, the rest may require me to consult a legal pad or KeepassX, the latter being protected by an extremely long and complex password unique to it. I do of course reuse some of the passwords, given that there are only a couple dozen of them and probably 100 or more accounts which use one of them.

Re: You have exactly three passwords, don't you?

#18

Post by jbk »

I use one password per account.

I have a common shared suffix like "HuRf!z0" and then I prepend a prefix depending on the website, like "gm" for HN.

So far, this has been quite simple to use, even when I am not in front of my machine.

Re: You have exactly three passwords, don't you?

#19

Post by lambada »

pavel_lishin wrote: post #2

Some systems don't require a complex password. I don't care if someone breaks into the game center thing on the iphone because my password is prettypony2 - what are they going to do, erase my high scores on Tetris? I'm sure as hell not copying and pasting a 16 character password between the LastPass app every time.

Given that the gamecenter password is the same as your iTunes / Apple account password, they could wipe out your account balance by buying / renting things. If you have any card details stored then they could go onto the Apple Store and order using those. They could see your billing address, and so intercept your mail, thus gaining more documents to eventually steal your identity.

Of course, if you only buy using the pre-paid cards you can buy in retail stores then all they can do is wipe out the balance.

I'm sure your response was partly flippant, but the implications because of Apples one universal account means that someone determined could do a lot of things.

Post reply on HN