Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adobe credentials and the serious insecurity of password hints

troyhunt.com

Post reply on HN
Print view View original

11–20 of 43 posts

Re: Adobe credentials and the serious insecurity of password hints

#11

Post by Semaphor »

marios wrote: post #10
cdman wrote: post #7

Earlier quoted context omitted.

Don't use Ghostery because they're tracking you: http://en.wikipedia.org/wiki/Ghostery#Criticism Try disconnect.me or blacklisting the sites directly from the hosts file.

I kept using ghostery because I didn't know of any alternative and sometimes I can't install adsuck. (which is is better than a huge hosts file. An oversized hosts file can have a negative impact on DNS and overall network responsiveness). Thanks for disconnect.me, I'll give it a shot :)

disconnect.me is also FOSS.

Re: Adobe credentials and the serious insecurity of password hints

#12

Post by ScottWhigham »

Great insight/writeup but the last bit gets to me:

Ultimately, password hints are evil and they add nothing to an online system that can’t be achieved with a secure password reset feature.

It's a classic case of someone criticizing one important feature without suggesting viable alternatives. He might as well have said,

Gasoline engines are evil and they add nothing to a world that can't be achieved with a more efficient propellant.

Yeah, okay - but what's the more efficient propellant?!?!

Password hints aren't "evil" just because (a) Adobe happened to store theirs in plain text, and (b) some users do use seriously identifying information in theirs. Password hints make it fast and easy for an actual user who genuinely needs to reset their password to be able to do so quickly and efficiently. What's the secure password reset feature that Troy alludes to? I missed it.

Re: Adobe credentials and the serious insecurity of password hints

#13

Post by dingaling »

ScottWhigham wrote: post #12

Great insight/writeup but the last bit gets to me: Ultimately, password hints are evil and they add nothing to an online system that can’t be achieved with a secure password reset feature. It's a classic case of someone criticizing one important feature without suggesting viable alternatives. He might as well have said, Gasoline engines are evil and they add nothing to a world that can't be achieved with a more effic…

> What's the secure password reset feature that Troy alludes to?

I've seen a few concepts. One I liked was the selection of two or three images from a gallery. If the user correctly identified the ones he had selected at sign-up then a new password was sent to the registered e-mail address.

But any password reset process should ensure that it never links back to the original password. Reset, not recover.

Re: Adobe credentials and the serious insecurity of password hints

#14

Post by willthames »

ScottWhigham wrote: post #12

Great insight/writeup but the last bit gets to me: Ultimately, password hints are evil and they add nothing to an online system that can’t be achieved with a secure password reset feature. It's a classic case of someone criticizing one important feature without suggesting viable alternatives. He might as well have said, Gasoline engines are evil and they add nothing to a world that can't be achieved with a more effic…

I would think that Troy alludes to his very extensive piece detailing how and how not to do password resets.

http://www.troyhunt.com/2012/05/everything-you-ever-wanted-t...

I think the point about password hints is that, like secret questions, they typically reduce the security of the account when used by actual users. Alternative approaches protect users from themselves.

Re: Adobe credentials and the serious insecurity of password hints

#16

Post by mikegriff »

ohwp wrote: post #2

I got Ghostery installed, the page loads and then suddenly the text of the article is removed. I know I know, I just shouldn't use Ghostery but I like to have a little privacy online. Sorry I won't return to your site again...

I've been getting that too on a number of sites. After reading the replies to this, I see it's ghostery being a bit too eager.

I'm going to give disconnect.me a try and see how that works out.

Re: Adobe credentials and the serious insecurity of password hints

#17

Post by mikegriff »

cdman wrote: post #7
ohwp wrote: post #2

I got Ghostery installed, the page loads and then suddenly the text of the article is removed. I know I know, I just shouldn't use Ghostery but I like to have a little privacy online. Sorry I won't return to your site again...

Don't use Ghostery because they're tracking you: http://en.wikipedia.org/wiki/Ghostery#Criticism Try disconnect.me or blacklisting the sites directly from the hosts file.

Thanks for the heads up on this. I thought I had read something about that in the past, but I couldn't remember what it was exactly.

Going to go have a look at disconnect.me now.

Re: Adobe credentials and the serious insecurity of password hints

#18

Post by ballard »

0. Password hints, the horror. As a user, the wisest thing is to just put something misleading and use good password hygiene.

1. This reminds me of a funny thing I did at big name university that shall remain nameless. On the CS network which used NIS, I ran getent passwd as a regular user and received everyone's hashed passwords! Then, I piped that through john the ripper.... Say hello to 50 user's passwords in 30 seconds with nothing more than the standard English dictionary. (In an era just before shmoo, et. al. rainbowtables.). Dept chair, ~20 profs and some students. Drop a cron to start xeyes every 30 minutes anyone? }:)

Post reply on HN