111–120 of 171 posts
As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
https://www.passwordstore.org/
It simply manages gpg-encrypted files in a directory hierarchy. Very flexible to set up whatever organization makes sense for you.
I find it suits my needs.
Earlier quoted context omitted.
> This is not a good suggestion on their part, and has long been proven ineffective: Agreed; that is bad advice. I tell people: If you think of a trick then the attackers, who have expertise and think about these issues all the time, have thought of it long ago and have written it into their password-cracking software. That applies to visual substitutions (such as GoToMyPC recommended), phonetic substitutions (e.g.,…
Are there any good sources on what sort of generative trickery a good cracking tool will use? I've noticed that the OSX Keychain 'memorable' password suggestions are almost always /(\w+\d+[[::punc::]]+\w+)/, which is enough of a pattern to probably make an explicit generator for which will match much faster than a naive brute-force.
Two answers:
1) It's not worth trying to keep up with, unless that's your specialty. There are people who spend days thinking up attacks; how much time will you need to spend to keep up with them?
Far more time-effective than trying to anticipate all the specific attacks is to use provably secure defenses: Passwords that are mathematically too expensive to brute force, and which cannot be guessed by other means (e.g., by knowing personal information about you). That shifts the weak link from your password to the security of your OS, network, and applications, which probably have a couple of holes in them.
2) This will give you an idea of the scope of possible attacks. Note that it's 9 years old: https://www.schneier.com/blog/archives/2007/01/choosing_secu...
Earlier quoted context omitted.
A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions. For 2FA I use either SMS or Authy https://www.authy…
> I use https://lastpass.com/ for generating passwords. ... Would prefer open source, but nothing else comes close. On a linux/unix system, one could use /dev/urandom: tr -dc '[[:alnum:][:punct:]]' would generate a 16 character long password . One could even put the following function in $HOME/.bash_profile or such genpw() { tr -dc '[[:alnum:][:punct:]]' Now invoking it by saying genpw would generate a pseudorandom s…
Earlier quoted context omitted.
Couldn't I write a bruteforcer that instead of 5 * letters, tried 5 * dictionary words and get your password easily?
The way to compute the amount of possible brute-force combinations: For a normal 5 letter (alpha-numeric only) password: 36 factorial, which is (36 * 36 * 36 * 36 * 36) = 60 million possible combinations. However, for a 5-word password, the calculation is as follows: Assuming the number of possible words in the English language is 1.025109 million, then: 1,025,109 factorial, which is (1,025,109 * 1,025,109 * 1,025,10…
Earlier quoted context omitted.
Couldn't I write a bruteforcer that instead of 5 * letters, tried 5 * dictionary words and get your password easily?
Five or six words is a huge amount of entropy. In reality there are other rules in my example than just using words. It starts with a capital letter and includes a conjugated verb (running) both of which increase complexity considerably. And it of a random length, having taken its length from my selection of words rather than from any fixed policy. Few services accept random lengths but imho all should. There is a gr…
They reduce complexity: It reduces the number of possibilities on the first character, and the attacker knows that one word must be a (conjugated? present participle?) verb yet, when otherwise it could be anything.
It's sad that this is a service instead of just free software. Did that never evolve to be user friendly enough? Do ISPs not let you run your own web server anymore? Maybe it's because of changing IP addresses and domain names? The cost of this service seems to be slightly more than the cost of maintaining your own domain name.
I run my own web server with a residential ISP and they don't seem to mind. But in places like an office or with really crappy ISPs you just don't have a public IP. I've searched for services that just let you forward out a few ports over SSH but these don't seem to exist. Right now, to get to my laptop I have a raspberry pi "jump box" that sits on the book shelf and my laptop connects to it over SSH and forwards out…
Earlier quoted context omitted.
Couldn't I write a bruteforcer that instead of 5 * letters, tried 5 * dictionary words and get your password easily?
The way to compute the amount of possible brute-force combinations: For a normal 5 letter (alpha-numeric only) password: 36 factorial, which is (36 * 36 * 36 * 36 * 36) = 60 million possible combinations. However, for a 5-word password, the calculation is as follows: Assuming the number of possible words in the English language is 1.025109 million, then: 1,025,109 factorial, which is (1,025,109 * 1,025,109 * 1,025,10…
> For a normal 5 letter (alpha-numeric only) password: > 36
With the "normal" recommendation of numbers, uppercase and lowercase letters, and punctuation, it's up around 100.
> factorial
The calculation is X^Y, where X is the number of possibilities per element, and Y is the number of elements (letters or words in these examples). So using only only lowercase letters (26) in an 8 character password would be 26^8. It's not factorial because you can reuse characters (e.g., your password could be X92m-sXp/)
> the amount of possible words is much smaller than that. But the attacker can't know that for sure
They will search the more likely words first. I read someplace that 10,000 words covers most people's vocabulary. That's still 100 times better than numbers + uppercase + lowercase + punctuation.
Earlier quoted context omitted.
I run my own web server with a residential ISP and they don't seem to mind. But in places like an office or with really crappy ISPs you just don't have a public IP. I've searched for services that just let you forward out a few ports over SSH but these don't seem to exist. Right now, to get to my laptop I have a raspberry pi "jump box" that sits on the book shelf and my laptop connects to it over SSH and forwards out…
Is it still the case that for most ISPs the uplink is much slower than the downlink speed? That was one reason running anything other than limited-use servers from your home wasn't feasible.
As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions. For 2FA I use either SMS or Authy https://www.authy…
I feel like it's almost certain that Lastpass is owned, as are other popular online password stores.
No security is perfect; all you can do is make it more expensive than it's worth to the attacker.
How much would it be worth to have all the passwords to every account of every Lastpass user? Does Lastpass really have the resources and skill to protect something that valuable? Is it even possible?
Earlier quoted context omitted.
> This is not a good suggestion on their part, and has long been proven ineffective: Agreed; that is bad advice. I tell people: If you think of a trick then the attackers, who have expertise and think about these issues all the time, have thought of it long ago and have written it into their password-cracking software. That applies to visual substitutions (such as GoToMyPC recommended), phonetic substitutions (e.g.,…
But if the trick you are using results in sufficient entropy, it shouldn't matter that the enemy has thought of it too. I'm still a fan of linking common words together as this results in easily-memorized passwords with very high entropy. "Catrunningfishhostagelaptop" is a good password these days. it is easily remember but also difficult to brute force even if you know the trick by which it was constructed. (And yes…