Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down (2010)

blog.jgc.org

Post reply on HN
Print view View original

141–150 of 196 posts

Re: Write your passwords down (2010)

#141

Post by Wool2662 »

f1shy wrote: post #132
Longhanks wrote: post #123

Earlier quoted context omitted.

I absolutely despise everything in this comment. I have a user name and I know the associated password, let me in. Leave me alone with your proprietary authenticators that will lock me out the moment I lose my phone or Google/MS just _decide_ they feel like locking me out. GitHub force-disabling password authentication for git push has actively made me contribute less to GitHub-hosted projects. And when I really feel…

I really do bot understand the policy of github. Before I could have a 40 char password in my head. Now it MUST be somewhere in my disc. I was totally surprised as I learned is the only way to login. Seems a 50 year old idea

And yet the likelihood of you telling someone or typing the contents of this file somewhere you shouldn't is much lower. It's more phishing resistant and is much less likely to be in some leaked password database, that's what GitHub cares about. Targeted attacks on single people don't even move the needle.

Phishing and password stuffing attacks are like 95% of 'hacking' attempts.

And frankly it is very likely that your 40 character password landed in your shell history at least once.

Re: Write your passwords down (2010)

#142

Post by tracker1 »

Then twitter.com becomes X, and you're doomed.

Seriously though, I've setup accounts on Site foo, but then bar buys them, and two years later it's on Baz.com, and if I don't remember the switch(es) that woudld/could suck.

I just use Bitwarden for everything but my system login(s) and bitwarden passphrase, which I tend to keep around 20 chars, and multiple words.

Re: Write your passwords down (2010)

#143

Post by tracker1 »

rkangel wrote: post #89
kadoban wrote: post #85

Earlier quoted context omitted.

I noticed that as well, the fix for me is pretty easy: just create the account in bitwarder first and then autofill it in the actual account creation page. No extra work, and becomes habit quite quickly.

This is fine on desktop. It's less great on mobile.

I haven't found it to be too bad on mobile... but ymmv of course.

Re: Write your passwords down (2010)

#144

Post by tracker1 »

skerit wrote: post #3
gostsamo wrote: post #2

Don't use fancy combinations. Word phrases are even more random and much easier to remember. E.G. "touch-some-grass" is rander longer than any recommended minimum and hardly could be connected to any website.

Exactly, using phrases is so much nicer and better in every way. It annoys me when sites demand a password should have a special character or upper case letter in it. Or even worse: a max length.

My password manager is generally set to 30 random characters with all options. Max lengths bug the crap out of me, or limited character options... I mean, just use utf8 + normalization before hashing. Min-length should be the only requirement (if that). If I want to write in morse-code using dots and dashes, let me (I don't but had a friend that used to do that).

Actually, the only thing worse, is not being able to paste into the password field(s)... you create a long random password, and now you can't paste it... great.

Re: Write your passwords down (2010)

#145

Post by tracker1 »

AtNightWeCode wrote: post #18
jug wrote: post #9

Earlier quoted context omitted.

Max lengths are so sketchy because this makes it more likely the crazy guys are actually storing your password rather than the fixed size hash.

Passwords are sent to the server though in most cases. So there must be some limit.

I wrote an authentication platform a few years ago... I had a setting to allow a max passphrase length (because it was a govt requirement for a client), but if unset, it would be 1024 as a pragmatic limit on the payload (considering the hash length was less), I always thought that was reasonable.

Re: Write your passwords down (2010)

#146

Post by tracker1 »

iLoveOncall wrote: post #91
falcolas wrote: post #57

Earlier quoted context omitted.

100Kb is a perfectly reasonable length IMO. Only takes seconds to send even over terrible links.

It becomes problematic when it needs to be hashed, you can essentially DDOS servers by sending extremely long passwords that need to be hashed.

Part of why I prefer to have authentication on a separate server... if it gets ddos'd at least existing sessions can carry on.

Re: Write your passwords down (2010)

#147

Post by tracker1 »

monsieurbanana wrote: post #34
AtNightWeCode wrote: post #18

Earlier quoted context omitted.

Passwords are sent to the server though in most cases. So there must be some limit.

Yes but that's not what they're discussing, it's about the sites that have some low limit like 8-16 characters. And if someone knows why banks are specially prone to having crapshit password requirements... Flashback to my french bank that had a password that needed to be exactly 8 digits, no letters or other, and that you could only type by clicking on a digital numpad that had the numbers randomly sorted.

Interconnected old mainframe systems fwiw... In the end, a lot of these banking systems are connected back to mainframe systems with a LOT of legacy cruft that nobody has the nerve to actually update. It may not even be hashed or encrypted, which is part of why banks also add a second factor/cookie, though the implementation could/should be better.

Re: Write your passwords down (2010)

#148

Post by _Algernon_ »

0xbadcafebee wrote: post #135
_Algernon_ wrote: post #90

Earlier quoted context omitted.

>Do not do this. It's just crappy security practice. >Password managers give you versions & history (you need to rotate passwords occasionally), a TOTP generator+seed store, configurable password generator using a schemes of characters (some websites only allow specific characters), is encrypted at rest & in memory so it's more secure than a piece of paper in your wallet, is backed up online, and of course you only h…

Regardless of the threat model, a password manager is better, period. It addresses more threats, provides better security, is more reliable. > your passwords can is safe from malware, digital exploits and so on No they're not. They can still be compromised by malware and digital exploits when you type them into your device. If you have malware you're largely just fucked. That's why people have been trying to get rid…

>No they're not. They can still be compromised by malware and digital exploits when you type them into your device. If you have malware you're largely just fucked. That's why people have been trying to get rid of passwords forever, because they still are vulnerable to a number of attacks in various circumstances.

With the notebook you have a single password compromised which has the chance of serving as a canary to detect the compromise. With a password manager potentially every password is instantly compromised.

>This is the same threat model as a password manager. Always use a second factor regardless of the primary method.

No it's not. I'm not talking about 2fa; I'm talking about using passwords that eg. are a combination of a notebook part, and a secret only you know, thereby having a unique password for each service, while not having to remember 200 unique passwords.

>Only shitty ones. Security researchers were raising the alarm about LastPass long ago. 1Password and BitWarden are perfectly fine, secure and reliable. They all use zero-knowledge so as long as your master password is long and complex, there's no risk to your vaults.

If you have to pay attention to security researches to use a package manager it is already impractical for the wast portion of the population. All auditing of previous versions also ceases to be meaningful the moment a new version is released, or you are unable to actually verify the running version (which cloud software always has). You also have to trust the client software which is vulnerable to the same issues as local password managers.

>And actually, even then memorization is better than writing it down. Come up with a mnemonic for a long password phrase and some memory tricks to remember the phrase in case you forget it.

This would be great if people just needed a single password. People these days have hundreds of accounts. I have 239 and I'm reasonably conservative with creating new accounts. Remembering 239 secure passwords, even with a mnemonic is a fulltime job. It's not in any way realistic.

In the end, if you consider the intended audience for the advice of using paper password management it is the people who currently use a single password for every service they use. For those people any step-up is an improvement.

Re: Write your passwords down (2010)

#149

Post by tracker1 »

jamesponddotco wrote: post #79
Eric_WVGG wrote: post #33

Earlier quoted context omitted.

There's an understated bonus to "correct horse battery staple" passwords — they're easier to type on iPhone and Android keyboards. So besides being of questionable security benefits, 0bScur3 passwords also bonk that advantage of nice-long-easy-to-remember passwords.

Or on a PS5, Nintendo Switch, and whatnot. So much easier to type and remember.

Yeah, streaming accounts are probably the only ones in my password manager that aren't randomly generated for that reason. "Gimme movies now!" (not my actual passphrase)

Re: Write your passwords down (2010)

#150

Post by jamesponddotco »

tracker1 wrote: post #149
jamesponddotco wrote: post #79

Earlier quoted context omitted.

Or on a PS5, Nintendo Switch, and whatnot. So much easier to type and remember.

Yeah, streaming accounts are probably the only ones in my password manager that aren't randomly generated for that reason. "Gimme movies now!" (not my actual passphrase)

Mine are still randomly generated, but using the diceware method. Best of both worlds, really.
Post reply on HN