151–160 of 171 posts
Earlier quoted context omitted.
Those are rules in the user's head. We assume that the enemy only knows that the user is chaining words.
That might not be true for an enemy who has access to some of your other passwords already, but assuming it is I still don't see how the strategy above increases complexity. At best, the complexity remains the same.
It doesn't, but it does make it easier to remember :)
Earlier quoted context omitted.
If a lot of people start doing this thing, then it will be trivial for an attacker to figure out name+service1@domain can be changed to name+service2@domain
"service1" could be generated randomly as well, and stored along with the password in a password manager. Another nice property of this suffix is that one can identify who gave away their email address / which site it was scraped from when receiving spam; not sure where I have seen this written down originally.
Earlier quoted context omitted.
If a lot of people start doing this thing, then it will be trivial for an attacker to figure out name+service1@domain can be changed to name+service2@domain
Same argument for port knocking. Absolutely ineffective against targeted attacks, but most attacks aren't customized and targeted.
Earlier quoted context omitted.
Couldn't I write a bruteforcer that instead of 5 * letters, tried 5 * dictionary words and get your password easily?
The way to compute the amount of possible brute-force combinations: For a normal 5 letter (alpha-numeric only) password: 36 factorial, which is (36 * 36 * 36 * 36 * 36) = 60 million possible combinations. However, for a 5-word password, the calculation is as follows: Assuming the number of possible words in the English language is 1.025109 million, then: 1,025,109 factorial, which is (1,025,109 * 1,025,109 * 1,025,10…
I'd guess the words used in that password fall into the top 10k words, easily. No need to check words like pediatrician, when the password contains the word cat.
The best part about running a cybersecurity company: lots of easy, free marketing. It's a really good time to be in the industry. It is unfortunate that people are trusting companies to protect their information and it ends up being really hard to do properly. Every able-bodied security engineer really should get in the game since there's money to be made as well as good to be done.
Earlier quoted context omitted.
Of course you do. That's why you don't reuse passwords. Why would you trust your other accounts to their internal investigation + PR interpretation anyway?
Because I'm human and can't maintain 30+ passwords?
Yes, someone could compromise your password manager password and then they'd have everything, but at least there's an additional step there. It's not going to protect you against nation-state level meddling with your life, but it will protect you from "random blog got hacked", which is slightly more likely for most of us.
Generally, I remember my login passwords, password manager password, and Google passwords (for email), and then put everything else into the password manager. I have no idea what my HN password is and don't care.
Earlier quoted context omitted.
> I use https://lastpass.com/ I feel like it's almost certain that Lastpass is owned, as are other popular online password stores. No security is perfect; all you can do is make it more expensive than it's worth to the attacker. How much would it be worth to have all the passwords to every account of every Lastpass user? Does Lastpass really have the resources and skill to protect something that valuable? Is it even…
Well as long as you 'feel' that way, it must be true. Lastpass (supposedly) stores the encrypted password vault, never the decrypted. Decryption occurs on the users end. You would need to either have a keylogger on the target users machine to grab their master password, or compromise the software. Neither is impossible, but both are a little harder than simply break in and access Lastpass's storage. I say supposedly…
Earlier quoted context omitted.
Well as long as you 'feel' that way, it must be true. Lastpass (supposedly) stores the encrypted password vault, never the decrypted. Decryption occurs on the users end. You would need to either have a keylogger on the target users machine to grab their master password, or compromise the software. Neither is impossible, but both are a little harder than simply break in and access Lastpass's storage. I say supposedly…
I use LastPass, but I'm still fearful about it. It's such a rich target, and all a hacker would really have to do is to intercept when you put your decryption key in and send it off to their own server. Then they'd have access to all your accounts. They'd have to put that backdoor into the extension, but the point is, it's doable, and most people wouldn't have any way of knowing that it happened.
https://lastpass.com/support.php?cmd=showfaq&id=6926
"LastPass says they never receive my Master Password. Don’t I send it to the LastPass servers when I log in?
No, when you login to LastPass, two things are generated from your Master Password using our code discussed previously before anything is sent to the server: the password hash and the decryption key. This is all done locally.
The password hash is sent to our servers to verify you. Once verified, we send back your encrypted Vault. We are only sent your hash, not your Master Password.
The decryption key, which NEVER leaves your computer, is then used to decrypt your Vault once it comes back."