151–160 of 181 posts
I'd remove the emphasized text. Yes they are vulnerable to collision attacks but that's completely irrelevant in this context.
Earlier quoted context omitted.
It is complete idiocy to use passwords across services. Utter insanity. It is the worst possible practice imaginable, and is never, ever excusable. It's one thing to argue for improving people's password practices, but please don't pretend that there's no reason for their behavior. The vast majority of people who share passwords between sites experience no repercussions from their choice. And choosing not to create a…
I'm a software developer, but I'm done trying to remember passwords for every single site. What do I do? I just don't use the sites. I've restricted, and continue to pare down, the sites that I use on the internet. It's the truth. I do keep my amazon.com account, so I can order paper and cardboard books the local bookstores don't carry, and read them on the sofa at my house, next to my floor lamp.
use throwaway passwords for one off services and just use the password reset feature when you want to use it.
Earlier quoted context omitted.
I just recently got this email from AWS: Dear Amazon S3 Customer, Amazon S3 now supports server side encryption with customer-provided keys (SSE-C), a new encryption option for Amazon S3. When using SSE-C, Amazon S3 encrypts your objects with the custom encryption keys that you provide. Since Amazon S3 performs the encryption for you, you get the benefits of using your encryption keys without the cost of writing or e…
Wait. how exactly do you transfer the encryption key to amazon? And do they keep your key? How long?
Look, it's keys all the way down.
Beneath that, wiretaps.
Your non-devs FAQ is still not quite informative. You still don't explain to laymen /why/ what the sites are doing is wrong, you just say "You should never see your password". edit: Maybe something along the lines of: > Modern cryptography allows websites to save passwords in a form that is un-decryptable even to the site itself. This works because to check the validity of logins, the unencrypted (plain) version of t…
Thanks, I've added wording for that.
Earlier quoted context omitted.
Which is still true if you don't know their passwords but if you have their email. You can reset the passwords for just about every conceivable account they have.
Back when I was a teen I used to fraud people and scam ebay sellers through paypal. If I were to somehow gain access to an email (via RAT, Cookie hijacking), one of the easiest ways to recover a password was to look for a provider that sent out a plaintext password. Chances are the unfortunate target used the same password on every site (or if it was lowercase and alpha, that password + "1"). That would grant continu…
Cool!
Earlier quoted context omitted.
I agree; this point shouldn't be about password reset emails being more secure, it should be about the fact you don't need to be able to email them their password to have a successful account recovery process. That said, it can be more secure. Firstly, people reuse passwords, so intercepting a plaintext password gives you access not only to the account on that site, but also several others. Secondly, if the link expi…
Exactly. This action is so obviously horrendous it's had to believe it still happens. Once a password hits your inbox, you can almost count on it living forever. And Basically with one 5 second search of my inbox for "password" a thief could easily discover my password that I use for almost every web site. It's totally irresponsible for a service provider to essentially reveal a secret like that (without asking or re…
Earlier quoted context omitted.
Exactly. This action is so obviously horrendous it's had to believe it still happens. Once a password hits your inbox, you can almost count on it living forever. And Basically with one 5 second search of my inbox for "password" a thief could easily discover my password that I use for almost every web site. It's totally irresponsible for a service provider to essentially reveal a secret like that (without asking or re…
Does none of that responsibility lay with you for using the same password across all sites? What if, on the other side of the spectrum, their site was compromised, and your password was retrieved that way? You'd be vulnerable in the same way.
If google really does get in-browser crypto working, they might even understand pgp. They won't understand Diffie-Hellman, but they understand if words --> block of gibberish --> words, then there must be some math in between.
Earlier quoted context omitted.
Exactly. This action is so obviously horrendous it's had to believe it still happens. Once a password hits your inbox, you can almost count on it living forever. And Basically with one 5 second search of my inbox for "password" a thief could easily discover my password that I use for almost every web site. It's totally irresponsible for a service provider to essentially reveal a secret like that (without asking or re…
Does none of that responsibility lay with you for using the same password across all sites? What if, on the other side of the spectrum, their site was compromised, and your password was retrieved that way? You'd be vulnerable in the same way.
Earlier quoted context omitted.
That's a pretty technical explanation. I think something like this would suffice: > If the website can pull out your password to show it to you, an attacker can pull out the password to steal it. As ever, the issue is explaining hashing.
I think this is easier than it sounds. To a layman, when they type in their password, they are not thinking about how it would be implemented. The idea that "oh, somebody is doing a string compare against a password in the database" is not something that would enter their mind. That is baggage that software developers may have, but ordinary people have not been primed in that way. Ordinary people are going to be thin…
I don't think people are thinking about keys and locks. Passwords are a thing that existed before computers and that people understand perfectly outside of an IT context. Spies in films use secret phrases to prove they're the contact, kids use passwords to gain access to the clubhouse. But in all these non IT contexts the person checking the authentication knows the shared secret, so it's obvious how they check it.
If my mental model is "I've arranged a secret password with this website that proves I'm really me", then my first question when told the website doesn't know what secret password is "well how does it know that the password is correct?".
The best I've been able to come up with today is a somewhat lengthy metaphone with color mixing.
[Edit] Having said that, I just went and talked to my technical literate non programmer wife and she used the key and door analogy.