Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Post a boarding pass on Facebook, get your account stolen

michalspacek.com

Post reply on HN
Print view View original

181–190 of 313 posts

Re: Post a boarding pass on Facebook, get your account stolen

#181

Post by pault »

chiph wrote: post #141
np_tedious wrote: post #126

Earlier quoted context omitted.

Sounds like a "correct battery horse staple" would fit the bill

Or use a memorable phrase from literature. > This was not the last encounter between Bobby Shaftoe and Goto Dengo

I like the appeal (and the book) but I recall, when researching diceware, reading that this is a terrible idea in practice since the entropy is lowered dramatically by using natural language that's already in the public record. Even if they can't put every printed phrase into a lookup table, the probability of certain words following others wrecks the entropy.

Re: Post a boarding pass on Facebook, get your account stolen

#182

Post by kobeya »

sitepodmatt wrote: post #180

To help increase security through action, whenever friends send me their flight details that include a PNR I logon to the airline website and book them a middle seat and special meal choice 'bland meal'. Just doing my part.

“friends”

Re: Post a boarding pass on Facebook, get your account stolen

#183

Post by samstave »

sersi wrote: post #11

And this is also why I almost never give my real birth date when registering on websites (except on financial websites or websites where I'm legally obligated to) and I never ever give real answers to the security question.. My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager Security questions weakens the security of an account, they are easil…

For security questions for sites I dont care about, I pick the subjedt of the question and use that:

"What city were you born in" == "city"

"what was the name of your first pet?" == "pet"

etc.

Re: Post a boarding pass on Facebook, get your account stolen

#184

Post by pault »

teddyh wrote: post #174
chiph wrote: post #141

Earlier quoted context omitted.

Or use a memorable phrase from literature. > This was not the last encounter between Bobby Shaftoe and Goto Dengo

Nope. If a phrase from literature is “memorable”, it’s guessable. The logic of passwords is simple, once you realize that all humans are terrible random number generators. When you allow any part of your password to be chosen by a human, i.e. yourself, you have to assume that the human-chosen part is known to an attacker. The solution is to generate passwords with enough random bits to satisfy current demands. And by…

I have no idea who is downvoting you; this is perfectly correct. In fact, one of the (minor) plot points in the quoted book is a cyphertext getting broken because the person generating one time pad keys looks at the letters!

Re: Post a boarding pass on Facebook, get your account stolen

#185

Post by tony101 »

JupiterMoon wrote: post #36
sersi wrote: post #11

And this is also why I almost never give my real birth date when registering on websites (except on financial websites or websites where I'm legally obligated to) and I never ever give real answers to the security question.. My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager Security questions weakens the security of an account, they are easil…

> My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager The problem with this is that the "security" question will often be asked over the phone. At this point an answer of "Oh I just mash the keyboard for those" is probably going to get an attacker access to your account..

One solution would be to randomly generate security answers with human readable words. Diceware does this. You can use a dice, or you can use an open source tool like this one:

https://www.rempe.us/diceware/#eff

https://en.wikipedia.org/wiki/Diceware

Re: Post a boarding pass on Facebook, get your account stolen

#187

Post by tony101 »

teddyh wrote: post #174
chiph wrote: post #141

Earlier quoted context omitted.

Or use a memorable phrase from literature. > This was not the last encounter between Bobby Shaftoe and Goto Dengo

Nope. If a phrase from literature is “memorable”, it’s guessable. The logic of passwords is simple, once you realize that all humans are terrible random number generators. When you allow any part of your password to be chosen by a human, i.e. yourself, you have to assume that the human-chosen part is known to an attacker. The solution is to generate passwords with enough random bits to satisfy current demands. And by…

Diceware is memorable but not guessable.

Source:

https://en.wikipedia.org/wiki/Diceware

https://www.rempe.us/diceware/#eff

Re: Post a boarding pass on Facebook, get your account stolen

#188

Post by grzm »

teddyh wrote: post #174
chiph wrote: post #141

Earlier quoted context omitted.

Or use a memorable phrase from literature. > This was not the last encounter between Bobby Shaftoe and Goto Dengo

Nope. If a phrase from literature is “memorable”, it’s guessable. The logic of passwords is simple, once you realize that all humans are terrible random number generators. When you allow any part of your password to be chosen by a human, i.e. yourself, you have to assume that the human-chosen part is known to an attacker. The solution is to generate passwords with enough random bits to satisfy current demands. And by…

> this also applies if you run a password generator and choose a generated one that you like.

I'm sure there's some math that could be applied here to determine how much a user selecting from one of n generated passwords. Human intuition in cases like this can often be wrong as human psychology hasn't evolved to solve problems like this, so please correct me if I'm wrong, but mine tells me that a user choosing a password from whole cloth has much less entropy when the user is taken into account than a user choosing a password from a small set of those generated with high entropy.

While the latter is less than leaving it up to be chosen purely at random, I think it's much closer to pure random than it is than from the one that's created by the human. It's likely not your intent, but your note comes across as not acknowledging this. Am I reading it wrong? Or are my intuitions wrong? If one were to choose between (a) human generated or (b) human chosen from a set of non-human generated, how much stronger do you think (b) is than (a), and how much weaker is (b) compared to (c) randomly chosen from non-human generated?

Re: Post a boarding pass on Facebook, get your account stolen

#189

Post by oh_sigh »

wyager wrote: post #105
ddevault wrote: post #102

Earlier quoted context omitted.

You don't have to say "oh I just mash the keyboard for those", you can say "it's weird, bear with me" and read it out from your password manager.

It's not about what you say, it's about what an attacker can get away with saying. And they can almost certainly get away with "I just mash the keyboard."

How would the attacker know that you mashed the keyboard when answering 'What high school did you go to?' ?

Re: Post a boarding pass on Facebook, get your account stolen

#190

Post by beambot »

floatingatoll wrote: post #186

Why do Facebook and Twitter and etc. permit posting of airline QR codes and credit card photos without a safety warning and an option to safely blur out the sensitive bits?

Why do they permit it...? Because they aren't our parents and shouldn't be responsible for all the stupid shit that users could do.

The real question: Perhaps we can politely convince these services to display safety warnings & blur the sensitive bits? Want to be proactive about it: Help develop a plug & play library for services to use to accomplish this feat.

Post reply on HN