Post a boarding pass on Facebook, get your account stolen

Post by teddyh » Sat, Sep 23, 2017, 4:08 PM UTC

grzm wrote: post #188

teddyh wrote: post #174

Earlier quoted context omitted.

Nope. If a phrase from literature is “memorable”, it’s guessable. The logic of passwords is simple, once you realize that all humans are terrible random number generators. When you allow any part of your password to be chosen by a human, i.e. yourself, you have to assume that the human-chosen part is known to an attacker. The solution is to generate passwords with enough random bits to satisfy current demands. And by…

> this also applies if you run a password generator and choose a generated one that you like. I'm sure there's some math that could be applied here to determine how much a user selecting from one of n generated passwords. Human intuition in cases like this can often be wrong as human psychology hasn't evolved to solve problems like this, so please correct me if I'm wrong, but mine tells me that a user choosing a pass…

Post by teddyh » Sat, Sep 23, 2017, 4:17 PM UTC

tony101 wrote: post #187

teddyh wrote: post #174

Earlier quoted context omitted.

Nope. If a phrase from literature is “memorable”, it’s guessable. The logic of passwords is simple, once you realize that all humans are terrible random number generators. When you allow any part of your password to be chosen by a human, i.e. yourself, you have to assume that the human-chosen part is known to an attacker. The solution is to generate passwords with enough random bits to satisfy current demands. And by…

Diceware is memorable but not guessable. Source: https://en.wikipedia.org/wiki/Diceware https://www.rempe.us/diceware/#eff

Post by saryant » Sat, Sep 23, 2017, 4:20 PM UTC

jstanley wrote: post #57

csomar wrote: post #33

Earlier quoted context omitted.

I was traveling with a friend and we could benefit from changing flights. So my friend went to the counter to just ask about the possibility. He had my boarding pass but not my passport. He returned 20 minutes later with both boarding passes changed. The counter stuff just took his "word" for "he is my friend". Edit: An hour later driving and thinking about it, I think it is the right move from the airline. The risk…

If you booked the flights together, and paid together, it's probably pretty likely that you are travelling together. If the flights were booked together, I don't think this is out of line.

Post by grzm » Sat, Sep 23, 2017, 4:31 PM UTC

teddyh wrote: post #196

grzm wrote: post #192

Earlier quoted context omitted.

Cheers :) See? I knew there was some math. So how do you feel that compares to a user-generated password? That's the question I was getting at.

Detecting the randomness of a user-generated password is like detecting randomness in general; it can’t be done¹. Is a number like 392872956 random, or is it derived by using some obscure but guessable procedure? You can’t know just by looking at the number. Even if a user thinks they are choosing randomly, subconscious biases are very powerful. The same principle applies to word and character based passwords, so the…

Post by [deleted] » Sat, Sep 23, 2017, 4:47 PM UTC

JumpCrisscross wrote: post #132

JupiterMoon wrote: post #36

Earlier quoted context omitted.

> My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager The problem with this is that the "security" question will often be asked over the phone. At this point an answer of "Oh I just mash the keyboard for those" is probably going to get an attacker access to your account..

> The problem with this is that the "security" question will often be asked over the phone. At this point an answer of "Oh I just mash the keyboard for those" is probably going to get an attacker access to your account I used to do this and then lost my password file. Fast forward to a call with AT&T. I told them I forgot my secret answers. They offered that it was "a super weird answer," which let me use the "mashed…