Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down

blog.jgc.org

Post reply on HN
Print view View original

21–30 of 125 posts

Re: Write your passwords down

#21

Post by crocowhile »

ali001 wrote: post #15

I think that a better solution is to use pwdhash. Check it out here: http://pwdhash.com It's a browser extension for Chrome and for Firefox that seamlessly hashes the concatenation of your master password and the domain name of the site you're logging into. This produces a different password for each site, and requires you to remember only your master password. The extensions were created by Blake Ross (big name in t…

The most commonly used hashers are pwdhash, supergenpass and magicpassword. Given that they all use hashing algorithms, none of them will result in a password using special characters, which is not optimal.

Re: Write your passwords down

#22

Post by tghw »

tudorachim wrote: post #16
joshkaufman wrote: post #13

An easy way to create your own... Copy this empty table: http://pastebin.com/tzbd7FCt Fill it with this random password generator: https://www.grc.com/passwords.htm Be sure to use a fixed-width font.

From the random generator's website: "Every one is completely random (maximum entropy) without any pattern, and the cryptographically-strong pseudo random number generator we use guarantees that no similar strings will ever be produced again." Interesting guarantee for a random number generator to provide...

Obligatory: http://search.dilbert.com/comic/Random%20Number%20Generator

Re: Write your passwords down

#23

Post by tghw »

crocowhile wrote: post #21
ali001 wrote: post #15

I think that a better solution is to use pwdhash. Check it out here: http://pwdhash.com It's a browser extension for Chrome and for Firefox that seamlessly hashes the concatenation of your master password and the domain name of the site you're logging into. This produces a different password for each site, and requires you to remember only your master password. The extensions were created by Blake Ross (big name in t…

The most commonly used hashers are pwdhash, supergenpass and magicpassword. Given that they all use hashing algorithms, none of them will result in a password using special characters, which is not optimal.

Optimal? No. More than sufficient? Yes. You can use all numbers in your password, so long as it's long enough (and the website actually uses all of them).

Re: Write your passwords down

#24

Post by crocowhile »

> (I have a second copy of that sheet left with a friend in an envelope)

I love jgc but here he's making the same mistake most people make when they speak about security: assuming all readers have the same need for security and run the same risks. They don't. There is no point for my mom to adopt this system, it's way overkilled for her. (I think there's no point for me either).

One needs to explain to users two things: the first is that there is a big difference between being A target and being THE target. If you are just A target, picking one password for each website you subscribe to is more than enough. If you are THE target, then people will get to you, no matter how secure you think you are.

Re: Write your passwords down

#25

Post by sukuriant »

tudorachim wrote: post #16
joshkaufman wrote: post #13

An easy way to create your own... Copy this empty table: http://pastebin.com/tzbd7FCt Fill it with this random password generator: https://www.grc.com/passwords.htm Be sure to use a fixed-width font.

From the random generator's website: "Every one is completely random (maximum entropy) without any pattern, and the cryptographically-strong pseudo random number generator we use guarantees that no similar strings will ever be produced again." Interesting guarantee for a random number generator to provide...

It might be true random numbers as opposed to pseudo-random numbers. Likely created in a similar way to http://random.org

Re: Write your passwords down

#26

Post by jasonjei »

It's an interesting concept because passwords could be infinitely more secure if everything adopted a two-factor authentication system with something physical that you carried around like an RSA SecurID. Unfortunately, even that system risks being compromised, and like the sheet of paper, highly inconvenient.

But on the other hand, your garage door works with a rolling keY too, and you're also SOL if you lose your opener (unless you, ironically, have a keypad).

Re: Write your passwords down

#27

Post by lukeschlather »

samuel wrote: post #17

So you have a paper on your wallet, which can be used to obtain every password you use, using an intricate and very specific "algorithm". Then you publish the fact itself and the algorithm in your blog(real name), which, besides, doesn't depend on a passphrase (which could turn your method in a sort of dual factor authenticator). The paper could be photocopied and returned to your wallet and you'd never know. Please,…

Why do you believe he gave you the real algorithm?

Re: Write your passwords down

#28

Post by JacobAldridge »

corin_ wrote: post #12
jakehow wrote: post #10

Earlier quoted context omitted.

The problem with this approach is that you can only remember a few passwords like this, which means that you are going to reuse passwords on multiple sites. One site compromise can compromise multiple accounts for you.

I don't have any problem remembering them personally (then again, I still remember root passwords I used when I was thirteen and they were completely random characters). Sites like HN and Reddit I'm happy to use the same password (I'd be minorly annoyed, but realistically I wouldn't be that fussed if I lost control of either account, I can either recover it or even create a new one), but any site where someone findin…

actually I find it harder to remember which username/email goes with each site

So very true. My password creation process is fairly memorable, and tends to meet the requirements of any site (password length, numbers, capitals etc). But user names - it's an email address, it's the name on your email address, they do accept spaces, they don't accept spaces, they only have 8 characters ... drives me mad !

Re: Write your passwords down

#29

Post by lukeschlather »

corin_ wrote: post #9

Personally I don't see any reason for having them completely randomly generated. 'thIs1smyp4ssw0rd19%2' isn't any less secure than another 20 character password that includes lower+upper case letters, numbers and special characters. Obviously, if you do something like 'c0r1np4ssw0rd" then it may get to the stage where enough people do that for crackers to expect it (maybe it already is, but as long as you follow his…

That's not quite true. When we're talking about the security of a password, we're talking about how long it's going to take someone to crack a possibly salted hash (Gawker's weren't) of your password. When attempting to crack a hash, the attacker begins with dictionary words, then with leetspeak permutations of dictionary words, then starts adding random numbers in with random words.

It's hard to say in what order specifically they're going to try it, but generally speaking, they go from fewer bits to higher bits. thIs 1s my p4ssw0rd - that's not quite as many bits as you think it is. That's 4 permutations of dictionary words. That password probably hits the requirement of 80 bits, but it is less secure than other 20 character passwords. thIs1smyp4ssw0rd is going to be tried in its various permutations fairly early on in the cracking, and tacking on a few extra characters, while an order of magnitude increase in compute time, is not outside the realm of possibility.

Re: Write your passwords down

#30

Post by ali001 »

crocowhile wrote: post #21
ali001 wrote: post #15

I think that a better solution is to use pwdhash. Check it out here: http://pwdhash.com It's a browser extension for Chrome and for Firefox that seamlessly hashes the concatenation of your master password and the domain name of the site you're logging into. This produces a different password for each site, and requires you to remember only your master password. The extensions were created by Blake Ross (big name in t…

The most commonly used hashers are pwdhash, supergenpass and magicpassword. Given that they all use hashing algorithms, none of them will result in a password using special characters, which is not optimal.

Actually, that's not true. Look at the encoding section of the PwdHash USENIX paper. PwdHash returns an ASCII representation (not a hex or base64 encoded string) of the hashed domain name + master password. PwdHash also applies a number of constraints to the returned hash to ensure that the special characters that it does use are legal at most websites.

A typical PwdHash password, with domain name google.com and master password "LetMeIn+123456?" looks like this:

6+LYoE/C0wP8dGPoO

Try it yourself at the pwdhash website.

Post reply on HN