21–30 of 92 posts
For what it's worth, the horse battery staple is completely correct for the problem it's trying to solve. This article is about another (arguably more important) problem.
The article did stem from me reading blogposts where people were interpreting the XKCD comic into: just chose four words instead of one password.
Good point and article. I wish there was a de facto standard password manager/data format (open source, free, works everywhere). As it stands, there are many good ones, and it's hard to choose one , even though any choice is better than no choice.
I've used both LastPass and 1Password and while they're not open source or free, I have enjoyed using them both. I currently use 1Password and find it to be a great experience.
Maybe I'm barking up the wrong tree and the marketing or brand awareness of LastPass and 1Password is much higher than I suspect.
For what it's worth, the horse battery staple is completely correct for the problem it's trying to solve. This article is about another (arguably more important) problem.
Yeah, I get why he was trying to tie his point to something well-known. But I found the title maddening. If he had said, say, "Why horse battery staple is solving the wrong problem," I would have read his article with interest. But my increasing irritation as I waited for him to deliver on the promise in the title kept me from properly appreciating his point.
This comment suggests the author doesn't really understand the XKCD password scheme. The point is to choose four random words, not the first four words that pop into your head.
Also you cannot rely on an automatic-password-checker to tell the user their candidate password is weak: If it flags 'password1' as a weak password the user will just switch to 'password2' and that will become a common (ie. weak) password, at least until the password checker's database is updated.
For what it's worth, the horse battery staple is completely correct for the problem it's trying to solve. This article is about another (arguably more important) problem.
I use a password manager, but we should recognise there is one prominent issue with them, in that they create a single point of failure. The article suggests that the strength of algorithms like scrypt will keep you safe, but that doesn't stop low tech hacking methods (key loggers, shoulder surfing, etc...). We should be looking at using master passwords in conjunction with hardware dongles, if we really care about maximising security.
Earlier quoted context omitted.
I've used both LastPass and 1Password and while they're not open source or free, I have enjoyed using them both. I currently use 1Password and find it to be a great experience.
I'd genuinely like to know (and I promise that I'm not going for a vi/emacs discussion), why don't more people use KeePass? Specific to asking you, did you know about KeePass and, if you did know, what turned you away from it? It is both open source and free and, from what I've seen, has a good number of clients. Maybe I'm barking up the wrong tree and the marketing or brand awareness of LastPass and 1Password is muc…
What we're really missing is out of the box support for something like BitTorrent sync, so you don't need to centralize your store anywhere else.
People are not very creative and tend to think the same way when choosing passwords. This would lead to the exact same problem we have now, where a few passwords such as "password123" become very common.
The XKCD comic[1] says to use "four random common words." There seems to be some confusion between the popular use of "random" to mean "arbitrary" and the specific information-theory meaning of "random" (better worded as "randomly chosen"). Bruce Schneier criticized[2] the XKCD method based on the "arbitrary" interpretation, and the best explanation of the problem I've seen is in an answer[3] on the cryptography Stack Exchange site:
Random choices are random and uniform. This is hard to achieve with human users. You must convince them to use a device for good randomness (a coin, not a brain), and to accept the result. [...] If the users alter the choices, if only by generating another password if the one they got "does not please them", then they depart from random uniformity, and the entropy can only be lowered (maximum entropy is achieved with uniform randomness; you cannot get better, but you can get much worse).
[2] https://www.schneier.com/blog/archives/2014/03/choosing_secu...
I liked this article and largely agree with what it has to say, but I have a question related to a bit at the end. The article recommends using multifactor authentication everywhere, which sounds great for keeping things extra secure. Recently, though, I got a new phone and I'm thankful that I only had two services for which I was using multifactor authentication because otherwise I would have had to remember to set…
Good point, it is a problem. I'm aware of two options: - either you spend the time manually trying to going to all places where you use multi factor auth and perform "transfer device" process, which is hard and painful the more services you have, - or you save backups of the original source elsewhere, basically invalidating the security advantage multi factor offers you.
> What is there to prevent “letmeinfacebook” from being the new most common four word password for Facebook accounts? This comment suggests the author doesn't really understand the XKCD password scheme. The point is to choose four random words, not the first four words that pop into your head. Also you cannot rely on an automatic-password-checker to tell the user their candidate password is weak: If it flags 'passwor…
I liked this article and largely agree with what it has to say, but I have a question related to a bit at the end. The article recommends using multifactor authentication everywhere, which sounds great for keeping things extra secure. Recently, though, I got a new phone and I'm thankful that I only had two services for which I was using multifactor authentication because otherwise I would have had to remember to set…
Authy offers a cloud backup service, where they encrypt the secrets with a key derived from your password. They use PBKDF2 with only 1000 rounds, so pick a very high entropy password.