Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Substack's UI and 1Password temporarily cost me $2k

timmyomahony.com

Post reply on HN
Print view View original

271–278 of 278 posts

Re: Substack's UI and 1Password temporarily cost me $2k

#271

Post by ludocode »

Moeg wrote: post #147
ludocode wrote: post #142

Earlier quoted context omitted.

I tried using this but the final "enter" made me too uncomfortable. I really wish it was optional so I could verify where it just typed the password before submitting. After accidentally sending my password in the wrong field/window a couple of times I stopped using it entirely. Now I just copy-paste :(

You can edit how and what KeePass types, I always remove the final enter for comfort and safety reasons.

Ah wow, thanks for the tip. I guess you can edit the root group to change it globally? Thanks, I'll try this.

Re: Substack's UI and 1Password temporarily cost me $2k

#272

Post by SAI_Peregrinus »

heavenlyblue wrote: post #247
jesboat wrote: post #240

Earlier quoted context omitted.

> you're still sending your full password to the server for verification each time, so if the server is compromised for any length of time your password will be as well. The key difference between storing plaintext passwords and hashed passwords is that with hashed passwords, you can only compromise users who log in during the interval when the system is compromised, and even then, only for worse compromises (eg if a…

> users who log in during the interval when the system is compromised Why only then?

Because the server doesn't store the password, only the "password hash" of the password. So if the server isn't compromised during the login there's no way for the attacker to learn the password itself.

Re: Substack's UI and 1Password temporarily cost me $2k

#273

Post by Saris »

lawtalkinghuman wrote: post #241
Saris wrote: post #235

Earlier quoted context omitted.

I used to use Keepass with auto-type. I had a hotkey for it, and it would recognize the site based on the browser window title. That would probably be the best of both, no clipboard, and no browser addons.

Instead of checking the TLS certificate or the domain, you are depending on fak3b00k.com not implementing the same title tag as Facebook?

That's something to think about. But I'm not sure how I would end up on fak3b00k.com unless something changed my bookmark for it, or I really mistyped it but if I did that the URL being different is a dead giveaway.

Re: Substack's UI and 1Password temporarily cost me $2k

#274

Post by shakna »

JohnTHaller wrote: post #259
shakna wrote: post #138

Earlier quoted context omitted.

From what I can see, KeePass does use the clipboard. [0] [0] https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/N...

That's a different option (CTRL-C). You can copy and paste the username and password. There's a default clearing timeout that's more to ensure the user doesn't accidentally paste it elsewhere. The auto-type option I mentioned is different.

> The auto-type option I mentioned is different.

It actually falls back to the clipboard [0], in a huge number of situations [1]. Basically, if Windows Forms isn't available/reliable.

[0] https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/U...

[1] https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/U...

Re: Substack's UI and 1Password temporarily cost me $2k

#276

Post by Siira »

y7 wrote: post #225
EveYoung wrote: post #180

Earlier quoted context omitted.

My broker asks for 4-5 random letters of my password each time, making password managers unusable as well. Thinking about it now, how would you encrypt a password using this method? Create hashes of every combination?

You wouldn't encrypt/hash it, since 4-5 letters (say 30 bits) is trivial to brute force anyway. Talking about offline password encryption/hashing is a bit of a red herring anyway, since it distracts from the fact that you're still sending your full password to the server for verification each time, so if the server is compromised for any length of time your password will be as well. Reusing passwords is broken: you r…

Can’t the hash be computed through some browser API? The browser can then visually show when plaintext passwords are being sent.

Re: Substack's UI and 1Password temporarily cost me $2k

#277

Post by KMag »

tinus_hn wrote: post #216
KMag wrote: post #191

Earlier quoted context omitted.

Nit: I think you mean hashing, not encryption. Though, my bank uses a dual-password setup where the first password is required in its entirety and a few letters of the second password are required. I suspect this is stored by using a (hopefully memory-hard) salted key derivation function/password hash function (such as Argon2 or scrypt) to derive an encryption key from the first password, which is then used to decryp…

Hashing in this sense is one way encryption.

Cryptographic literature often mentions one-way functions, but I don't think I've ever seen the phrase "one way encryption" in a cryptographic paper. It's not a phrase used by cryptographers, except rarely to describe encryption using trap door one-way functions such as RSA.

Re: Substack's UI and 1Password temporarily cost me $2k

#278

Post by y7 »

Siira wrote: post #276
y7 wrote: post #225

Earlier quoted context omitted.

You wouldn't encrypt/hash it, since 4-5 letters (say 30 bits) is trivial to brute force anyway. Talking about offline password encryption/hashing is a bit of a red herring anyway, since it distracts from the fact that you're still sending your full password to the server for verification each time, so if the server is compromised for any length of time your password will be as well. Reusing passwords is broken: you r…

Can’t the hash be computed through some browser API? The browser can then visually show when plaintext passwords are being sent.

If you're willing to rely on client-side code for authentication, there are better mechanisms, such as https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...

There is a standard for it, called TLS-SRP, but unfortunately no browser supports it.

Post reply on HN