Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Top Mental Health and Prayer Apps Fail at Privacy, Security (2022)

foundation.mozilla.org

Post reply on HN
Print view View original

31–40 of 75 posts

Re: Top Mental Health and Prayer Apps Fail at Privacy, Security (2022)

#31

Post by SanderNL »

BoxFour wrote: post #17
SanderNL wrote: post #12

Earlier quoted context omitted.

I think creating a strong password and offering it once is better or am I overlooking something?

If you suggest making one powerful password and using it everywhere, then as soon as one website reveals your password all your accounts have been exposed. The usual practice is to remember one strong phrase and never use it for anything except your password keeper.

I mean if the website in questions generates a password and shows it (and then lets it go of course). This is used to show cert private keys for example. I can see it work with passwords.

I don’t care about passwords. I just want a “key” and I’ll store it.

Re: Top Mental Health and Prayer Apps Fail at Privacy, Security (2022)

#32

Post by jacobwilliamroy »

gjsman-1000 wrote: post #7
hospitalJail wrote: post #5

>Mozilla’s Minimum Security Standards, like requiring strong passwords What if I don't want a strong password? What if I have 0 care for my account because I never wanted an account to being with but was strong armed into giving away my email, phone number, and now need a unique password because I'm worried someone is going to see that I 'prayed' 100 times. I loved that reddit didn't need an email, and I could use a…

One very, very basic measurement / thought experiment for holiness in Christian circles to think about is the following: Imagine Christianity is illegal. Imagine the government decides to prosecute you, but hires the weakest, most incompetent, repeatedly-almost-disbarred prosecutor there is. You meanwhile get access to David Boies. Would the government have enough evidence for even the worst prosecutor to prove you a…

[flagged]

Re: Top Mental Health and Prayer Apps Fail at Privacy, Security (2022)

#33

Post by BoxFour »

SanderNL wrote: post #31
BoxFour wrote: post #17

Earlier quoted context omitted.

If you suggest making one powerful password and using it everywhere, then as soon as one website reveals your password all your accounts have been exposed. The usual practice is to remember one strong phrase and never use it for anything except your password keeper.

I mean if the website in questions generates a password and shows it (and then lets it go of course). This is used to show cert private keys for example. I can see it work with passwords. I don’t care about passwords. I just want a “key” and I’ll store it.

Seems reasonable.

Re: Top Mental Health and Prayer Apps Fail at Privacy, Security (2022)

#34

Post by asynchronous »

yreg wrote: post #21
hospitalJail wrote: post #5

>Mozilla’s Minimum Security Standards, like requiring strong passwords What if I don't want a strong password? What if I have 0 care for my account because I never wanted an account to being with but was strong armed into giving away my email, phone number, and now need a unique password because I'm worried someone is going to see that I 'prayed' 100 times. I loved that reddit didn't need an email, and I could use a…

I don't understand what they mean by strong passwords. From the methodology: > If the product uses passwords or other means of security for remote authentication, it must require that strong passwords are used, including having password strength requirements. What are 'strength requirements'? Is minimum-length-of-X a strength requirement? Apparently not, since Abide failed for the following: > Strong password: No. Al…

8 characters isn’t exactly long but I agree overall length is the main way to make a password stronger. Cue the xkcd comic.

Re: Top Mental Health and Prayer Apps Fail at Privacy, Security (2022)

#36

Post by bell-cot »

robertlagrant wrote: post #22
bell-cot wrote: post #4

Earlier quoted context omitted.

My reaction, too. OTOH, the article is pretty obviously aimed at an audience which might really benefit from some more "...and don't stick your finger in a light socket, either!"-level warnings.

We all benefit from those warnings. Who isn't taught to not stick their fingers in light sockets?

A human can be old enough that hearing reminders about computer data generally consisting of 0's and 1's, or that spare diapers are handy when an infant is around, or the 'R' on the gearshift lever standing for 'Reverse', or {etc.} ...may no longer be a good use of the old human's time.

Re: Top Mental Health and Prayer Apps Fail at Privacy, Security (2022)

#37

Post by dolmen »

3pt14159 wrote: post #29
hospitalJail wrote: post #5

>Mozilla’s Minimum Security Standards, like requiring strong passwords What if I don't want a strong password? What if I have 0 care for my account because I never wanted an account to being with but was strong armed into giving away my email, phone number, and now need a unique password because I'm worried someone is going to see that I 'prayed' 100 times. I loved that reddit didn't need an email, and I could use a…

Why do I need a password at all for 99.99% of apps or websites? If I lose a password, what do I almost always have to do? 1. Email account recovery link. 2. Input auth code sent from text message or authenticator app. [Optional.] 3. Make new random password I'm going to forget or lose. Why bother with this? If email is the reset mechanism why does the industry care so much about getting passwords from users? 1. Email…

> Why bother with this? If email is the reset mechanism why does the industry care so much about getting passwords from users?

Because you may not have access to your e-mail from the device where you want to use that service.

For example, I don't need to have access to my e-mails from my tablet as I'm always reading/writing them on a computer with a keyboard. So I don't want to setup access to my e-mails from my tablet, as it reduces the risks of a bad app leaking them or leaking my credentials.

Re: Top Mental Health and Prayer Apps Fail at Privacy, Security (2022)

#38

Post by cnity »

yreg wrote: post #21
hospitalJail wrote: post #5

>Mozilla’s Minimum Security Standards, like requiring strong passwords What if I don't want a strong password? What if I have 0 care for my account because I never wanted an account to being with but was strong armed into giving away my email, phone number, and now need a unique password because I'm worried someone is going to see that I 'prayed' 100 times. I loved that reddit didn't need an email, and I could use a…

I don't understand what they mean by strong passwords. From the methodology: > If the product uses passwords or other means of security for remote authentication, it must require that strong passwords are used, including having password strength requirements. What are 'strength requirements'? Is minimum-length-of-X a strength requirement? Apparently not, since Abide failed for the following: > Strong password: No. Al…

Passwords tend not to be brute forced one character at a time, but by combinations of common password lists and rainbow tables. The base unit is not character in these cases but entries in the tables.

Therefore, a password like "EstablishedCousins" is significantly less secure than "bR^4outc0m3" despite containing more characters.

Edit: I actually mean dictionary attack, not rainbow tables, but my point still stands.

Edit 2: In fact, the password from the example ("11111111") appears in the 71st line of this password dictionary: https://raw.githubusercontent.com/duyet/bruteforce-database/...

Re: Top Mental Health and Prayer Apps Fail at Privacy, Security (2022)

#39

Post by haswell »

Missing is the “Waking Up” meditation app which is a treasure trove of content and the first app that helped me “get” meditation.

I submitted it on their form for review, but was a little surprised to see it missing from a “top” list.

Seeing this report makes me really want to build privacy-respecting apps in this space. Of all categories, using traditional monetization and data selling practices seems particularly bad here.

(Not affiliated in any way; just a happy customer hoping they aren’t abusing my data too badly…)

Re: Top Mental Health and Prayer Apps Fail at Privacy, Security (2022)

#40

Post by thfuran »

yreg wrote: post #21
hospitalJail wrote: post #5

>Mozilla’s Minimum Security Standards, like requiring strong passwords What if I don't want a strong password? What if I have 0 care for my account because I never wanted an account to being with but was strong armed into giving away my email, phone number, and now need a unique password because I'm worried someone is going to see that I 'prayed' 100 times. I loved that reddit didn't need an email, and I could use a…

I don't understand what they mean by strong passwords. From the methodology: > If the product uses passwords or other means of security for remote authentication, it must require that strong passwords are used, including having password strength requirements. What are 'strength requirements'? Is minimum-length-of-X a strength requirement? Apparently not, since Abide failed for the following: > Strong password: No. Al…

'Sufficiently long' is doing a lot of work though. 1$a}F is a five symbol password and so is ASufficientlyLongPassPhrase. Unless an attacker has some specific knowledge about how the passwords were generated, the latter is significantly more secure since the dictionary size for the symbols (English words, though none especially uncommon so top 5k or so should suffice) is significantly larger than that of the former (standard keyboard characters). But it's not nearly as secure as a password in the style of the former with the same number of characters as that passphrase.
Post reply on HN