Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let them paste passwords

ncsc.gov.uk

Post reply on HN
Print view View original

371–376 of 376 posts

Re: Let them paste passwords

#371

Post by logfromblammo »

qmr wrote: post #370
logfromblammo wrote: post #77

Earlier quoted context omitted.

You just make up a story and use one of the knickknacks you keep near your workstation as a memory trigger. For instance, if I needed a new strong password, I could use, "This#jar#once#held#1111#M&Ms,#but#now#it#is#empty." The only thing I need to remember there is the story of the jar and the padding character I used in place of spaces. If I really had to, I could put "#" on a sticky note under the jar. But of cours…

You could also ... use spaces?

Yes, you could. That would be easier to remember, but also easier to guess. If your phrase is long enough, and unique enough, that wouldn't matter. The mere threat that it could be any character is enough to discourage most attackers.

Probably the best argument against spaces is the attack that listens to the sounds of your keyboard with a microphone as you type. As the space bar is a larger key, it sounds a distinctively lower note as you type, and would give even an unsophisticated attacker the means to determine the word lengths in your passphrase, which might reduce its entropy to something guessable within the lifespan of the universe.

Probably not a concern unless you might be targeted by someone with government-level resources.

Re: Let them paste passwords

#372

Post by sowbug »

Tobani wrote: post #55
sowbug wrote: post #9

Earlier quoted context omitted.

I also worry when a site doesn't work with autocomplete. It's rare these days that the developers have actively tried to prevent it from working, but more common that an unnecessarily intricate sign-in flow makes the existence of the password field unrecognizable to the browser. This makes me wonder about the personal security practices of the team that built it -- it's unlikely they typed strong passphrases hundreds…

There are a couple of reasons to actively prevent autofill passwords. The only one I have seen for login autofill prevention is when the password is actually a generated token (ala yubikey,etc) and a password manager won't do the right thing by default. There are regulatory bodies that require regular challenge of user identity for approving items as sort of a signature mechanism. This is another time where active th…

Those are good reasons, and I appreciate when the attribute is used properly in these cases. It's annoying to have to say "no, don't remember this updated password" to my browser every single time I visit certain sites that ask for OTPs that my browser wants to autofill.

In the token case, I wonder whether they should have been password fields to begin with. Replacing a 6-digit OTP with asterisks is of questionable benefit, because the shoulder-surfer it thwarts can't reuse the OTP and is really unlikely to swipe it and use it before you do.

Re: Let them paste passwords

#373

Post by rkeene2 »

palunon wrote: post #284
rkeene2 wrote: post #124

Earlier quoted context omitted.

I don't even have the ability to read my password manager's master key, since all passwords are encrypted with different AES keys, which is then encrypted with a private key I have no ability to read (only ask my smartcard to perform RSA on, if I can authenticate to it). hunter2 is the password manager I wrote for this: https://chiselapp.com/user/rkeene/repository/hunter2/

What if you loose your smartcard ?

hunter2 supports the concept of users, which are named public keys so I can share individual passwords with other users. One of those other users can be a different smartcard or a different person who can then authorized my new card.

Re: Let them paste passwords

#374

Post by rkeene2 »

mazamats wrote: post #291
palunon wrote: post #284

Earlier quoted context omitted.

What if you loose your smartcard ?

He could have an encrypted digital copy somewhere else

I don't keep my private key, in any format, accessible -- usually the private keys are generated on the card and never revealed.

Re: Let them paste passwords

#375

Post by Exuma »

_jal wrote: post #57

In general, more and more sites encourage me to just leave Javascript turned off all the time. If they break, screw them, I'll go elsewhere. The only sites "sticky" enough to make me put up with it are financial, and that's only because they all suck so changing solves nothing. 'Missing out' on Angular sites hasn't left me feel like I'm missing anything in my life. This ties in to the discussion of Craig's List the o…

Lol I always love replies like this. Scuse my french, but are you fucking kidding me?

So basically you don't use 80% of the internet because the occasional site annoys you?

Do you also cut off your hands when you get dirt on them???

People have been saying this since like 2000's, and the more advanced JS websites get, the more cringeworthy this comment gets. It's 2017, just fucking leave javascript on and use ghostry + ublock origin.

Re: Let them paste passwords

#376

Post by alanh »

SomeStupidPoint wrote: post #79
alanh wrote: post #27

Earlier quoted context omitted.

Oh, come on. All of them? If you're like me, that’s hundreds. Are you a memorization savant? Are you creating low-quality passwords? Mine are actually long and random (generated NOT by me and NOT four Dr Seuss words)

Why the dig at passphrases?

I don’t have a problem with passphrases per se, but when people make them up via their noggin, they aren’t random and aren’t likely to include many obscure words. Using only common words dramatically reduces entropy. E.g., there are only 1 trillion passphrases of 4 words that can be constructed with the 1000 most common words, but a 12-character passphrase pulling from alphanumerics and the ~16 punctuation characters on your keyboard yield 50 sextillion permutations. That’s 50 thousand billion billion.

The argument I am making is that your average passphrase — yes, including "correct horse battery staple" — could be cracked a trillion times over before a password generated via 1Password would be!

Post reply on HN