Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password reuse is rampant: nearly half of observed user logins are compromised

blog.cloudflare.com

Post reply on HN
Print view View original

41–50 of 51 posts

Re: Password reuse is rampant: nearly half of observed user logins are compromised

#41

Post by vikingerik »

shakna wrote: post #17
Rucadi wrote: post #2

Passwords are a pain in the ass, I just wished that having a cryptographic key installed in your device (and linked to it) to login to stuff or having an external crypto-device to login was easier and more common. For local access, biometrical is fine, and a "super-secure" password for if something happens that can only be used once would be the way.

Biometrics are really not fine. They're somehow supposed to be some permanent marker of who you are, but that's really not how it works in the real world. You physically change. I've broken any biometrics recognising me in a dozen different ways, this year alone. Cut open my finger, changing my fingerprint. Head surgery for melanoma gave me a scar so facial recognition doesn't work anymore, blood vessel burst in my e…

There's also this failure case: I know a pair of sisters who look and sound identical enough that they can unlock each other's phones with face and voiceprint recognition.

Re: Password reuse is rampant: nearly half of observed user logins are compromised

#42

Post by Larrikin »

vikingerik wrote: post #41
shakna wrote: post #17

Earlier quoted context omitted.

Biometrics are really not fine. They're somehow supposed to be some permanent marker of who you are, but that's really not how it works in the real world. You physically change. I've broken any biometrics recognising me in a dozen different ways, this year alone. Cut open my finger, changing my fingerprint. Head surgery for melanoma gave me a scar so facial recognition doesn't work anymore, blood vessel burst in my e…

There's also this failure case: I know a pair of sisters who look and sound identical enough that they can unlock each other's phones with face and voiceprint recognition.

I knew a girl from Asia that had a sister that was six years younger and twenty pounds skinnier. They could both unlock each other's phones using facial recognition.

Re: Password reuse is rampant: nearly half of observed user logins are compromised

#45

Post by dsego »

stormfather wrote: post #32

I have a rule that modifies a base password depending on the name of the site the password is for. That way I only have to remember the base password and the rule.

There is an improved version of this, basically a password generator based on a phrase + service name - https://getvau.lt The issue is that once a password is compromised you need to change how you generate it and remember this exception in the future.

Re: Password reuse is rampant: nearly half of observed user logins are compromised

#48

Post by anacrolix »

dizhn wrote: post #15
anacrolix wrote: post #13

Maybe if we weren't letting a third party sign arbitrary certificates for arbitrary domains they wouldn't be reading our passwords. People don't realise CloudFlare is a MitM-as-a-Service.

What do you mean? Is cloudflare causing 3rd parties to read our passwords?

CloudFlare is the 3rd party.

Try implementing what CloudFlare does yourself. You will very quickly realise how it works. It's actually pretty crazy.

Re: Password reuse is rampant: nearly half of observed user logins are compromised

#49

Post by anacrolix »

doublerabbit wrote: post #36
atmanactive wrote: post #33

Earlier quoted context omitted.

I highly doubt that this is true. HTTPS POST data is encrypted just like any other HTTPS data. But, if one is using CloudFlare or any other proxy, by nature, that data needs to be decrypted and then encrypted again on it's way to the destination server. So, yes, of course, each and every proxy can see the data. And, no, HTTPS POST data can't be snooped over the wire otherwise.

What's not true? I may of mumbled my post. The data from the form, HTTPS POST data is not encrypted. It's plain text encapsulated in a secure socket. Setup a PHP page with a form and capture the $_POST. All will return in plaintext. POST is data is sent in headers which yes are encrypted by SSL but the servers receiving will receive it in plain text. By using third party you lose full control of the data flow encrypt…

Exactly this.

If CloudFlare, any "relay" were compromised, all traffic through that would be compromised. That's everything. All your bank details, full access, it's all right there.

The selling point of SSL is nobody can read what you do between you and the final destination, except when the developers of that destination enlist CloudFlare who have a root certificate that allows them to intercept everything whether you realise or not.

Re: Password reuse is rampant: nearly half of observed user logins are compromised

#50

Post by shakna »

Larrikin wrote: post #42
vikingerik wrote: post #41

Earlier quoted context omitted.

There's also this failure case: I know a pair of sisters who look and sound identical enough that they can unlock each other's phones with face and voiceprint recognition.

I knew a girl from Asia that had a sister that was six years younger and twenty pounds skinnier. They could both unlock each other's phones using facial recognition.

Considering the frequency with which facial recognition leads to arrests if you're black [0], it seems that if you've got the right non-white skintone, you can unlock someone else's phone.

[0] https://www.abc.net.au/news/science/2023-11-01/ai-facial-rec...

Post reply on HN