41–50 of 56 posts
Earlier quoted context omitted.
Reading someone's email without permission is a crime. Nice idea though :)
Add some fine print in the user agreement, "During sign-up (only) for service X, I hereby authorize web service X to open my inbox and read one (1) email message, if I choose to provide my email account's password as my password for website X." No longer a federal crime, maybe? Probably still get an angry mob with pitchforks outside your window.
Here is the result for HackerNews: kcahu3602122@#)*
here for Facebook: ecafu3602122@#)^
(I can create them practically in my sleep. The algorithm is personal and easy)
To determine the algorithm, one would need plain text from two sites and be able to match them. Now, everytime a site limits my freedom to creating the password I want (assuming I can't provide my own security - by demanding a capital, a number, a this a that) I default to the same password. If they get one site with my simple pass, they get all the sites on which I use it.
When you put constraints on my password creation, you make my online life MORE insecure, not less.
Free my password. Don't tell me what I can and can't do. Offer a full page of help describing to those who don't care what they should do. But don't force them.
I am the only person I know who uses a unique, memorable and strong password for every site I use. I store all of them in my head. I have a base password and I add the first several characters of the site to the middle. For example: Facebook - sdfb231a2 Hacker News - sdyc231a2 Yahoo - sdya231a2 For strong passwords I can add a suffix to further strengthen the password. PayPal - sdpa231a2a4 I use the same suffix for a…
Earlier quoted context omitted.
Other than education and pushing them to use a secure password manager, I'm not sure, but the solution shouldn't involve breaking existing and secure systems which are widely used even if only by a minority of users.
"widely used by a minority" <- you made my point.
The proposed solution adds little to no real world security (see my other post about how easy it would be to guess which part is the random one which makes this system not useful unless almost all sites use it, which will never happen). Given little to no real world security gain from the described system, it certainly isn't worth breaking an existing system that works just fine and securely even if for just a minority of people.
I am the only person I know who uses a unique, memorable and strong password for every site I use. I store all of them in my head. I have a base password and I add the first several characters of the site to the middle. For example: Facebook - sdfb231a2 Hacker News - sdyc231a2 Yahoo - sdya231a2 For strong passwords I can add a suffix to further strengthen the password. PayPal - sdpa231a2a4 I use the same suffix for a…
I guess the same thing you'd do if you ran across a site with this well intentioned but terrible idea: write it down or email it to yourself.
The only sane thing you can do as a developer is let users chose any password they like, regardless of how insecure you think it is. Store it correctly and that's the end of your involvement. Let your users do what they want, or you'll just make things worse.
Earlier quoted context omitted.
> Tell the user: your password must contain the following word: “hzru” Enforcing this kind of thing on the masses won't make for stronger passwords, it will just have them opening up notepad.exe and saving this sites too-hard-to-remember-because-it-has-too-many-rules password on ~/Desktop/logins.txt
Now you'd have to prove that having passwords stored in a file is worse than massive password leaks. I suspect that it isn't. People already carry laptops with browsers that save passwords automatically. Losing your laptop already implies a password-change-fest.
"Now, one fine day somecrappysite.com gets hacked. The next time you visit, the web page has malicious code that sends your password in plaintext to someone. There go your Paypal funds, your Facebook account, your online life." What an optimist! somecrappysite.com was probably storing your password in plaintext to begin with and it probably got pulled from the database long before you logged in again. Having said tha…
Right, but those people are the one percent. How do we help the vast majority?
"This USB key is your identity card." is a simple concept to understand, and better than a password.
I am the only person I know who uses a unique, memorable and strong password for every site I use. I store all of them in my head. I have a base password and I add the first several characters of the site to the middle. For example: Facebook - sdfb231a2 Hacker News - sdyc231a2 Yahoo - sdya231a2 For strong passwords I can add a suffix to further strengthen the password. PayPal - sdpa231a2a4 I use the same suffix for a…
I'm also concerned about a targeted attack against my online identity. I've had a couple of online acquaintances be the victim of targeted attacks, one holding accounts hostage as a sort of online blackmail. Someone who compromises a couple of random forums and picks up on the pattern now has the key to your online identity. I'd mitigate it somewhat by using multiple prefixes and suffixes, one set for 'throwaway' accounts and others for more important stuff. Even that tactic has issues, do you remember to change your password for that throwaway site that blew up with success and now your account is part of your online identity?
The alternatives aren't too reassuring though, I balance these risks against the possibility of my KeePass, LastPass or browser password list getting compromised.
I cry everytime I read these threads on HN. I've never seen such stubborness than people desperately convinced that they need to be able to memorize their passwords, or that password managers are the devil. I'll say it again, just use a password manager. It generates random, complex passwords. It memorizes them for you. It pre-populates forms. They are locally encrypted and can be synced by themselves or with other t…
See all my other comments on this thread. Why does your mother use LastPass? How did she learn about it? How about the other 99% of the people? How do you make them use LastPass? This is not about us.
Earlier quoted context omitted.
Now you'd have to prove that having passwords stored in a file is worse than massive password leaks. I suspect that it isn't. People already carry laptops with browsers that save passwords automatically. Losing your laptop already implies a password-change-fest.
Are you implying that browsers save passwords in cleartext? A quick search indicates that all major browsers encrypt passwords to user accounts, and some give the option of a master password as well.