Live data from Hacker News

Adobe credentials and the serious insecurity of password hints

troyhunt.com

41–43 of 43 posts

Re: Adobe credentials and the serious insecurity of password hints

#41

> Password hints are an absolutely ridiculous security measure. Password hints have multiple uses. For identity management and verification systems, it's used as an additional identity check after the password if the host seems to have changed. For password recovery, it's a "need to know" factor you have to pass before you get to the "need to have" of e-mail account access. Since it's trivial to bruteforce, multiple…

I think you've mixed up password hints with security questions.

You seem to be talking about stuff of the form, "What is my mother's maiden name?"

A password hint is exactly what it says: a hint for what your password was, to help you avoid forgetting it. If your password is "lassie", then your password hint might be something like, "That dog you like from TV." The problem, of course, is that just about any hint that helps you remember your password also helps an attacker guess it.

Re: Adobe credentials and the serious insecurity of password hints

#42
post #41

> Password hints are an absolutely ridiculous security measure. Password hints have multiple uses. For identity management and verification systems, it's used as an additional identity check after the password if the host seems to have changed. For password recovery, it's a "need to know" factor you have to pass before you get to the "need to have" of e-mail account access. Since it's trivial to bruteforce, multiple…

I think you've mixed up password hints with security questions. You seem to be talking about stuff of the form, "What is my mother's maiden name?" A password hint is exactly what it says: a hint for what your password was, to help you avoid forgetting it. If your password is "lassie", then your password hint might be something like, "That dog you like from TV." The problem, of course, is that just about any hint that…

Ah, you're right, got the two confused

Re: Adobe credentials and the serious insecurity of password hints

#43
post #10
post #7

Earlier quoted context omitted.

Don't use Ghostery because they're tracking you: http://en.wikipedia.org/wiki/Ghostery#Criticism Try disconnect.me or blacklisting the sites directly from the hosts file.

I kept using ghostery because I didn't know of any alternative and sometimes I can't install adsuck. (which is is better than a huge hosts file. An oversized hosts file can have a negative impact on DNS and overall network responsiveness). Thanks for disconnect.me, I'll give it a shot :)

> An oversized hosts file can have a negative impact on DNS and overall network responsiveness

how many hosts entries would you say it is before the negative impact is significant? 20? 100?

Post reply on HN