Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down

blog.jgc.org

Post reply on HN
Print view View original

61–70 of 125 posts

Re: Write your passwords down

#61

Post by maw »

I don't write my passwords down, but I do use reminders in a code of sorts.

An example: I have an account with the bank Bancomer. In Spanish, "comer" means to eat, so I refer to it as "eßenbanque". (I know it's "essen"; nobody likely to find my list would recognize the ß, though; it would be mistaken for a B.) If my password were "l4rryb1rd" (it's not) I might render it as "oiseaulázaro", just enough of a reminder, while still misleading.

This scheme might not work so well in, say, Brussels, but here in Monolingüilandia I think it's reasonable, although I do wonder from time to time just how sound it really is.

Re: Write your passwords down

#62

Post by flogic »

sophacles wrote: post #57
lukeschlather wrote: post #27

Earlier quoted context omitted.

Why do you believe he gave you the real algorithm?

Access to the piece of paper severely reduces the attack space, even if it isn't "go diagonal from (letter2, letter3) of domain name". Heck, it is not much different if it is a trivial transform on the characters themselves. Anything that a person could easily do (making the thing convenient enough to actually use) is not going significantly alter the number of permutations. Of course, this is making a big assumption…

Once you're in the realm of targeted attacks you're in a whole different ball game. You have to consider who the attacker is likely to be and what they have access to. If your wallet isn't secure enough you can upgrade to a fire safe or some such. That narrows it do to people who you let in your home or are willing to break in. Beyond that though you're starting to enter into the realm of James Bond shit.

Re: Write your passwords down

#63

Post by ErrantX »

mikeryan wrote: post #7

Its funny I worked for a startup that got acquired by Comcast, and eventually we started having to follow the Comcast security policy which made us change domain passwords every month with requirements around using strange characters etc. I'd say about 50% of the people ended up with their current password on a post-it on their monitor or desk.

Yep, this is common practice.

I do a lot of pen testing, and one of the easiest ways to get access to important things is figure out a way to go into the IT department under some premise. Passwords galore, the rest is just memory :)

(this is, sadly, only a slight exaggeration)

Re: Write your passwords down

#64

Post by ErrantX »

Dove wrote: post #58
nowarninglabel wrote: post #19

Earlier quoted context omitted.

Yes, this same thing happens on the ship I work on in the summers. There are about 300 people, and about half have to reset their password when they come on board. There is the arbitrary 8 character, at least 1 #, at least 1 special character, at least 1 capital, can't match a dictionary word, and can't be close to the previous password. Also can't contain their name. Try explaining that to 150 people over and over a…

> just require long passwords, no other requirement. I particularly liked the suggestion (elsewhere) to set passwords to a random combination of three dictionary words. It's hard to remember 7Gw$kW_ws, but I bet I could come up with a meaning for "dog shower flange".

That's not much better entropy on the password. It wouldn't take long to go through all three word combinations based on a normal english dictionary.

With a password the key is always entropy. You can use all the smarts in the world to avoid the pre-computation attacks on your password... but never forget that brute force is not limited to character by character attack :)

Re: Write your passwords down

#65

Post by zcid »

16s wrote: post #60

I've been doing this: echo -n "A long sentence I can recall. site_name" | sha1sum I use the sha1sum from that as my password. site_name may be hackernews, slashdot, home, etc. I can break them in half (20 chars) or quarters (10 chars) if the site can't accept a 40 char password. Also I can add a period on the end if the site requires special chars. These are strong passwords and unique for each site. Works great on W…

While my method isn't as secure as your most likely is, I prefer a simpler algorithm based upon the site name. I can perform my algorithm in my head and enter a password quickly and without having to refer to a terminal or another program.

Btw, do you ever worry that your command history might be accessed to discover your passwords?

Re: Write your passwords down

#66

Post by s-phi-nl »

ErrantX wrote: post #64
Dove wrote: post #58

Earlier quoted context omitted.

> just require long passwords, no other requirement. I particularly liked the suggestion (elsewhere) to set passwords to a random combination of three dictionary words. It's hard to remember 7Gw$kW_ws, but I bet I could come up with a meaning for "dog shower flange".

That's not much better entropy on the password. It wouldn't take long to go through all three word combinations based on a normal english dictionary. With a password the key is always entropy. You can use all the smarts in the world to avoid the pre-computation attacks on your password... but never forget that brute force is not limited to character by character attack :)

http://www.baekdal.com/tips/password-security-usability says that it would take 2,537 years to crack a password with three common words, at a rate of 100 guesses per second, and flange isn't common. That's long enough for me.

Re: Write your passwords down

#67

Post by ErrantX »

s-phi-nl wrote: post #66
ErrantX wrote: post #64

Earlier quoted context omitted.

That's not much better entropy on the password. It wouldn't take long to go through all three word combinations based on a normal english dictionary. With a password the key is always entropy. You can use all the smarts in the world to avoid the pre-computation attacks on your password... but never forget that brute force is not limited to character by character attack :)

http://www.baekdal.com/tips/password-security-usability says that it would take 2,537 years to crack a password with three common words, at a rate of 100 guesses per second, and flange isn't common. That's long enough for me.

Right, so someone trying to brute force the password into the interface is limited by the speed of the program (or any artificial limits it should have built in :)).

In fact, just one word with a couple of numbers has the same effect.

Don't forget though, you are trusting this password to a site. If they are hacked, what then? Your 2K years turns into minutes or hours.

Re: Write your passwords down

#68

Post by msg »

jgrahamc wrote: post #54
crocowhile wrote: post #24

> (I have a second copy of that sheet left with a friend in an envelope) I love jgc but here he's making the same mistake most people make when they speak about security: assuming all readers have the same need for security and run the same risks. They don't. There is no point for my mom to adopt this system, it's way overkilled for her. (I think there's no point for me either). One needs to explain to users two thin…

I somewhat agree, but when mass hacks occur it opens people with poor passwords up to hackers because they've got all the time in the world to see whose accounts they can get into. BTW Do you use the same password on your Gawker account elsewhere?

I usually have two passwords: A stupid one that I only use on stupid sites, and a good one that I use on crucial ones (Gmail, Amazon, bank). There's no relationship between the good and bad passwords, so I feel more confident that I'll be unaffected by data breaches.

I checked the torrent and I guess I never made a Gawker account.

Re: Write your passwords down

#69

Post by 16s »

zcid wrote: post #65
16s wrote: post #60

I've been doing this: echo -n "A long sentence I can recall. site_name" | sha1sum I use the sha1sum from that as my password. site_name may be hackernews, slashdot, home, etc. I can break them in half (20 chars) or quarters (10 chars) if the site can't accept a 40 char password. Also I can add a period on the end if the site requires special chars. These are strong passwords and unique for each site. Works great on W…

While my method isn't as secure as your most likely is, I prefer a simpler algorithm based upon the site name. I can perform my algorithm in my head and enter a password quickly and without having to refer to a terminal or another program. Btw, do you ever worry that your command history might be accessed to discover your passwords?

I use an app I wrote to do the sha1 so the sentence is not hanging around in bash history, but I do rely on the cmd prompt at times on computers at my house. Here's a screeshot of the app: http://i.imgur.com/tz255.png

No one but me uses it. So it's bare bones.

Re: Write your passwords down

#70

Post by corin_ »

jerf wrote: post #48
corin_ wrote: post #42

Earlier quoted context omitted.

Realistically if you take into account the possibility of using up to four works, with some but not all vowels replaced with numbers, a mixture of upper/lower, and some other random numbers and special characters in an undisclosed place... that creates such a huge number of possibilities that it might as well not be dictionary based from the cracker's point of view.

Write your scheme down, compute the number of permutations it makes available, then divide by the total number of possibilities allowed by your password set (a straight [possible_chars]^[length] computation). The results will surprise you. The space of things you describe is far smaller relative to the available space than you realize. You can indeed make this big enough to work, and it's easy to make it big enough t…

The thing is, even if it's true for the one scheme I suggested, unless you know the format a password will be in you can't aim directly for that scheme, meaning you can't limit the number of possibilities that much.

I could pick a password that is "coRInStaNdr3ws19@90" which is my first name, my first school, my year of birth, and a few capitals/numbers/special characters. If an attacker knows that's my type of password then it might make it easier for him, but 'corin' isn't in dictionaries (sure they might think to find out my name and add it as a dictionary word), and I doubt "st" and "andrews" would be. Realistically, unless I give away my rough password format, they won't be able to narrow it down and will be left with a password that's just as hard to crack as if it was completely random.

Post reply on HN