Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Hacklore – An Open Letter

hacklore.org

Post reply on HN
Print view View original

61–70 of 115 posts

Re: Stop Hacklore – An Open Letter

#61

Post by Waterluvian »

HiPhish wrote: post #24

I have two more to add to the list: > Secret questions No, my mother's maiden name is not a secret. And some questions like "who was your best friend in elementary school?" might have different answers depending on when you ask me. Plus, unless my best friend's name was Jose Pawel Mustafa Mungabi de la Svenson-Kurosawaskiwitz (we used to call him Joe) it's pretty easy to guess with a dictionary attack. The only way t…

> Jose Pawel Mustafa Mungabi de la Svenson-Kurosawaskiwitz

How in the #%*^ did you figure out my secret question?

I absolutely hate security theatre. And these kinds of things are just that. In fact, I’m sure that difficult to remember passwords make us less secure as we forget or write them down.

Re: Stop Hacklore – An Open Letter

#62

Post by NegativeK »

peanut-walrus wrote: post #57

For 1, you can still have extremely malicious networks. It's true that your web traffic is likely encrypted but... What services are exposed on your machine? Do you have mapped samba shares? For 5 - session cookies are one of the main things stealers look for. Deleting cookies is absolutely good advice until browsers build in better mitigations against cookie theft. For 6 - if there was a standard interface how passw…

While you and I would love it if password managers would rotate creds, we're not yet at the point where people will use password managers. They're still using CompanynameFall2025!. Next month, they'll dutifully rotate their password to CompanynameWinter2025! because their work policy is still stuck on shitty standards.

> This kind of advice is well-intentioned but misleading. It consumes the limited time people have to protect themselves and diverts attention from actions that truly reduce the likelihood and impact of real compromises.

When you've got 15 seconds to _maybe_ get someone to change their behavior for the better, you need to discard everything that's not essential and stay very very far away from "yes, but" in your explanations.

Re: Stop Hacklore – An Open Letter

#63

Post by [deleted] »

magackame wrote: post #11
Animats wrote: post #8

Note that most of the signers are from companies which collect substantial consumer information for revenue purposes. Hence the emphasis on "updating". And the absence of "turn up browser security levels to max" or "get a good ad blocker". Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right.

> Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right. You think of someone stealing your password vault and cracking AES? The vault is E2EE.

[deleted]

Re: Stop Hacklore – An Open Letter

#65

Post by thayne »

HiPhish wrote: post #24

I have two more to add to the list: > Secret questions No, my mother's maiden name is not a secret. And some questions like "who was your best friend in elementary school?" might have different answers depending on when you ask me. Plus, unless my best friend's name was Jose Pawel Mustafa Mungabi de la Svenson-Kurosawaskiwitz (we used to call him Joe) it's pretty easy to guess with a dictionary attack. The only way t…

> "kittycat", but "k!ttyc4T" is still less secure than "horse battery staple correct".

Well... something like that. Please don't use exactly "horse battery staple correct".

Re: Stop Hacklore – An Open Letter

#66

Post by golem14 »

thomastjeffery wrote: post #27

Don't worry about cookies or bother using a VPN, because... you are being tracked anyway? What's the point of including such a defeatist stance? > the real world across industry, academia, and government. Gotcha, so no one here gives a shit about privacy. They only care about avoiding the inconveniences of fraud and leaked secrets. Use a password manager and a feature-complete adblocker (ublock origin on Firefox). Se…

BTW, I really would like to have a way to partially clear cookies – i.e., I don't want to be signed out of gmail, and maybe not out of the Mechanic's Bank of Alaska or Amazon or Netflix, but most other things could go. I don't think this is easy in Chrome, Safari or other mainstream browsers, is it?

Yesyes, I do know that Big Ad can mostly stitch together some proxy profile of me anyway, but it would be more blurry.

Re: Stop Hacklore – An Open Letter

#68

Post by ndriscoll »

johncoatesdev wrote: post #31
Animats wrote: post #8

Note that most of the signers are from companies which collect substantial consumer information for revenue purposes. Hence the emphasis on "updating". And the absence of "turn up browser security levels to max" or "get a good ad blocker". Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right.

Updating software is good advice. Do you realize how many CVEs are reported on a daily basis? Once you've got a password manager you're largely protected against phishing, so the biggest target becomes your computer, and the most likely way to compromise that would be through outdated software with public vulnerabilities. What do you expect your browser security levels to the max to do? Browsers are designed to be se…

Almost all CVEs are basically irrelevant to everyone that doesn't have some obligation to keep on top of patching them. Meanwhile, auto-updates are RCE by default.

Re: Stop Hacklore – An Open Letter

#69

Post by NegativeK »

villiage wrote: post #58

I don’t understand why people promote password managers for individuals. You don’t need to store your password in a central location that is a prime target to hackers; even if it’s encrypted, that’s more of a risk than keeping one of your own. And some of the previous advice they’re stepping back from like avoiding QR codes you’re unfamiliar with is still good advice; you should be careful and not expose yourself too…

1. People are terrible at creating strong passwords. People will NOT create hundreds of strong passwords.

2. People will not use complex solutions unless actively and rigidly enforced.

3. At best, we can hope that they can create one really good passphrase. That's combined with MFA.

There are people that are exceptions to those, but they're vanishingly small percentage of the population. And unfortunately, there are a way, way more people that think they have something better but are deluding themselves -- like bad card counters that casinos are happy to have at the blackjack table or non-experts rolling their own crypto.

Re: Stop Hacklore – An Open Letter

#70

Post by BLKNSLVR »

Slight tangent: My wife's place of work has recently instituted a minimum 16-character password rule with the standard complexity requirements. They also encourage the use of password management software, as well as enforcing password changes every 6 months.

Where I see a flaw in this is the initial login.

If you're not already on your computer to access the password manager, how do you retrieve the essentially non-memorisable password to unlock your computer in order to get to the password manager to retrieve the essentially non-memorisable password?

The password to unlock the computer, therefore, must be able to be remembered. This pretty much excludes 16-character auto-generated passwords for anyone but a savant.

Am I missing something obvious here? (MFA using an authenticator app on the phone? Is that something that Windows / Mac/ Linux supports?)

Post reply on HN