Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down

blog.jgc.org

Post reply on HN
Print view View original

71–80 of 125 posts

Re: Write your passwords down

#71

Post by verdant »

mikeryan wrote: post #7

Its funny I worked for a startup that got acquired by Comcast, and eventually we started having to follow the Comcast security policy which made us change domain passwords every month with requirements around using strange characters etc. I'd say about 50% of the people ended up with their current password on a post-it on their monitor or desk.

I loathe policies about expiring passwords because it breeds insecurity in the manner you mention. However, my company has this same policy, not because its been evaluated as being a good policy, but because our SOX audits require it.

Another reason to grumble over SOX.

Re: Write your passwords down

#72

Post by kgo »

s-phi-nl wrote: post #66
ErrantX wrote: post #64

Earlier quoted context omitted.

That's not much better entropy on the password. It wouldn't take long to go through all three word combinations based on a normal english dictionary. With a password the key is always entropy. You can use all the smarts in the world to avoid the pre-computation attacks on your password... but never forget that brute force is not limited to character by character attack :)

http://www.baekdal.com/tips/password-security-usability says that it would take 2,537 years to crack a password with three common words, at a rate of 100 guesses per second, and flange isn't common. That's long enough for me.

This guy picks that upper limit based on the idea that an attacker can't hit the webserver more than 100 times a minute, which makes me question how much he knows about crypto. He doesn't take into account someone who has access to the password hashes.

So assume they've got something lame like SHA-1 hashes, even on commodity hardware you're talking about 100,000 hashes a second. Now you're at 2.5 years. Setup a simple cluster or buy some CPU cards, and you easily get into the three month range.

Re: Write your passwords down

#73

Post by jerf »

corin_ wrote: post #70
jerf wrote: post #48

Earlier quoted context omitted.

Write your scheme down, compute the number of permutations it makes available, then divide by the total number of possibilities allowed by your password set (a straight [possible_chars]^[length] computation). The results will surprise you. The space of things you describe is far smaller relative to the available space than you realize. You can indeed make this big enough to work, and it's easy to make it big enough t…

The thing is, even if it's true for the one scheme I suggested, unless you know the format a password will be in you can't aim directly for that scheme, meaning you can't limit the number of possibilities that much. I could pick a password that is "coRInStaNdr3ws19@90" which is my first name, my first school, my year of birth, and a few capitals/numbers/special characters. If an attacker knows that's my type of passw…

You're making a false assumption that the hacker must somehow divine your pattern, but that is not necessary. An attacker could mount a Markov-chain based attack based on common phonetic patterns (and even common numbers, since some will show up more often than others) and radically cut down the search space even without assuming any aspect of your "pattern", and what you cited will get caught in that orders of magnitude before a truly random password. Along with enormous numbers of patterns that you could cite, as well, this is pretty much a superset of them all.

When you cut the possibility space down, you have cut the possibility space down. You can't fool entropy. The math is quite vicious that way.

You're encountering the "everybody can create an encryption scheme that they themselves can't crack" problem. You may not be able to think of how to abuse low-entropy passwords to crack something far longer than you "ought" to be able to, but that doesn't make it impossible, or even necessarily hard for an attacker.

Re: Write your passwords down

#74

Post by kgo »

jasonjei wrote: post #26

It's an interesting concept because passwords could be infinitely more secure if everything adopted a two-factor authentication system with something physical that you carried around like an RSA SecurID. Unfortunately, even that system risks being compromised, and like the sheet of paper, highly inconvenient. But on the other hand, your garage door works with a rolling keY too, and you're also SOL if you lose your op…

I did some consulting work at a big pharma company. And they solved the whole problem of someone stealing (or more likely losing) a RSA key by keeping all the keys at the helpdesk!

You just called up, said you need the ID, and they read you the number over the phone...

Me: "Hi I'm XXX and I need the RSA key for COMPANY X."

Helpdesk: "Okay... It's on the board here somewhere... Found it... It's down to the last bar. Let me wait until it flips... Okay. Six bars... 643332."

Me: "Thanks a million."

Re: Write your passwords down

#75

Post by stcredzero »

Dove wrote: post #58
nowarninglabel wrote: post #19

Earlier quoted context omitted.

Yes, this same thing happens on the ship I work on in the summers. There are about 300 people, and about half have to reset their password when they come on board. There is the arbitrary 8 character, at least 1 #, at least 1 special character, at least 1 capital, can't match a dictionary word, and can't be close to the previous password. Also can't contain their name. Try explaining that to 150 people over and over a…

> just require long passwords, no other requirement. I particularly liked the suggestion (elsewhere) to set passwords to a random combination of three dictionary words. It's hard to remember 7Gw$kW_ws, but I bet I could come up with a meaning for "dog shower flange".

I came up with such a scheme 12 years ago, but with some improvements. If you modify words from /usr/dict/words with h4xx0r style modifications, then it's easy to get above 80 bits of entropy with a reasonable number of entities.

An average vocabulary has something like a million words in it, if you word count derivations. If you can expand that by a factor of five with easily memorable things like 1337-speak transformations, you can get above 80 bits with only 4 entities.

Re: Write your passwords down

#76

Post by paulshort »

This password would be really hard to crack.

T#!$ p@$$w0rd w0uld &e re@lly #@rd t0 cr@ck.

T#!$p@$$w0rdw0uld&ere@lly#@rdt0cr@ck

The passwords for my important stuff look much like the above. Just write a sentence that's easy to remember, replace letters with the special characters they look like and blend it all together. Works a treat.

Re: Write your passwords down

#77

Post by crux_ »

16s wrote: post #60

I've been doing this: echo -n "A long sentence I can recall. site_name" | sha1sum I use the sha1sum from that as my password. site_name may be hackernews, slashdot, home, etc. I can break them in half (20 chars) or quarters (10 chars) if the site can't accept a 40 char password. Also I can add a period on the end if the site requires special chars. These are strong passwords and unique for each site. Works great on W…

Not to be snarky, but isn't your master password now sitting there, plaintext, in your command-line history? (Worse: when you accidentally do this in a terminal that's remoted somewhere.)

Re: Write your passwords down

#78

Post by teralaser »

Here is another reason to write your passwords down: At my workplace there was a programmer. One day he had a heart attack, and was put into a 3 week artifiscal coma. When he woke again, he could not remember any passwords. Everything was a pain. To this day, his website ends the day, he had the attack.

Re: Write your passwords down

#79

Post by 16s »

crux_ wrote: post #77
16s wrote: post #60

I've been doing this: echo -n "A long sentence I can recall. site_name" | sha1sum I use the sha1sum from that as my password. site_name may be hackernews, slashdot, home, etc. I can break them in half (20 chars) or quarters (10 chars) if the site can't accept a 40 char password. Also I can add a period on the end if the site requires special chars. These are strong passwords and unique for each site. Works great on W…

Not to be snarky, but isn't your master password now sitting there, plaintext, in your command-line history? (Worse: when you accidentally do this in a terminal that's remoted somewhere.)

See my reply below. I seldom do it in a terminal and when I do only on my home machines. The command above is for explanation. If I showed you my app without that explanation, it wouldn't be the same.

Re: Write your passwords down

#80

Post by pavel_lishin »

maw wrote: post #61

I don't write my passwords down, but I do use reminders in a code of sorts. An example: I have an account with the bank Bancomer. In Spanish, "comer" means to eat, so I refer to it as "eßenbanque". (I know it's "essen"; nobody likely to find my list would recognize the ß, though; it would be mistaken for a B.) If my password were "l4rryb1rd" (it's not) I might render it as "oiseaulázaro", just enough of a reminder, w…

I use something vaguely similar for my passwords, but with Russian instead of spanish/german.

Fun fact: the password based on Russian transliteration that looks NOTHING like any English word I've seen (imagine "cexuqakr3") trips the linux "too close to dictionary word!" warning while a less secure password that's based on two english words (imagine "bellykitten13") doesn't.

Post reply on HN