Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down

blog.jgc.org

Post reply on HN
Print view View original

91–100 of 125 posts

Re: Write your passwords down

#91

Post by matclayton »

16s wrote: post #60

I've been doing this: echo -n "A long sentence I can recall. site_name" | sha1sum I use the sha1sum from that as my password. site_name may be hackernews, slashdot, home, etc. I can break them in half (20 chars) or quarters (10 chars) if the site can't accept a 40 char password. Also I can add a period on the end if the site requires special chars. These are strong passwords and unique for each site. Works great on W…

This reduces the search space massively though as we now know you only use 0-f as characters, probably brings it closer to being brute forceable for the sites don't accept 40chars! And dont have rate limits.

Re: Write your passwords down

#92

Post by 16s »

matclayton wrote: post #91
16s wrote: post #60

I've been doing this: echo -n "A long sentence I can recall. site_name" | sha1sum I use the sha1sum from that as my password. site_name may be hackernews, slashdot, home, etc. I can break them in half (20 chars) or quarters (10 chars) if the site can't accept a 40 char password. Also I can add a period on the end if the site requires special chars. These are strong passwords and unique for each site. Works great on W…

This reduces the search space massively though as we now know you only use 0-f as characters, probably brings it closer to being brute forceable for the sites don't accept 40chars! And dont have rate limits.

16^20 = 1,208,925,819,614,629,174,706,176

The very best GPU crackers do about 1 billion guesses a second. Good luck.

Re: Write your passwords down

#93

Post by Sapient »

giberson wrote: post #56

I employ what I like to call "Personal Hashing". Think of it like the human version of md5. I've come up with an easy to remember, easy to compute (work done in my head), hashing system that I use to generate passwords for all my accounts. The power of this method is that it generates strong passwords, and is easy to remember. Take for example, and this is just a sample not my own personal hash formula, the following…

I may be missing something, but doesn't this give you the same password for all accounts with the username johnsmith?

Re: Write your passwords down

#94

Post by Sapient »

paulshort wrote: post #76

This password would be really hard to crack. T#!$ p@$$w0rd w0uld &e re@lly #@rd t0 cr@ck. T#!$p@$$w0rdw0uld&ere@lly#@rdt0cr@ck The passwords for my important stuff look much like the above. Just write a sentence that's easy to remember, replace letters with the special characters they look like and blend it all together. Works a treat.

With some Markov chain generators and leetification, not as hard as you think.

Re: Write your passwords down

#95

Post by callahad »

flogic wrote: post #62
sophacles wrote: post #57

Earlier quoted context omitted.

Access to the piece of paper severely reduces the attack space, even if it isn't "go diagonal from (letter2, letter3) of domain name". Heck, it is not much different if it is a trivial transform on the characters themselves. Anything that a person could easily do (making the thing convenient enough to actually use) is not going significantly alter the number of permutations. Of course, this is making a big assumption…

Once you're in the realm of targeted attacks you're in a whole different ball game. You have to consider who the attacker is likely to be and what they have access to. If your wallet isn't secure enough you can upgrade to a fire safe or some such. That narrows it do to people who you let in your home or are willing to break in. Beyond that though you're starting to enter into the realm of James Bond shit.

Or into the realm of two-factor auth. Sometimes I wonder why my roommate can get a security token for his World of Warcraft account, and I can't get one for my bank...

Re: Write your passwords down

#96

Post by jmulho »

msg wrote: post #68
jgrahamc wrote: post #54

Earlier quoted context omitted.

I somewhat agree, but when mass hacks occur it opens people with poor passwords up to hackers because they've got all the time in the world to see whose accounts they can get into. BTW Do you use the same password on your Gawker account elsewhere?

I usually have two passwords: A stupid one that I only use on stupid sites, and a good one that I use on crucial ones (Gmail, Amazon, bank). There's no relationship between the good and bad passwords, so I feel more confident that I'll be unaffected by data breaches. I checked the torrent and I guess I never made a Gawker account.

The problem with that plan is that one day you will learn that someone who works at Google, or Amazon, or your bank or some other "crucial" site has captured millions of username/password combinations and tried them at all the other crucial sites.

Re: Write your passwords down

#97

Post by Jach »

16s wrote: post #60

I've been doing this: echo -n "A long sentence I can recall. site_name" | sha1sum I use the sha1sum from that as my password. site_name may be hackernews, slashdot, home, etc. I can break them in half (20 chars) or quarters (10 chars) if the site can't accept a 40 char password. Also I can add a period on the end if the site requires special chars. These are strong passwords and unique for each site. Works great on W…

Your approach is great, I think I'll use it too.

My current method for secure passwords on sites that have a max around 8 or 12 or so is to think of some song lyrics I know, pick n words, camel-case them, l33+-translate a couple letters, and add shift+numeral special characters to either side.

Re: Write your passwords down

#98

Post by TheSOB88 »

kgo wrote: post #72
s-phi-nl wrote: post #66

Earlier quoted context omitted.

http://www.baekdal.com/tips/password-security-usability says that it would take 2,537 years to crack a password with three common words, at a rate of 100 guesses per second, and flange isn't common. That's long enough for me.

This guy picks that upper limit based on the idea that an attacker can't hit the webserver more than 100 times a minute, which makes me question how much he knows about crypto. He doesn't take into account someone who has access to the password hashes. So assume they've got something lame like SHA-1 hashes, even on commodity hardware you're talking about 100,000 hashes a second. Now you're at 2.5 years. Setup a simpl…

Shit, he's in trouble now!

Re: Write your passwords down

#99

Post by dekz »

16s wrote: post #60

I've been doing this: echo -n "A long sentence I can recall. site_name" | sha1sum I use the sha1sum from that as my password. site_name may be hackernews, slashdot, home, etc. I can break them in half (20 chars) or quarters (10 chars) if the site can't accept a 40 char password. Also I can add a period on the end if the site requires special chars. These are strong passwords and unique for each site. Works great on W…

echo -n "A long sentence I can recall. site_name" | openssl dgst -sha1

For those with openssl.

Post reply on HN