2 ms·

Don't reuse your passwords. You've heard it repeated over and over again. I do believe that is the solution. Now, of course, I do reuse. But other than the abo

by romland 17y ago

Don't reuse your passwords. You've heard it repeated over and over again. I do believe that is the solution. Now, of course, I do reuse. But other than the above I just don't see a solution to this particular problem. Filtering both the username and password in the logs? It wouldn't make -me- feel any safer when I log onto that Xbox hacker forum. I worry about the administrator of the site having access to my passwords. Not any possible hackers that might wander by. PS. There are tools out there that will fill in username and password depending on URL. Of course, that gives another attack vector...

ErrantX 17y ago
It's just people I guess. The thing is that working as a hacker (white hat) has made me actually less worried about my bad security habits. It's like real life. If your sane in your habits and stay alert not much is likely to happen. It's like insurance. You only insure as much as you feel is at potential risk; once the cost of insurance outweighs the risk you (should) stop paying. Same with your passwords; the risk of losing them is fairly minimal. If someone wants to get them really bad they will do, not a lot you can ultimately do to stop them. Reasonable vigilance should be enough to keep you secure. (and by that I mean having enough sense that when XYZ site's password database is compromised you change things etc.)
- romland 17y ago
  Agreed. As far as I know my password has been "stolen" once in my life -- and that was due to a compromised shell at my ISP. And that's the kicker: _as far as I know_. All the other times (should there be any) I just wouldn't know because I didn't care. And now that I read back my comment, it kind of looks as if I was just trying to take a cheap stab at your comment. It wasn't the case. I genuinely spent a moment to think about whether there would be a viable solution to the problem at this level. :) Now, getting rid of passwords altogether... (I dislike people who say you can't solve this -- and here I go doing it myself!)
illumin8 17y ago
A really good way to do this is to just reuse your password on every site, but add a site specific string to it. For example, your HN password becomes passwordhn. That way you can pretty safely reuse your password without putting your other accounts at as great of a risk.

by romland 17y ago

ErrantX 17y ago

It's just people I guess. The thing is that working as a hacker (white hat) has made me actually less worried about my bad security habits. It's like real life. If your sane in your habits and stay alert not much is likely to happen. It's like insurance. You only insure as much as you feel is at potential risk; once the cost of insurance outweighs the risk you (should) stop paying. Same with your passwords; the risk of losing them is fairly minimal. If someone wants to get them really bad they will do, not a lot you can ultimately do to stop them. Reasonable vigilance should be enough to keep you secure. (and by that I mean having enough sense that when XYZ site's password database is compromised you change things etc.)

romland 17y ago
Agreed. As far as I know my password has been "stolen" once in my life -- and that was due to a compromised shell at my ISP. And that's the kicker: _as far as I know_. All the other times (should there be any) I just wouldn't know because I didn't care. And now that I read back my comment, it kind of looks as if I was just trying to take a cheap stab at your comment. It wasn't the case. I genuinely spent a moment to think about whether there would be a viable solution to the problem at this level. :) Now, getting rid of passwords altogether... (I dislike people who say you can't solve this -- and here I go doing it myself!)

illumin8 17y ago

A really good way to do this is to just reuse your password on every site, but add a site specific string to it. For example, your HN password becomes passwordhn. That way you can pretty safely reuse your password without putting your other accounts at as great of a risk.