4 ms·

security 101 - use different passwords for everything.

by axod 17y ago

rmorrison 17y ago
1password
viraptor 17y ago
Good idea in theory. Unfortunately every serious person doing programming / administration / ... will have at least 20 accounts on the internet (probably underestimated!: email, other email, HN, sourceforge, github, facebook, own pc, own pc admin, vps, stackoverflow, etc. etc.) At some point it's not possible to remember them all anymore... You have a choice of storing them with master password (now I can get all of them in one file), using the same one, having a password scheme (like usualpwd_HN, usualpwd_gmail, ...) or ... ? Edit: what I started doing is setting random password that I will not remember and just requesting a reset when I get logged out.
- bugs 17y ago
  You could use a password scheme for sites you don't really care much about and stronger separate passwords for important and often used sites. I do this and it works out well and if you use the important sites enough you will and do remember your strong passwords but for the ones you don't you always can reset your password by email which isn't that inconvenient if you think about how often you are accessing the website that you cannot remember your password.
- axod 17y ago
  ...or... writing a simple script that given a key, generates you a password based on it. I probably have 50+ passwords at least, and every one is different. I just run my little script with a "key" and it tells me the password. And of course browsers remember them anyway. eg ./get_my_password.sh mygmail ./get_my_password.sh server_1_mysql_root I think 1password etc do similar things though.
  - Groxx 17y ago
    1password uses 128-bit AES, based on your master password. Intelligently, they didn't write their own encryption. Of course, we wanted to avoid writing this code in the Agile Keychain and elected to use the OpenSSL function PKCS5_PBKDF2_HMAC_SHA1 to generate the keys. Key generation is simply too important a step to not rely directly on the experts. In order to thwart would-be attackers and strengthen the key, we elected to use 1000 iterations in the PBKDF2 algorithm. http://help.agile.ws/1Password3/agile_keychain_design.html http://help.agile.ws/1Password3/agile_keychain_design.html
- swombat 17y ago
  I used a password manager, and I have a different password for every single service that I'm signed onto. If you're using similar passwords for all the services you're signed onto, it's pure hypocrisy to turn around and criticise Rackspace for "poor security". The single point of failure is you.
ErrantX 17y ago
Another security 101: assume your users insist on using the same password for everything

security 101 - use different passwords for everything.

by axod 17y ago

security 101 - use different passwords for everything.

rmorrison 17y ago

1password

viraptor 17y ago

Good idea in theory. Unfortunately every serious person doing programming / administration / ... will have at least 20 accounts on the internet (probably underestimated!: email, other email, HN, sourceforge, github, facebook, own pc, own pc admin, vps, stackoverflow, etc. etc.) At some point it's not possible to remember them all anymore... You have a choice of storing them with master password (now I can get all of them in one file), using the same one, having a password scheme (like usualpwd_HN, usualpwd_gmail, ...) or ... ? Edit: what I started doing is setting random password that I will not remember and just requesting a reset when I get logged out.

bugs 17y ago
You could use a password scheme for sites you don't really care much about and stronger separate passwords for important and often used sites. I do this and it works out well and if you use the important sites enough you will and do remember your strong passwords but for the ones you don't you always can reset your password by email which isn't that inconvenient if you think about how often you are accessing the website that you cannot remember your password.
axod 17y ago
...or... writing a simple script that given a key, generates you a password based on it. I probably have 50+ passwords at least, and every one is different. I just run my little script with a "key" and it tells me the password. And of course browsers remember them anyway. eg ./get_my_password.sh mygmail ./get_my_password.sh server_1_mysql_root I think 1password etc do similar things though.
- Groxx 17y ago
  1password uses 128-bit AES, based on your master password. Intelligently, they didn't write their own encryption. Of course, we wanted to avoid writing this code in the Agile Keychain and elected to use the OpenSSL function PKCS5_PBKDF2_HMAC_SHA1 to generate the keys. Key generation is simply too important a step to not rely directly on the experts. In order to thwart would-be attackers and strengthen the key, we elected to use 1000 iterations in the PBKDF2 algorithm. http://help.agile.ws/1Password3/agile_keychain_design.html http://help.agile.ws/1Password3/agile_keychain_design.html
swombat 17y ago
I used a password manager, and I have a different password for every single service that I'm signed onto. If you're using similar passwords for all the services you're signed onto, it's pure hypocrisy to turn around and criticise Rackspace for "poor security". The single point of failure is you.

ErrantX 17y ago

Another security 101: assume your users insist on using the same password for everything