7 ms·
A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ https://lastpass.com/ for generating passwords. $12/year and works on Linux & A
by edent 10y ago
A unique password, 2FA, AND a unique email address.
I use https://lastpass.com/ https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions.
For 2FA I use either SMS or Authy https://www.authy.com/ https://www.authy.com/ Take a look at https://www.turnon2fa.com/ https://www.turnon2fa.com/ to see which sites support 2FA.
It does make logging in to some frequently used sites a bit of a pain (looking at you PayPal!) but I think it is worth it.
On to unique email addresses. I do this for two reasons.
1. Allows me to easily see where an email has come from & filter if necessary. I can tell if your company has leaked / lost / sold my address.
2. If I have reused a password, a database leak doesn't compromise other sites. An attacker doesn't know the login details for LinkedIn based on my GoToMyPC email.
I tend to use something like lnkdn@ mydomain / gtmypc@ ... / twttr@ ... - but if your mail provider lets you use a catch-all, it can be anything you like.
One word of warning - it really confuses people when you give the email over the phone! I usually say "I'm creating a unique email address for you so that the message doesn't go into spam. Ok? sound of me hitting random keys It's yourcompany@ ...."
- jagermo 10y agoHa, just like my setup. And yes, it does confuse people, to a lot of them it seems like magic.
- acmecorps 10y agoGood idea on (2). I have a gmail account, so I just use myaccount+whatever_service@gmail.com. Pretty handy.
- tonmoy 10y agoIf a lot of people start doing this thing, then it will be trivial for an attacker to figure out name+service1@domain can be changed to name+service2@domain
- ethbro 10y agoSame argument for port knocking. Absolutely ineffective against targeted attacks, but most attacks aren't customized and targeted.
- EdHominem 10y agoIt also cuts down on the attack surface enough to let you use more active alerting.
- rzzzt 10y ago"service1" could be generated randomly as well, and stored along with the password in a password manager. Another nice property of this suffix is that one can identify who gave away their email address / which site it was scraped from when receiving spam; not sure where I have seen this written down originally.
- drdaeman 10y agoI think when spammers see a "+" they just strip everything after it down, i.e. me+spam@example.org -> me@example.org. Not to say many sites just don't accept "+" (or, worse, cease to accept such addresses). Unique, non-guessable, machine-generated addresses are the way to go (do with emails just like password managers do with passwords), but no common person can use those, because they'll need a domain and self-hosted MDA. E.g. $ echo "$(echo -en "secretsalt\nsome.example.net" | sha1sum -b | xxd -r -p | base36 | cut -c-8)@me.example.org" h6t8490d@me.example.org Or just generating random IDs and maintaining the database. (Sure, HMAC would be a better idea than this string concatenation, but meh...)
- tonmoy 10y agoThen I could just make my rand(service1) chars larger. No point in adding it to email address at all. Email leak (privacy) is an issue that this could help with but I do not see any benefit in terms of securing my account
- lukasm 10y agoHow do you generate new emails? Say, I see a new websites I need a new email? What do you do? Is there a chrome extension that can do it with one click?
- StavrosK 10y agoI use 33mail.com. You just give them a new email address, no need to generate. For example, hackernews@lukasm.33mail.com
- robotmlg 10y agoGmail doesn't need any config. Add whatever you want to your usual email after a + and it'll just work
- lukasm 10y agoYeah but doesn't prevent the attack. Username is still in the email address. Ideally I'd like <domain>+<nonce>@gmail.com that forwards all to my email.
- stephengillie 10y agoMy personal domain is set to forward all email to my Gmail. Since Google is my registrar, it's expectedly simple to configure this. I haven't setup outbound addresses; services rarely need email sent to them, and replying from my Gmail hasn't caused me any problems yet.
- 0xmohit 10y ago> I use https://lastpass.com/ https://lastpass.com/ for generating passwords. ... Would prefer open source, but nothing else comes close. On a linux/unix system, one could use /dev/urandom: tr -dc '[[:alnum:][:punct:]]' < /dev/urandom | head -16c would generate a 16 character long password. One could even put the following function in $HOME/.bash_profile or such genpw() { tr -dc '[[:alnum:][:punct:]]' < /dev/urandom | head -${1-16}c } Now invoking it by saying genpw would generate a pseudorandom string of 16 characters length. You could specify the length by passing a parameter to it, e.g. genpw 8.
- EasyTiger_ 10y agoAre you implying this comes close to the convenience of LastPass?
- 0xmohit 10y agoSorry, haven't used LastPass myself. But as far as generating a random password goes, this would be pretty effective.
- deleted 10y ago[deleted]
- jrnichols 10y agoUbuntu has "apg" which I think does something similar. https://help.ubuntu.com/community/StrongPasswords https://help.ubuntu.com/community/StrongPasswords
- edent 10y agoO...K... but where do you store them? How do you sync them between devices? How do you auto fill them in the browser? How do you change them when a service is compromised? How do you securely share them with other users? LastPass does all of that. And I don't even have to drop into the terminal.
- kbaker 10y agopwgen already exists, working exactly like you were thinking. $ pwgen 16 1 siaJa9fohnie9aew Though, you should use lastpass or similar for many other reasons. Not just generating passwords, but for managing them.
- roddux 10y agoKeePassX (https://www.keepassx.org/ https://www.keepassx.org/) is free and open source password manager. Having never tried LastPass I can't vouch that it's feature compatible, but it covers all my needs.
- StavrosK 10y agoI tried both (switched from LastPass to KeePassX). KeePassX works better, especially with KeePass2Android. Strongly recommended.
- edent 10y agoI did look at KeePassX - but it doesn't seem to have reliable autofill in Chrome & Firefox (where I use 99% of my passwords). It also means I have to manually synchronise the database between phone, PC, etc. The hunt continues!
- vladimir-y 10y ago> I did look at KeePassX - but it doesn't seem to have reliable autofill in Chrome & Firefox It does have browser integration, for both Chrome - ChromeIPass extension, and Firefox - KeeFox extension. Both extension work via KeePassHttp plugin. Works well on Arch Linux.
- vladimir-y 10y agoI meant KeePass http://keepass.info/ http://keepass.info/ writing about browser integration (in my case I run it on mono), not the KeePassX. KeePassX is a very simple app in comparison with KeePass, so I prefer KeePass over KeePassX.
- tripzilch 10y agoI just keep the keepass.db file in a cloud storage folder that is synced across devices. Works perfectly and because of the encryption it hardly even matters that cloud storage is (currently) on a US server. The "perform autotype" option in KeepassX Linux seems to work well enough for me in Firefox, Chromium and most applications (it basically seems to send <user><TAB><password><ENTER> which usually does the trick--and afaik it has some settings you can tweak when it doesnt, but I never bothered with those). But if Lastpass works for you, that's cool. Getting to use a password manager in the first place is the most important step, IMHO.
- chmars 10y agoI am switching away from unique mail addresses … I used a mix of catch-all and plus characters: The former reduces the efficiency of your spam filter, the later is not (fully) supported by many websites. AirBnB for example allowed me to set an mail address with a plus character, however, login did not work anymore, so I was locked out and had to create a new account … AirBnB support refused to change my mail address since they apparently did not get the plus character 'trick'.
- mistersquid 10y agoAdd grep whitelist to your spam filter for some arbitrary extension, e.g. a tld such as '.com'. This way the address can be some-web-app.somecompany.com@yourdomain.tld, you can whitelist *.com@ (or higher up on the subdomain if necessary). Not sure if this would maintain the efficiency of your (or any) spam filter, but it does avoid the '+' character.
- bronson 10y agoIn my experience adding the domain of the recipient often leads to problems. Rep: "Can you verify your email address?" Me: "er, em-verizon@example.com" Rep: "Hey, I didn't know you worked for Verizon!" Me: "no..." And now the call gets excruciatingly slow and unfriendly because the rep thinks I'm trying to hack something. Also, more than one web forum has silently binned me until I removed the domain from my email address. Had one where I could post for a few days, then the admin deleted me and sent that email address a crazy anti-spam rant thinking I was a bot. I still like using unique email addresses but I make sure they're obscure.
- dreamcompiler 10y agoI use the domain backwards e.g. nozirev@mydomain.com.Customer service agents don't notice, and it's easy for me to tell where the email was supposed to have originated.
- gregmac 10y agoYep, I highly recommend LastPass as well. The password generation, sync, platform support, and browser extension features are great. It's fairly easy to setup exclusion filters for not remembering passwords, as well as controlling if matching works on the first level domain (*.domain.com) or exact host.. The former generally works well for most sites, but the latter is essential for my own domains (where I have multiple different services, accounts for testing, etc). I've been using a catch all domain for at least 15 years. One thing I learned early is to use a subdomain, which avoids getting dictionary spam attacks. For the last many years, I just forward it to a gmail account, where there is a corresponding filter to label it into an "accounts" group. I get essentially zero spam to this. Also, I've had multiple times where it confused reps as well. It's kind of funny when it happens, but also sad that having "theircompany@sub.my domain.com" makes them go "oh, did you used to work here or something?".
- tripzilch 10y ago> For the last many years, I just forward it to a gmail account How do you do this?
- hackuser 10y ago> I use https://lastpass.com/ https://lastpass.com/ I feel like it's almost certain that Lastpass is owned, as are other popular online password stores. No security is perfect; all you can do is make it more expensive than it's worth to the attacker. How much would it be worth to have all the passwords to every account of every Lastpass user? Does Lastpass really have the resources and skill to protect something that valuable? Is it even possible?
- mhurron 10y agoWell as long as you 'feel' that way, it must be true. Lastpass (supposedly) stores the encrypted password vault, never the decrypted. Decryption occurs on the users end. You would need to either have a keylogger on the target users machine to grab their master password, or compromise the software. Neither is impossible, but both are a little harder than simply break in and access Lastpass's storage. I say supposedly because I do not know of any 3rd party verification.
- hackuser 10y agoI didn't make that claim; why add that attitude to an otherwise pleasant conversation? When disagreeing, please reply to the argument instead of calling names. E.g. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- mhurron 10y agoYes you did make that claim. You said that you feel there is a high likelihood that lastpass is compromised. You have no evidence or proof of this, just a gut feeling presented as some sort of fact or 'just asking questions.' "I feel like it's almost certain that Lastpass is owned"
- SnacksOnAPlane 10y agoI use LastPass, but I'm still fearful about it. It's such a rich target, and all a hacker would really have to do is to intercept when you put your decryption key in and send it off to their own server. Then they'd have access to all your accounts. They'd have to put that backdoor into the extension, but the point is, it's doable, and most people wouldn't have any way of knowing that it happened.
- Mandatum 10y agoWhat provider do you use that allows for catch-all? I really like GMail but the lack of support is really annoying, and a lot of sites & dump leaks are beginning to ignore the "+word" notation for email addresses.