6 ms·

> changing my passwords every 30 days is looking less and less important. Using some non-English Unicode text as password will make the password really strong.

> changing my passwords every 30 days is looking less and less important. Using some non-English Unicode text as password will make the password really strong. I sometimes include Malayalam text for passwords as it's my native language.

jeffjose 9y ago
Or made up Malayalam words such as Melcow!
- sundvor 9y ago
  cs91PvMVtET37V%eKEMut0LI^kQYp3e&jSuCGl!9Lp Lastpass.
  - hunter2_ 9y ago
    All I see are asterisks, weird.
    - sundvor 9y ago
      Oh. I just grabbed what would have been my next random 42 character password, hoping that would be sufficient to prove the point that (almost) ridiculously long one time use passwords is the way to go.
    - firebones 9y ago
      Bravo. Masterclass username for this comment. I'm dying. (For those who may have missed it in this HN crowd, let me momentarily invoke a veil of joke-explainer and offer this http://knowyourmeme.com/memes/hunter2 http://knowyourmeme.com/memes/hunter2 of the joke.)
      - sundvor 9y ago
        Haha, I've been around for a while but that one I missed. Awesome.
        firebones 9y ago
        HackerNews: Where the subtlety of a comment's humor is inversely proportional to the size of the cognitive DDOS it initiates.
    - dotancohen 9y ago
      Appropriate username indeed!
tuxracer 9y ago
Then oauth based attacks like this come along and your password (however strong it may be) and two-factor auth are bypassed completely... It's interesting Apple can scale personally vetting apps for the app store but Google apparently can't be bothered to do the same for apps that could actually ruin businesses and lives with the data they could scoop up
- AstralStorm 9y ago
  It is not quite a virus, it works more akin to a trojan and exploits people not thinking about what they're clicking. In 10s, why would Google docs ask for an oAuth prompt with big permissions? People click through security dialogs, it is a known fact.
  - SonOfLilit 9y ago
    Funny that you'd ask that, as when developing Google Script automation scripts, Google Docs asks for exactly that. (Of course, this is a different situation and all, and there is a lot of sense in your comment that mine doesn't at all invalidate.)

jeffjose 9y ago

Or made up Malayalam words such as Melcow!

sundvor 9y ago
cs91PvMVtET37V%eKEMut0LI^kQYp3e&jSuCGl!9Lp Lastpass.
- hunter2_ 9y ago
  All I see are asterisks, weird.
  - sundvor 9y ago
    Oh. I just grabbed what would have been my next random 42 character password, hoping that would be sufficient to prove the point that (almost) ridiculously long one time use passwords is the way to go.
  - firebones 9y ago
    Bravo. Masterclass username for this comment. I'm dying. (For those who may have missed it in this HN crowd, let me momentarily invoke a veil of joke-explainer and offer this http://knowyourmeme.com/memes/hunter2 http://knowyourmeme.com/memes/hunter2 of the joke.)
    - sundvor 9y ago
      Haha, I've been around for a while but that one I missed. Awesome.
      - firebones 9y ago
        HackerNews: Where the subtlety of a comment's humor is inversely proportional to the size of the cognitive DDOS it initiates.
  - dotancohen 9y ago
    Appropriate username indeed!

tuxracer 9y ago

Then oauth based attacks like this come along and your password (however strong it may be) and two-factor auth are bypassed completely... It's interesting Apple can scale personally vetting apps for the app store but Google apparently can't be bothered to do the same for apps that could actually ruin businesses and lives with the data they could scoop up

AstralStorm 9y ago
It is not quite a virus, it works more akin to a trojan and exploits people not thinking about what they're clicking. In 10s, why would Google docs ask for an oAuth prompt with big permissions? People click through security dialogs, it is a known fact.
- SonOfLilit 9y ago
  Funny that you'd ask that, as when developing Google Script automation scripts, Google Docs asks for exactly that. (Of course, this is a different situation and all, and there is a lot of sense in your comment that mine doesn't at all invalidate.)