10 ms·
I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then rem
by oelmekki 9y ago
I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that.
Currently, my way to generate a new password is this : `pwgen | md5sum`. And then, I use "lost password" everywhere (but for my mailbox, obviously), that is, the rare times my browser is not already prefilling the login form.
This makes me wonder why we don't just go with that : generate a random password for the user in registration form, allow the browser to save it. On the login form, check if fields are prefilled. If not, only display an email field and send an auth link as mail. User clicking it (once, and fast enough) is logged in.
You still have to remember your mailbox password, but that's the only one, quite akin the root password of a server.
- belzebub 9y agoEmail address is stupid, we should have randomly generated proxy email addresses.
- thephyber 9y agoA former coworker makes liberal use of American Express disposable credit card numbers -- proxy credit card numbers that you can request to give away to less than trustworthy merchants.
- jacobwg 9y agoPrivacy (https://privacy.com/ https://privacy.com/) offers a similar service for those that want something that works with more than American Express cards or other such offerings from other card issuers.
- tatersolid 9y agoMy Citibank card has the same feature, although the number generation applet requires Flash. On a banking website. In mid-2017.
- dabber 9y agoEmail addresses have been working fine for me. What I would love though is a way to easily alias my phone number.
- Poc 9y agoI personally use KeePass, I generate 20+ character random passwords and it save them in a encrypted file. I just wrote my email password and hide it in case I lose my file.
- dEnigma 9y agoI also use KeePass to generate long, pseudo-random passwords. The amount of different passwords I need is far beyond what I can hold in my head, especially when they have to be secure. I got my closest family to use KeePass too, which lead to a significant reduction in lost passwords and hacked accounts.
- lorenzk 9y agoWhy pipe to md5sum?
- YSFEJ4SWJUVU6 9y agoTo format the password I guess? pwgen sounds like a command that might be able to do that, too, though, but I wouldn't know. Anyway, as far as password creation goes, here's another alternative based on more standard tools: head -c NN /dev/urandom | base32 # or base64, or md5sum if you so prefer
- oelmekki 9y agoI could just pass an option to make pwgen generate longer passwords, really, but I find amusing the idea of generating the hash of 160 urandom level generated passwords :) Now that's random! Oh, and also, it looks like a hashed password, so special troll points if a cracker find the password and think it's its hash. (note for people who may not know pwgen : it outputs 20 lines of 8 random passwords)
- agwa 9y ago> (note for people who may not know pwgen : it outputs 20 lines of 8 random passwords) Unfortunately, it only does this if STDOUT is a TTY. If it's a pipe, then it outputs a single 8 character long password. So I'm afraid you've been generating rather low entropy passwords by piping the output of pwgen through md5sum. You can confirm this by piping pwgen through cat: pwgen | cat
- lathiat 9y agoi simultaneously love and loathe programs that do this, I long for some kind of shell pipe negotiation. Most annoying trying to use "watch" or "less" and have the color work. "watch --color juju status --color", ahh. :-)
- agwa 9y agoHaving used isatty in some of my CLI programs to alter the behavior depending on whether STDOUT is a TTY, I see the appeal. It allows the program to do the best thing depending on how it's being invoked. However, more recently I've grown skeptical. It leads to surprises, and if a person isn't familiar with the finer details of file descriptors, they may wonder why piping a program changes its behavior. I think this example of someone shooting himself in the foot with pwgen has convinced me never to do this again.
- Franciscouzo 9y agoJust use pwgen 32 instead
- deleted 9y ago[deleted]
- peterwwillis 9y agoProblems: 1) email is insecure, 2) it requires two logins, 3) it's not dual factor, 4) it's more error-prone. It's less work [and more secure] to just implement Google or Facebook authentication. In terms of generating a strong password: most browsers have password generators (which I didn't even know about until recently). They aren't all enabled by default and they don't work on all forms, and not all browsers have them. Browsers also have supported user certificates [which are more secure than passwords, sort of] for like 15 years, but nobody ever uses them. The main reason (afaik) is how shit the browser's UX for them was, in combination with a burden of complexity - and of course you can't use them on random public devices. I think we are close to reaching an authentication nirvana. If U2F came embedded in all new computing devices, and an open method of securely synchronizing all devices and service providers was used, we could effectively skip passwords, and rely almost entirely on backup codes for the few times they were needed. A lot of laptops and phones come with fingerprint scanners now. If those scanners were used as part of a U2F solution we would have a pretty solid authentication mechanism. (fingerprints are not foolproof, but IMHO they are about as secure as a password)
- hippich 9y agochrome already does that (but i still stick with keepass)
- ShinTakuya 9y agoOr, you know, you can just use a password manager. Using forgot password all over the place is a bad idea, a lot of sites send you a temporary password that people can find in your emails if they ever hack your emails. Pick a really good password for your password manager and remember that. Doesn't matter too much which password manager. If you're paranoid use KeePass, otherwise I personally use LastPass.
- oelmekki 9y agoIf someone access my mailbox, they'll use lost password to access other websites :)
- dredmorbius 9y agoSo long as you're hashing the output, go straight to the source. And if you're going to hash, use a longer hash. dd if=/dev/urandom bs=2048 count=1 | od -A none -l | sha512sum Or just generate a long password: pwgen 2048 1