7 ms·

Proves me once again that the best password vault is sitting on my shoulders.

by Jdam 9y ago

alien_at_work 9y ago
How does that work? With Keychain I literally have a different password on every single site I visit. If someone hacks Facebook they'll have... my Facebook password (and whatever sites use OAuth and won't let me opt out of it). Does your brain consistently handle that level of password diversification, because that's the best defense against password theft.
- heavymark 9y ago
  Agreed. Though always does come down to the weakest link. Such as if a person had access to just your email account password then they could reset most any other password on other accounts you have in the middle of the night while you slept. Which is why 2 factor on your email is most important though, depending on what software/methods you use for 2 factor always a chance that could be bypassed. Also if someone gains physical access to your device(s) while you are in the bathroom or what not, if they know your laptop password which is usually something easy to remember, then they have access to all your keychain passwords no matter how complex each of them are. Still million times better than attempting to memorize custom passwords for each site, since most people will just have one password, and will add a few characters based on the site name/domain which can also easily be cracked.
- Waterluvian 9y ago
  For many years now I've used an algorithm for password generation that I keep in my head. It's pretty simple, I have a memorized string (like a traditional password), and a memorized set of rules. For example, I might have a rule where I take my password, replace the first character with the first character of the product (a for Amazon), and replace the last letter with the type of product I'm using (s for shopping). I have a significantly more complex algorithm than that, but you get the idea. Every password I have is different, but they're all trivial to remember. This isn't super hardcore security, but it helps me have like 40 passwords that are all different.
  - ZoFreX 9y ago
    And how many of your passwords need to leak for that scheme to be completely transparent?
  - snowwolf 9y ago
    So your password has a root password and probably 2-4 pseudo random characters appended/prepended/replaced? That means once it has been leaked in 1 breach, your 'true' algorithmic password is only 2-4 characters long. Which should take a few minutes to crack on other sites. And the more breaches you are included in, the easier it would be to work out your algorithm, reducing the number of attempts further. But they aren't going to target me specifically? They won't. They just find everyone whose password across multiple breaches is similar (Levenshtein distance or something) and brute force the differences.
    - Santosh83 9y ago
      > But they aren't going to target me specifically? They won't. They just find everyone whose password across multiple breaches is similar (Levenshtein distance or something) and brute force the differences. Is this possible when the leaked passwords are all only salted hashes?
      - snowwolf 9y ago
        You mean like LinkedIn (SHA1 hashes without salt), Adobe (Poor Crypto), Dropbox (half of them SHA1), etc., etc. [1] https://haveibeenpwned.com/PwnedWebsites#LinkedIn https://haveibeenpwned.com/PwnedWebsites#LinkedIn [2] https://haveibeenpwned.com/PwnedWebsites#Adobe https://haveibeenpwned.com/PwnedWebsites#Adobe [3] https://haveibeenpwned.com/PwnedWebsites#Dropbox https://haveibeenpwned.com/PwnedWebsites#Dropbox
      - arghwhat 9y ago
        No, but not everyone follow good crypto practices...
  - Santosh83 9y ago
    I did this too, back when I had to use public terminals and obviously could not use password managers. But the idiosyncrasies of password rules on many sites added to the complexity of my own "transformation" of the base password, until the whole thing while workable, became burdensome. These days I do all logging in on my own PC and therefore I see no real need not to use a password manager and unique, random passwords for each site. The obvious downside to this approach is if I were ever to be caught in a situation where I MUST log in to some site but do not have access to my PC AND phone, and therefore cannot risk opening the password DB on an alien system. Pretty unlikely scenario though.
- bjt2n3904 9y ago
  For web accounts I don't care about, a password manager seems to be handy. But for things like bank and email, I don't particularly trust a password manager. "CorrectHorseBatteryStaple" isn't too difficult to remember, and is plenty secure.
moxious 9y ago
Even memory is a tradeoff. Assuming excellent memory, even then people won't use 20 character passwords because they're too hard to type precisely. The ability to store/copy/paste passwords makes for stronger passwords because size and complexity just doesn't matter
- adekok 9y ago
  > people won't use 20 character passwords because they're too hard to type precisely. I have friends who do this. They set huge passwords for "security", and then can't type them consistently, or forget them, and have to reset the password. Then they complain about their accounts getting locked. I can't convince them that a shorter password is still secure, and will remove much of the aggravation.
  - hellofunk 9y ago
    How much shorter? Password security is related to the length of a password.
monochromatic 9y ago
That’s not a very good solution either.
hellofunk 9y ago
This is highly irresponsible advice (if your comment may be construed as advice). If it isn't advice, then it's just a bad idea.
amazingman 9y ago
Confirmation bias is a powerful thing.

Proves me once again that the best password vault is sitting on my shoulders.

by Jdam 9y ago

Proves me once again that the best password vault is sitting on my shoulders.

How does that work? With Keychain I literally have a different password on every single site I visit. If someone hacks Facebook they'll have... my Facebook password (and whatever sites use OAuth and won't let me opt out of it). Does your brain consistently handle that level of password diversification, because that's the best defense against password theft.

heavymark 9y ago
Agreed. Though always does come down to the weakest link. Such as if a person had access to just your email account password then they could reset most any other password on other accounts you have in the middle of the night while you slept. Which is why 2 factor on your email is most important though, depending on what software/methods you use for 2 factor always a chance that could be bypassed. Also if someone gains physical access to your device(s) while you are in the bathroom or what not, if they know your laptop password which is usually something easy to remember, then they have access to all your keychain passwords no matter how complex each of them are. Still million times better than attempting to memorize custom passwords for each site, since most people will just have one password, and will add a few characters based on the site name/domain which can also easily be cracked.
Waterluvian 9y ago
For many years now I've used an algorithm for password generation that I keep in my head. It's pretty simple, I have a memorized string (like a traditional password), and a memorized set of rules. For example, I might have a rule where I take my password, replace the first character with the first character of the product (a for Amazon), and replace the last letter with the type of product I'm using (s for shopping). I have a significantly more complex algorithm than that, but you get the idea. Every password I have is different, but they're all trivial to remember. This isn't super hardcore security, but it helps me have like 40 passwords that are all different.
- ZoFreX 9y ago
  And how many of your passwords need to leak for that scheme to be completely transparent?
- snowwolf 9y ago
  So your password has a root password and probably 2-4 pseudo random characters appended/prepended/replaced? That means once it has been leaked in 1 breach, your 'true' algorithmic password is only 2-4 characters long. Which should take a few minutes to crack on other sites. And the more breaches you are included in, the easier it would be to work out your algorithm, reducing the number of attempts further. But they aren't going to target me specifically? They won't. They just find everyone whose password across multiple breaches is similar (Levenshtein distance or something) and brute force the differences.
  - Santosh83 9y ago
    > But they aren't going to target me specifically? They won't. They just find everyone whose password across multiple breaches is similar (Levenshtein distance or something) and brute force the differences. Is this possible when the leaked passwords are all only salted hashes?
    - snowwolf 9y ago
      You mean like LinkedIn (SHA1 hashes without salt), Adobe (Poor Crypto), Dropbox (half of them SHA1), etc., etc. [1] https://haveibeenpwned.com/PwnedWebsites#LinkedIn https://haveibeenpwned.com/PwnedWebsites#LinkedIn [2] https://haveibeenpwned.com/PwnedWebsites#Adobe https://haveibeenpwned.com/PwnedWebsites#Adobe [3] https://haveibeenpwned.com/PwnedWebsites#Dropbox https://haveibeenpwned.com/PwnedWebsites#Dropbox
    - arghwhat 9y ago
      No, but not everyone follow good crypto practices...
- Santosh83 9y ago
  I did this too, back when I had to use public terminals and obviously could not use password managers. But the idiosyncrasies of password rules on many sites added to the complexity of my own "transformation" of the base password, until the whole thing while workable, became burdensome. These days I do all logging in on my own PC and therefore I see no real need not to use a password manager and unique, random passwords for each site. The obvious downside to this approach is if I were ever to be caught in a situation where I MUST log in to some site but do not have access to my PC AND phone, and therefore cannot risk opening the password DB on an alien system. Pretty unlikely scenario though.
bjt2n3904 9y ago
For web accounts I don't care about, a password manager seems to be handy. But for things like bank and email, I don't particularly trust a password manager. "CorrectHorseBatteryStaple" isn't too difficult to remember, and is plenty secure.

moxious 9y ago

Even memory is a tradeoff. Assuming excellent memory, even then people won't use 20 character passwords because they're too hard to type precisely. The ability to store/copy/paste passwords makes for stronger passwords because size and complexity just doesn't matter

adekok 9y ago
> people won't use 20 character passwords because they're too hard to type precisely. I have friends who do this. They set huge passwords for "security", and then can't type them consistently, or forget them, and have to reset the password. Then they complain about their accounts getting locked. I can't convince them that a shorter password is still secure, and will remove much of the aggravation.
- hellofunk 9y ago
  How much shorter? Password security is related to the length of a password.

monochromatic 9y ago

That’s not a very good solution either.

hellofunk 9y ago

This is highly irresponsible advice (if your comment may be construed as advice). If it isn't advice, then it's just a bad idea.

amazingman 9y ago

Confirmation bias is a powerful thing.