5 ms·
Password Reuse
- nostrademons 16y agoActually, a company-wide Starcraft 2 tournament is more likely. Oh wait, we just finished one of those last week. And then had HDStarcraft come and cast the finals.
- AndyKelley 16y agoI thought of this 9 years ago, and got stuck at the same step as the hat guy. Once you have the login details, then what? The only thing you can really do with the information is be a giant douchebag, and that's not cool.
- tomjen3 16y agoSteal the accounts, use it to make money and blow it all on high class escorts. People claim money won't make them happy. That is because they buy the wrong things...
- anedisi 16y agoafter someone hacked my paypal acc i have simple algorithm that i can calculate in my head for my passwords.
- troels 16y agoPick a line from a song. Easy to remember, (neigh) impossible to brute force.
- danbmil99 16y agoproblem is, Google will not remain non-evil forever. The public market has a way of corrupting the soul of a company.
- jrockway 16y agoWhat are they going to do after they turn evil? Play CoD4 on the lobby TV? (Yup, I read all the way to the end.)
- loewenskind 16y agoWhat makes you think they're non-evil now? Because they say so?
- tommynazareth 16y agoCan anyone suggest decent password manager that would have the advantages of being cloud based without the risk of someone stealing my passwords?
- hugoroy 16y agoI think that Firefox, or any good browser with a sync feature, can be a good password manager.
- d4nt 16y agoI use KeyPassX on Dropbox. It works, kind of.
- edanm 16y agoI personally use KeePass, which isn't cloud-based, but I drop the database file into my Dropbox. I also have a copy of KeePass portable and my database on a disk-on-key which I keep on my keychain. This isn't usually up-to-date, but it does have the most important stuff in there. I wrote a bit about KeePass and various tricks here, if you're interested: http://www.loopycode.com/solving-sign-up-anxiety/ http://www.loopycode.com/solving-sign-up-anxiety/.
- VMG 16y agoI use pwsafe over ssh on a remote host. Not decent but one option.
- pietrofmaggi 16y ago1Password from AgileWeb Solutions: http://agilewebsolutions.com/onepassword http://agilewebsolutions.com/onepassword And then sync the data in the cloud with dropbox: http://help.agile.ws/1Password3/cloud_syncing_with_dropbox.html http://help.agile.ws/1Password3/cloud_syncing_with_dropbox.h... 1Password is integrated in the browser using a plugin (mainly safari under OS X, where it started, but I use it with Chrome with no problem). Highly recommended
- brown9-2 16y agoPasswordSafe on a dropbox shared folder works great: http://passwordsafe.sourceforge.net/ http://passwordsafe.sourceforge.net/
- forensic 16y agoI often wonder why this hasn't already happened on a massive scale. I figure a bunch of Russian and Chinese hackers are skimming off cents at a time or something because they don't want to kill their golden goose by being too overt.
- jasonkester 16y agoThe fun part is that password complexity makes this problem worse, not better. People use the same user/pass combo for every site they visit, except when one of them forces them to use a complicated password that they can't remember. So they send themselves an email with the site name, username and password so that they can find it next time they need to log into their bank. So once your registry cleaning website has their email password, you also have a nice list of all their strong passwords too. Adding to the irony, most people know that they need a different password for their bank, so if you just let them pick one without forcing complexity, they'll choose something they can remember, and their bank account will be safe.
- dstik 16y agoBut letting them pick a password without forced complexity makes it significantly easier to crack their password using one of the various, comprehensive, easy to find and download wordlists or dictionaries.
- jasonkester 16y agoIn the real world though, passwords aren't cracked nearly as often as they're read off a post-it note stuck to somebody's monitor. Loosen complexity and you can eliminate that post-it. That's a huge overall win. Complexity in itself isn't actually that bad. It's arbitrary complexity that spawns all those post-its. You can come up with a strong password that you and only you can remember, but it's useless if your bank rejects it due to its own silly complexity policy. There are sites out there that I regularly fail to log in with using my standard "strong" passwords, and it's not until I make it all the way through the Reset Password process to where it tells me its complexity requirement that I'm reminded which password I must have used last time I went through the process. The only real solution is to let people use the word "password" if they really want. It's still orders of magnitude safer than having them keep a file/email/post-it full of plain text passwords sitting around in plain view.
- troels 16y agoI believe you're right. But do you have any empirical evidence to support this claim?
- westi 16y agoA friend an I have considered a number of times setting up something like http://ismypasswordsecure.com http://ismypasswordsecure.com and just collecting passwords that way. This is of course pure evil and we never figured a way in which it had a return apart from publishing lists of common passwords.
- AngryParsley 16y agoInstead of collecting the passwords, have the submission button show a page about sane password practices. (Something similar to http://ismycreditcardstolen.com/ http://ismycreditcardstolen.com/)
- westi 16y agoI just wouldn't want to actively encourage anyone to enter their password in a webpage like that. We need to train people to behave more securely.
- nodata 16y agoMicrosoft already has one, on a non-SSL page: http://www.microsoft.com/uk/protect/yourself/password/checker.mspx http://www.microsoft.com/uk/protect/yourself/password/checke...
- arethuza 16y agoI checked with Fiddler and it's client side only - no outgoing traffic back to a server! Still, I don't think this is a great idea. You could harvest a lot of passwords with a page like this.
- nodata 16y agoBut it doesn't matter if it's client side only: * It might not be in future * It's not using SSL, so anybody in between can make it stop being client side only whenever they like * It's a terrible, terrible idea to teach users to trust things like this.
- taitems 16y agoThis reminds me of the good old days of searching Limewire for "password .txt .rtf .doc". It's incredible what folders and documents people would foolishly share. But the most important thing I learned is this: email account passwords are worth their weight in gold! As soon as you have an email address and password, you have access to a searchable list of logins and password confirmations. This is even more worrying than the example the comic utilises. You still have to (manually or automatically) go to these sites and guess the username (is it bob101 or is it 101bob this time?) and try the various passwords. As soon as you're into an email account you have quite the dangerous list. All of which are confirmed and ready to go. -- This is entirely a work of fiction, and in no means describes my teenage years.
- VMG 16y agoalso most sites have a "forgot password?" link that works by sending you an email. In this sense, the email password is the master password.
- nodata 16y agoand the e-mail password is recoverable by guessing the answer to a weak security question, so in a sense a weak security question answer is the master password.
- loewenskind 16y agoWhy do people remember passwords? We've had browsers that can remember them for you, password1, etc. for years now. I make up a new password for every single site I have to log into and let the browser remember it.
- KoZeN 16y agoMainly because most people log into these sites from more than one computer. It's imperative for me to recall all of my passwords as I need them both at work and at home. Currently I am rotating between three different passwords but this is an area I am becoming increasingly paranoid over.
- billswift 16y agoIf you have relatively few passwords, use Bruce Schneier's advice and write them on a piece of paper that you keep in your wallet - safe and available.
- malyk 16y agountil you lose your wallet.
- peterwwillis 16y agouse a password keyring! mozilla provides one if you enable master password and sync your profiles between home and work. kwallet, gnome keyring and keepass are other alternatives. i was working on backporting a gaim master password patch to pidgin but haven't had the time to finish it. if you write down some passwords on paper and put them in your wallet, rc4-encrypt them with a master password and write down the base64 equivalent. there should be plenty of free javascript decoders for base64 and rc4 so you can decode them wherever you can find a browser. (yes this is paranoid, but if people know you keep passwords in your wallet it's trivial to get your pocket picked)
- RiderOfGiraffes 16y ago<preamble> I initially posted this as a comment on a duplicate submission, not realising it was a duplicate. So I've moved it here to the original. For some reason someone down-voted it there - no idea why - so I hereby give them the chance to down-vote it again, but ask for a reason. </preamble> Usually submitting XKCD is frowned on, but I'm pleased to see this one submitted. This attack vector is so seldom recognised as a real potential problem. It neatly explains the problem of password re-use. As an aside, it's known that One-Time-Pad is provably secure. What's less well known is that during WW2 OTP systems were occasionally broken, because in the real world they ended up being Two-Time-Pads. People re-used a pad because they didn't get a new pad in time, etc. This was going to be one of my greybeard stories, but I'm still getting closer to the information source. http://news.ycombinator.com/item?id=1333934 http://news.ycombinator.com/item?id=1333934 http://news.ycombinator.com/item?id=996250 http://news.ycombinator.com/item?id=996250 http://news.ycombinator.com/item?id=994358 http://news.ycombinator.com/item?id=994358 http://news.ycombinator.com/item?id=1001262 http://news.ycombinator.com/item?id=1001262 I really have to find time to go back and organise them properly.
- albertzeyer 16y agoWell, exactly that is the reason why we should adopt something like OpenID. Of course, if someone catches the password of your OpenID provider, you are also fucked. But all OpenID consumers (i.e. any random site) will not get it that way. Also, you can easily globally change your password for just everything if you know that your old one has become insecure.