6 ms·

86% of my passwords are for low consequence sites. How much should I care if someone hacks my handle and posts ads on a chat site? Or reads registration-requi

by dzdt 8y ago

86% of my passwords are for low consequence sites. How much should I care if someone hacks my handle and posts ads on a chat site? Or reads registration-required articles under my registration? Or etc etc.

majewsky 8y ago
1. With a password manager, you don't have to think anymore if a site is high-consequence or low-consequence. 2. What kinds of websites that require a sign-in are actually low-consequence? I can't think of any from the top of my head, but that's probably because I'm pretty reluctant to sign up to new sites.
- Etheryte 8y ago
  To be honest, the first one that comes to mind is HN. There is zero consequence if someone was to get a hold of my credentials here — I don't care about the score and I can still recover the bookmarks.
  - asaph 8y ago
    What if the person that takes over the account posts messages that arouse the interest of authorities? Your IP addresses and other info are associated with the account.
    - Bromskloss 8y ago
      Are you posting on Hacker News from your own IP address?!?! :-O
    - Etheryte 8y ago
      I think this is a pseudo-problem in pretty much any country except for, perhaps, totalitarian regimes or similar. If any large body would take interest in the account seriously enough to get the associated IP, they would also automatically get the new account holder's IP and the clear correlation.
- barrkel 8y ago
  Low-consquence? Typically one-off purchases from random internet vendors; if no saved credit card details, just a way to view past orders. Risk is leakage of more PII, like address. Forum logins risk reputational damage, but otherwise are reasonably limited. Some people use specialist forums to ask one-off questions, for example.
- mehrdadn 8y ago
  > 2. What kinds of websites that require a sign-in are actually low-consequence? It's usually not a function of the site, but a function of the site and the user. pg would probably care more about his HN account than user051783254. That said, some sites where I expect the majority of users (mostly the non-paying ones, but perhaps even the paying ones depending on the payment mechanism) would probably not care about their accounts being hijacked might include: HN, StackOverflow, CodeProject, AllTrails, Disqus, Last.fm, SlickDeals, etc.
- lostcolony 8y ago
  What kinds of website would require a throwaway email address?
- rocannon 8y ago
  I had a login at a game website called Shakes & Fidget years ago. The site itself is low-consequence. I wouldn't care if someone hacked my login. Another example is when I'm just trying some service and don't expect to use it ever again. What would worry me is if people hack the login for a low-consequence site and then figure out that those login credentials for this user are the same everywhere: at their bank, Amazon, etc. Personally, I use different passwords at every single website, but at low-consequence websites I sometimes use less secure ones. I don't see how this is a problem (for me). I understand why low-consequence sites do not implement schemes to force users to use stronger passwords, though. Howls of outrage, lost users, and attempts to get around it, as charDiversity says: https://news.ycombinator.com/item?id=16975773 https://news.ycombinator.com/item?id=16975773
- gsich 8y ago
  2. all sites/forums/whatever that require you to login to see a link, download stuff ... you get the idea. Or probably: sites that don't involve money.
qrbLPHiKpiux 8y ago
It comes down to threat modeling and compartmentation.
OskarS 8y ago
If you ever reuse that password anywhere else, then you should care A LOT. If you go "i only reuse passwords on low-consequence sites", then I have to ask you 1) why reuse at all? and 2) are you sure? I bet that that's not true, I bet you think that's true but it turns out that your Uber password is the same as your RandomSite password. Just use a password manager. It's easier and it's safer, and you never have to think "is this a low consequence site?" ever again, because you'll have high quality passwords everywhere. It's really the only way to be sure you have unique and strong passwords everywhere.
- acjohnson55 8y ago
  Unfortunately, OSs don't make it easy to use password managers, especially in mobile. A lot of my banking sites also defeat my password manager with bizarre UX like user name masking and multi step login screens.
  - sethammons 8y ago
    I use keypassx on Mac, Windows, and Android. It is a minor pain to have to log into it to grab my username and password, but worth it. I sync the encrypted DB with Dropbox.
  - mehrdadn 8y ago
    Or by disabling automated entry, or with disabling the password field until the username field is filled.
- mayniac 8y ago
  Yeah I do this. I also work in security. >why reuse at all? Because it's easy. There's many sites I create an account for once or twice and I never use again, mainly e-commerce. I don't care if someone logs in, at best they get an address and maybe a few card details. That's all practically public information. >are you sure? I bet that that's not true Yup, 100%. And even if a few get missed, anything super important has 2fa, on top of using semi-unique passwords that adhere to a format so I can guess them in <5 attempts if I don't have my password manager on hand. And I check them semi-frequently in haveibeenpwned. >Just use a password manager. I agree this is good advice in general but even with decently designed password managers, like dashlane and lastpass, people often don't like to use them for various reasons. My parents get confused by new software. I tell them "use a very strong password for google, amazon, ebay etc, and if any other site asks you for a password use a weaker one". If they used a password manager I guarantee they'd get overwhelmed when it comes to using it on different devices and give up, reverting to worse security than before. Also in the end, people are astronomically more likely to fall for phishing emails than be the victim of a security breach from password re-use. Seriously the whole "use a password manager with a RNG upper/lower/symbol/number combination" trend is overhyped and honestly a distraction from more pressing security issues. Google estimated phishing victims are 400x more likely to have their accounts compromised than anything else[1]. And as someone who is currently dealing 90% with phishing attacks over any kind of password related incidents I'm very inclined to agree. If you're a public figure and therefore an actual individual target for motivated attackers then yes, use RNG passwords and a password manager with 2fa and only ever store the db on a memory stick which you keep on a chain around your neck, otherwise it's not really necessary. [1] https://www.bleepingcomputer.com/news/security/google-ranks-phishing-above-keyloggers-and-password-reuse-as-bigger-threat-to-users/ https://www.bleepingcomputer.com/news/security/google-ranks-...
snowwolf 8y ago
Maybe it's not such a big deal if someone hacks your account on one 'inconsequential' site, but what if they do it across 10, 20 'inconsequential' sites? You may not give much away on one site, but combine all that data across multiple sites, and maybe I can start building a profile on you, identify you, impersonate you, steal your identity, etc.
- mayniac 8y ago
  >You may not give much away on one site, but combine all that data across multiple sites, and maybe I can start building a profile on you, identify you, impersonate you, steal your identity, etc. Why would someone go through that much effort on one person when they can end out a million phishing emails with two minutes of work, get a few thousand replies, get a few hundred people buying their scam and walk away with a six figure payout? The chance of you getting your identity stolen because of password reuse is about as low as getting killed in a terrorist attack: it's not really worth thinking about or putting too much effort into preventing when you're more likely to get hit by a car.
AnIdiotOnTheNet 8y ago
'Security' is some kind of religion in tech circles. I don't know if it is just that risk analysis isn't part of your standard tech education, or if they think it makes them look cool to talk about always using 200 character hardware-RNG generated passphrases when ordering pizza online, or what exactly, but they're everywhere.
- raverbashing 8y ago
  Seconded The usual cargo-cult thinking usually ends up with someone leaving their 1024 bit secret key under the doormat, or worrying too much about nation states hacking your routers instead of worrying about Bob clicking a suspicious link.
  - scrollaway 8y ago
    How many seconds have you, GP, and a couple of other commenters in this subthread devoted to thinking that maybe people who use password managers for everything find it not merely secure but also convenient? I don't know about you but I don't like having to remember passwords. But people here can feel free to impress everyone with their memorized password they use on pizzahut.com, right up until they find out that they reused it somewhere important they totally forgot about because they don't have a convenient database of all the websites they have an account on. Seriously, this counter-culture of being proud to have shitty passwords is the same mindset that makes antivax and climate science deniers a thing. You want to reuse shitty passwords, nobody is stopping you (I've certainly done it), but don't be proud of it and don't shit on people who care more than you.
    - raverbashing 8y ago
      I'm not talking about password managers (in this case) You should worry about strong passwords, but the point is moot if the rest of the system has other major flaws. See: people who have their security answer as a long hex string, and customer service doesn't check the digits.
      - 8y ago

by dzdt 8y ago

majewsky 8y ago

1. With a password manager, you don't have to think anymore if a site is high-consequence or low-consequence. 2. What kinds of websites that require a sign-in are actually low-consequence? I can't think of any from the top of my head, but that's probably because I'm pretty reluctant to sign up to new sites.

Etheryte 8y ago
To be honest, the first one that comes to mind is HN. There is zero consequence if someone was to get a hold of my credentials here — I don't care about the score and I can still recover the bookmarks.
- asaph 8y ago
  What if the person that takes over the account posts messages that arouse the interest of authorities? Your IP addresses and other info are associated with the account.
  - Bromskloss 8y ago
    Are you posting on Hacker News from your own IP address?!?! :-O
  - Etheryte 8y ago
    I think this is a pseudo-problem in pretty much any country except for, perhaps, totalitarian regimes or similar. If any large body would take interest in the account seriously enough to get the associated IP, they would also automatically get the new account holder's IP and the clear correlation.
barrkel 8y ago
Low-consquence? Typically one-off purchases from random internet vendors; if no saved credit card details, just a way to view past orders. Risk is leakage of more PII, like address. Forum logins risk reputational damage, but otherwise are reasonably limited. Some people use specialist forums to ask one-off questions, for example.
mehrdadn 8y ago
> 2. What kinds of websites that require a sign-in are actually low-consequence? It's usually not a function of the site, but a function of the site and the user. pg would probably care more about his HN account than user051783254. That said, some sites where I expect the majority of users (mostly the non-paying ones, but perhaps even the paying ones depending on the payment mechanism) would probably not care about their accounts being hijacked might include: HN, StackOverflow, CodeProject, AllTrails, Disqus, Last.fm, SlickDeals, etc.
lostcolony 8y ago
What kinds of website would require a throwaway email address?
rocannon 8y ago
I had a login at a game website called Shakes & Fidget years ago. The site itself is low-consequence. I wouldn't care if someone hacked my login. Another example is when I'm just trying some service and don't expect to use it ever again. What would worry me is if people hack the login for a low-consequence site and then figure out that those login credentials for this user are the same everywhere: at their bank, Amazon, etc. Personally, I use different passwords at every single website, but at low-consequence websites I sometimes use less secure ones. I don't see how this is a problem (for me). I understand why low-consequence sites do not implement schemes to force users to use stronger passwords, though. Howls of outrage, lost users, and attempts to get around it, as charDiversity says: https://news.ycombinator.com/item?id=16975773 https://news.ycombinator.com/item?id=16975773
gsich 8y ago
2. all sites/forums/whatever that require you to login to see a link, download stuff ... you get the idea. Or probably: sites that don't involve money.

qrbLPHiKpiux 8y ago

It comes down to threat modeling and compartmentation.

OskarS 8y ago

If you ever reuse that password anywhere else, then you should care A LOT. If you go "i only reuse passwords on low-consequence sites", then I have to ask you 1) why reuse at all? and 2) are you sure? I bet that that's not true, I bet you think that's true but it turns out that your Uber password is the same as your RandomSite password. Just use a password manager. It's easier and it's safer, and you never have to think "is this a low consequence site?" ever again, because you'll have high quality passwords everywhere. It's really the only way to be sure you have unique and strong passwords everywhere.

acjohnson55 8y ago
Unfortunately, OSs don't make it easy to use password managers, especially in mobile. A lot of my banking sites also defeat my password manager with bizarre UX like user name masking and multi step login screens.
- sethammons 8y ago
  I use keypassx on Mac, Windows, and Android. It is a minor pain to have to log into it to grab my username and password, but worth it. I sync the encrypted DB with Dropbox.
- mehrdadn 8y ago
  Or by disabling automated entry, or with disabling the password field until the username field is filled.
mayniac 8y ago
Yeah I do this. I also work in security. >why reuse at all? Because it's easy. There's many sites I create an account for once or twice and I never use again, mainly e-commerce. I don't care if someone logs in, at best they get an address and maybe a few card details. That's all practically public information. >are you sure? I bet that that's not true Yup, 100%. And even if a few get missed, anything super important has 2fa, on top of using semi-unique passwords that adhere to a format so I can guess them in <5 attempts if I don't have my password manager on hand. And I check them semi-frequently in haveibeenpwned. >Just use a password manager. I agree this is good advice in general but even with decently designed password managers, like dashlane and lastpass, people often don't like to use them for various reasons. My parents get confused by new software. I tell them "use a very strong password for google, amazon, ebay etc, and if any other site asks you for a password use a weaker one". If they used a password manager I guarantee they'd get overwhelmed when it comes to using it on different devices and give up, reverting to worse security than before. Also in the end, people are astronomically more likely to fall for phishing emails than be the victim of a security breach from password re-use. Seriously the whole "use a password manager with a RNG upper/lower/symbol/number combination" trend is overhyped and honestly a distraction from more pressing security issues. Google estimated phishing victims are 400x more likely to have their accounts compromised than anything else[1]. And as someone who is currently dealing 90% with phishing attacks over any kind of password related incidents I'm very inclined to agree. If you're a public figure and therefore an actual individual target for motivated attackers then yes, use RNG passwords and a password manager with 2fa and only ever store the db on a memory stick which you keep on a chain around your neck, otherwise it's not really necessary. [1] https://www.bleepingcomputer.com/news/security/google-ranks-phishing-above-keyloggers-and-password-reuse-as-bigger-threat-to-users/ https://www.bleepingcomputer.com/news/security/google-ranks-...

snowwolf 8y ago

Maybe it's not such a big deal if someone hacks your account on one 'inconsequential' site, but what if they do it across 10, 20 'inconsequential' sites? You may not give much away on one site, but combine all that data across multiple sites, and maybe I can start building a profile on you, identify you, impersonate you, steal your identity, etc.

mayniac 8y ago
>You may not give much away on one site, but combine all that data across multiple sites, and maybe I can start building a profile on you, identify you, impersonate you, steal your identity, etc. Why would someone go through that much effort on one person when they can end out a million phishing emails with two minutes of work, get a few thousand replies, get a few hundred people buying their scam and walk away with a six figure payout? The chance of you getting your identity stolen because of password reuse is about as low as getting killed in a terrorist attack: it's not really worth thinking about or putting too much effort into preventing when you're more likely to get hit by a car.

AnIdiotOnTheNet 8y ago

'Security' is some kind of religion in tech circles. I don't know if it is just that risk analysis isn't part of your standard tech education, or if they think it makes them look cool to talk about always using 200 character hardware-RNG generated passphrases when ordering pizza online, or what exactly, but they're everywhere.

raverbashing 8y ago
Seconded The usual cargo-cult thinking usually ends up with someone leaving their 1024 bit secret key under the doormat, or worrying too much about nation states hacking your routers instead of worrying about Bob clicking a suspicious link.
- scrollaway 8y ago
  How many seconds have you, GP, and a couple of other commenters in this subthread devoted to thinking that maybe people who use password managers for everything find it not merely secure but also convenient? I don't know about you but I don't like having to remember passwords. But people here can feel free to impress everyone with their memorized password they use on pizzahut.com, right up until they find out that they reused it somewhere important they totally forgot about because they don't have a convenient database of all the websites they have an account on. Seriously, this counter-culture of being proud to have shitty passwords is the same mindset that makes antivax and climate science deniers a thing. You want to reuse shitty passwords, nobody is stopping you (I've certainly done it), but don't be proud of it and don't shit on people who care more than you.
  - raverbashing 8y ago
    I'm not talking about password managers (in this case) You should worry about strong passwords, but the point is moot if the rest of the system has other major flaws. See: people who have their security answer as a long hex string, and customer service doesn't check the digits.
    - 8y ago