4 ms·

I used to have stacks of these yellow sticky notes with my password printed on it. I ensured, that whereever I went, I would stick one of them to anything I tou

• xoa 8y ago
  >I ensured, that whereever I went, I would stick one of them to anything I touched, so I'd have it ready just in case. Indeed, sticky notes with a password printed on them stuck around where they'd be needed is exactly what my very intelligent grandmother, doctor, and likely tens if not hundreds of millions of other people do worldwide. Often to comply with "good password policies" passed down from on high by thoughtless "security" technical people with zero appreciation or empathy for the actual humans they exist to serve and thus with minimal understanding of what "good security" actually means. Said sticky notes are quite trivial for any random passerby who possesses mildly functioning Mark 1 Eyeball(s) (only a single one is required!) to note. Turns out it's even easier then pulling a fingerprint or face/retina scan and turning it into something workable that can beat a good PAD and then stealing the device it's used with. Who'd have thought? Oh wait, maybe you were trying to be sarcastic there and make some point? I think you might in fact have made a point, but perhaps not quite the one you intended.
  • Fnoord 8y ago
    Your grandmother, doctor, etc are not aware they can use a password manager with a master password such as "dandy-pencil-colonist-precise-populate-stardom" which would be more difficult to crack than finding and copying a fingerprint on your device. Its only a matter of time until one of these is cracked, and with touchID and faceID they're going to get cracked before said password is cracked. PS: Just a piece of advice, your tone throughout this thread isn't going to convince anyone. On the contrary.
    • xoa 8y ago
      >Your grandmother, doctor, etc are not aware they can use a password manager with a master password such as "dandy-pencil-colonist-precise-populate-stardom" They are. My grandmother in particular cannot handle such a thing. At all. This exactly the sort of dismissive tech myopia that comes from people who get too deep into the tech trenches and lose sight of huge swaths of the general population. It's very easy to take for granted the huge amounts of meta knowledge and mental models of abstract systems people like us possess. With those as frameworks lots of things make total sense that are utterly confusing to those without them, even ignoring sensory trouble. >which would be more difficult to crack than finding and copying a fingerprint on your device. Really? Seems a lot easier: there that person is hunting and pecking (you don't think touch typing even is universal do you?) in public, hard of hearing and totally focused on that, while someone else stands behind them and just watches. Even assuming there are no cameras looking down of any kind around of course. Using words like you suggest makes it even easier, if you know each section is a real word then even missing parts will make it easy to fill in the blanks, heck just hearing it would be plenty to narrow the search space. Or how about using WiFi transmissions directly to recognize keystrokes ("Keystroke Recognition Using WiFi Signals": https://www.sigmobile.org/mobicom/2015/papers/p90-aliA.pdf https://www.sigmobile.org/mobicom/2015/papers/p90-aliA.pdf )? >Its only a matter of time until one of these is cracked, and with touchID and faceID they're going to get cracked before said password is cracked. Uh-huh, sure thing. That's why we read all the time about the vast gangs using harvested finger prints and 3D face scans to unlock iPhones, but have never read about shitty PINs getting brute forced or people reusing passwords or password reset mechanisms getting abused because people forget them all the time or password databases getting leaked or...? Yeah, passwords are certainly the best! >PS: Just a piece of advice, your tone throughout this thread isn't going to convince anyone. On the contrary. Right back at you. Your comment comes across as a typically dismissive, smug put down of the needs and requirements of large portions of the our fellow humans who do amazing things but just not in our specialty. And it's an attitude that has actively harmed security.
      • Fnoord 8y ago
        > They are. My grandmother in particular cannot handle such a thing. At all. This exactly the sort of dismissive tech myopia that comes from people who get too deep into the tech trenches and lose sight of huge swaths of the general population. It's very easy to take for granted the huge amounts of meta knowledge and mental models of abstract systems people like us possess. With those as frameworks lots of things make total sense that are utterly confusing to those without them, even ignoring sensory trouble. The advantage of using a sentence as password is that it is easy to remember. The advantage of using a password manager is that you only need to remember one strong password. The strong password can be remembered as a picture (like correct horse battery staple) which is a very strong way to remember anything. Tricks like paintings and books can be used instead of sticky notes. With touchID and faceID an adversary can force you to cooperate, and they also have false positives. IIRC with FaceID it was 1 in 1.000.000. TouchID weaker. Non-Apple implementations likely even weaker. It takes longer to break said password with full knowledge (53 bit entropy). It didn't even have fancy things such as capitals or different separators. Plus, I never said I only use a password; I use 2FA. A YubiKey with TOTP or whatever can be revoked. The government doesn't have a copy of it, it isn't stored in my ID card either. It is mine, and mine only. > Really? Seems a lot easier: there that person is hunting and pecking (you don't think touch typing even is universal do you?) in public, hard of hearing and totally focused on that, while someone else stands behind them and just watches. Even assuming there are no cameras looking down of any kind around of course. Using words like you suggest makes it even easier, if you know each section is a real word then even missing parts will make it easy to fill in the blanks, heck just hearing it would be plenty to narrow the search space. Or how about using WiFi transmissions directly to recognize keystrokes ("Keystroke Recognition Using WiFi Signals": https://www.sigmobile.org/mobicom/2015/papers/p90-aliA.pdf https://www.sigmobile.org/mobicom/2015/papers/p90-aliA.pdf )? TEMPEST and such is a different problem. I don't recommend WLAN in secure environments. Cameras are a reason why I recommend 2FA. > That's why we read all the time about the vast gangs using harvested finger prints and 3D face scans to unlock iPhones, but have never read about shitty PINs getting brute forced or people reusing passwords or password reset mechanisms getting abused because people forget them all the time or password databases getting leaked or...? Yeah, passwords are certainly the best! We've read about fingerprint identification and facial recognition being cracked. It isn't a matter when touchID and faceID are cracked; the question is when. The password I mentioned, if inputted securely, has high enough entropy to remain secure longer than touchID and faceID are. PIN has very weak entropy, and using your password in public is a bad idea. > Right back at you. Your comment comes across as a typically dismissive, smug put down of the needs and requirements of large portions of the our fellow humans who do amazing things but just not in our specialty. And it's an attitude that has actively harmed security. You are projecting.
  • mulle_nat 8y ago
    The point apparently went way over your head. Your grandmother does not leave her password all over random places. At the coffee shop, the neighbors kitchen or the airport restroom as she does with her fingerprints, or does she ?