4 ms·

> Use tough passwords and change them frequently. The best practice for passwords is to use real words or phrases you can remember easily — but spell them incor

> Use tough passwords and change them frequently. The best practice for passwords is to use real words or phrases you can remember easily — but spell them incorrectly. They should be at least eight characters and have a combination of letters, numbers, and special characters, such as 5pEAzhawh$ for “five pizzas.” The result of encouraging frequent changes: 5pEAzhawh$, 5pEAzhawh$2, 5pEAzhawh$3, 5pEAzhawh$4, 5pEAzhawh$5, ... > Even better, use a password manager like Lastpass. They really should have lead with this.

lewisinc 8y ago
https://xkcd.com/936/ https://xkcd.com/936/
TimTheTinker 8y ago
Yes, they clearly didn't consult (and/or use) security researchers' most recent recommendations about passwords. Password managers have become a nearly non-negotiable necessity. Telling people just use a password manager is becoming kind of like telling developers just use source control 15 years ago. You just won't know how important they are (or the true cost/benefit) until you start using one yourself.
- astura 8y ago
  15 years ago? Source control was very, very standard 15 years ago. 15 years ago I would have run, not walked, from a job if they didn't use source control. There was no git, we used CVS, which was almost old enough to vote at that time.
  - TimTheTinker 8y ago
    > Source control was very, very standard 15 years ago. For commercial shops, perhaps. But back then the bar for using source control was much, much higher, so for many small projects, people didn't bother. There wasn't anything as simple as `git init`. There were a few public CVS and SVN servers that were appropriate for open source projects, but for anything personal or commercial, you had to use a local, single-user repo or set up your own server. (Back then, the only viable DVCS systems were commercial.)
    - pessimizer 8y ago
      > you had to set up your own server. That was like 5 minutes of work, though. Maybe an hour or two if you hadn't done it before. It's absurdly easy to set up and use SVN. CVS was easy to set up, but a nightmare to use. > you had to use a local, single-user repo or set up your own server. That's the opposite of having no source control, that's having source control.
    - xorcist 8y ago
      Sourceforge is almost 20 years old now, and offered version control free of charge. For a while it was almost as dominant in the free software world as github is now. The FreeBSD CVS archive is 25 years old. Version control was absolutely mainstream back then.
      - TimTheTinker 8y ago
        > Version control was absolutely mainstream back then. I’m not arguing with that, only pointing out that it wasn’t ubiquitous.
    - astura 8y ago
      Sorry, no, this just isn't true.
dqpb 8y ago
No, the best practice is to use a password manager with randomly generated passwords.
- packet_nerd 8y ago
  True, but there's still a few you have to memorize. Your PC's password and your password manager's password at least.
tokyodude 8y ago
When will LastPass stop being recommended? It says right in their TOS they collect all your browser behavior and sell it to 3rd parties. Why should I trust them?
- Hawxy 8y ago
  Huh? I just went through LogMeIn's privacy policy (which covers all of their services) and it says nothing of the sort. The privacy policy for the firefox extension is also fairly clean.
  - tokyodude 8y ago
    see other reply
- ydj 8y ago
  Can you highlight where in the TOS they say this? I’ve used LastPass for several years and this would be concerning if true. I didn’t seen any such language in their ToS: https://www.logmeininc.com/legal/terms-and-conditions https://www.logmeininc.com/legal/terms-and-conditions
  - tokyodude 8y ago
    tos: > You may use our Services only as permitted in these Terms, and you consent to our Privacy Policy at https://www.logmeininc.com/legal/privacy https://www.logmeininc.com/legal/privacy, which is incorporated by reference. pp: > When you use our Services, we receive information generated through the use of the Service, either entered by you or others who use the Services with you (for example, schedules, attendee info, etc.), or from the Service infrastructure itself, (for example, duration of session, use of webcams, connection information, etc.) We may also collect usage and log data about how the services are accessed and used, including information about the device you are using the Services on, IP addresses, location information, language settings, what operating system you are using, unique device identifiers and other diagnostic data to help us support the Services. > Third Party Data: We may receive information about you from other sources, including publicly available databases or third parties from whom we have purchased data, and combine this data with information we already have about you. We may also receive information from other affiliated companies that are a part of our corporate group. This helps us to update, expand and analyze our records, identify new prospects for marketing, and provide products and services that may be of interest to you. > Location Information: We collect your location-based information for the purpose of providing and supporting the service and for fraud prevention and security monitoring. If you wish to opt-out of the collection and use of your collection information, you may do so by turning it off on your device settings. > Device Information: When you use our Services, we automatically collect information on the type of device you use, operating system version, and the device identifier (or "UDID"). and > Some specific examples of how we use the information: > * Conduct research and analysis > * Display content based upon your interests > * Market services of our third-party business partners and > 4. Information Sharing > ... We may share your personal information with (a) third party service providers; (b) business partners; (c) affiliated companies within our corporate structure and (d) as needed for legal purposes. and > Examples of how we may share information with service providers include: > * Sending marketing communications there's more

lewisinc 8y ago

https://xkcd.com/936/ https://xkcd.com/936/

TimTheTinker 8y ago

Yes, they clearly didn't consult (and/or use) security researchers' most recent recommendations about passwords. Password managers have become a nearly non-negotiable necessity. Telling people just use a password manager is becoming kind of like telling developers just use source control 15 years ago. You just won't know how important they are (or the true cost/benefit) until you start using one yourself.

astura 8y ago
15 years ago? Source control was very, very standard 15 years ago. 15 years ago I would have run, not walked, from a job if they didn't use source control. There was no git, we used CVS, which was almost old enough to vote at that time.
- TimTheTinker 8y ago
  > Source control was very, very standard 15 years ago. For commercial shops, perhaps. But back then the bar for using source control was much, much higher, so for many small projects, people didn't bother. There wasn't anything as simple as `git init`. There were a few public CVS and SVN servers that were appropriate for open source projects, but for anything personal or commercial, you had to use a local, single-user repo or set up your own server. (Back then, the only viable DVCS systems were commercial.)
  - pessimizer 8y ago
    > you had to set up your own server. That was like 5 minutes of work, though. Maybe an hour or two if you hadn't done it before. It's absurdly easy to set up and use SVN. CVS was easy to set up, but a nightmare to use. > you had to use a local, single-user repo or set up your own server. That's the opposite of having no source control, that's having source control.
  - xorcist 8y ago
    Sourceforge is almost 20 years old now, and offered version control free of charge. For a while it was almost as dominant in the free software world as github is now. The FreeBSD CVS archive is 25 years old. Version control was absolutely mainstream back then.
    - TimTheTinker 8y ago
      > Version control was absolutely mainstream back then. I’m not arguing with that, only pointing out that it wasn’t ubiquitous.
  - astura 8y ago
    Sorry, no, this just isn't true.

dqpb 8y ago

No, the best practice is to use a password manager with randomly generated passwords.

packet_nerd 8y ago
True, but there's still a few you have to memorize. Your PC's password and your password manager's password at least.

tokyodude 8y ago

When will LastPass stop being recommended? It says right in their TOS they collect all your browser behavior and sell it to 3rd parties. Why should I trust them?

Hawxy 8y ago
Huh? I just went through LogMeIn's privacy policy (which covers all of their services) and it says nothing of the sort. The privacy policy for the firefox extension is also fairly clean.
- tokyodude 8y ago
  see other reply
ydj 8y ago
Can you highlight where in the TOS they say this? I’ve used LastPass for several years and this would be concerning if true. I didn’t seen any such language in their ToS: https://www.logmeininc.com/legal/terms-and-conditions https://www.logmeininc.com/legal/terms-and-conditions
- tokyodude 8y ago
  tos: > You may use our Services only as permitted in these Terms, and you consent to our Privacy Policy at https://www.logmeininc.com/legal/privacy https://www.logmeininc.com/legal/privacy, which is incorporated by reference. pp: > When you use our Services, we receive information generated through the use of the Service, either entered by you or others who use the Services with you (for example, schedules, attendee info, etc.), or from the Service infrastructure itself, (for example, duration of session, use of webcams, connection information, etc.) We may also collect usage and log data about how the services are accessed and used, including information about the device you are using the Services on, IP addresses, location information, language settings, what operating system you are using, unique device identifiers and other diagnostic data to help us support the Services. > Third Party Data: We may receive information about you from other sources, including publicly available databases or third parties from whom we have purchased data, and combine this data with information we already have about you. We may also receive information from other affiliated companies that are a part of our corporate group. This helps us to update, expand and analyze our records, identify new prospects for marketing, and provide products and services that may be of interest to you. > Location Information: We collect your location-based information for the purpose of providing and supporting the service and for fraud prevention and security monitoring. If you wish to opt-out of the collection and use of your collection information, you may do so by turning it off on your device settings. > Device Information: When you use our Services, we automatically collect information on the type of device you use, operating system version, and the device identifier (or "UDID"). and > Some specific examples of how we use the information: > * Conduct research and analysis > * Display content based upon your interests > * Market services of our third-party business partners and > 4. Information Sharing > ... We may share your personal information with (a) third party service providers; (b) business partners; (c) affiliated companies within our corporate structure and (d) as needed for legal purposes. and > Examples of how we may share information with service providers include: > * Sending marketing communications there's more