3 ms·

I don't want to alarm anyone but so does this site. If your not using unique passwords for every site you use then you really should consider doing it. Tools su

by edd 16y ago

I don't want to alarm anyone but so does this site. If your not using unique passwords for every site you use then you really should consider doing it. Tools such as 1Password make it ridiculously easy, there really is no excuse.

mike-cardwell 16y ago
Yeah. There's a Firesheep handler for news.yc too: https://github.com/codebutler/firesheep/wiki/Handlers https://github.com/codebutler/firesheep/wiki/Handlers This website should really be migrated to https.
- spicyj 16y ago
  Heaven forbid someone in a coffee shop posts something on your HN account…
  - glhaynes 16y ago
    :) Yeah, not the end of the world... but many, many people use the same password (or one with slight variation) on many sites. Sure, they "shouldn't", but, still...
  - pclark 16y ago
    or editing your yc application.
  - mike-cardwell 16y ago
    It's not just that. Some countries inspect web traffic. Some of them disapprove of conversations on some topics.
vrish88 16y ago
Another way is to hash a "salt" password with the domain (or something site specific). So if my salt was "assword" and I put the last 4 characters from the domain name interspersed at the end of my password it would look like this: asswaotrodr. Giving you a unique and complicated password for every site.
- randm_prgrmr 16y ago
  "Salting" it in that way doesn't increase your security by much? If they looked at your password, once they obtained it, how long would it take them to figure out what you were doing, and thereby be able to derive all your other passwords?
  - vrish88 16y ago
    True, if someone were able to get your username and password for a site they may be able to figure out your hashing scheme. But what if someone compromises an entire database? They would use a bot to go out and see what they can access with the given usernames and passwords as is. The suggested password strategy helps to protect against the later case.

by edd 16y ago

mike-cardwell 16y ago

Yeah. There's a Firesheep handler for news.yc too: https://github.com/codebutler/firesheep/wiki/Handlers https://github.com/codebutler/firesheep/wiki/Handlers This website should really be migrated to https.

spicyj 16y ago
Heaven forbid someone in a coffee shop posts something on your HN account…
- glhaynes 16y ago
  :) Yeah, not the end of the world... but many, many people use the same password (or one with slight variation) on many sites. Sure, they "shouldn't", but, still...
- pclark 16y ago
  or editing your yc application.
- mike-cardwell 16y ago
  It's not just that. Some countries inspect web traffic. Some of them disapprove of conversations on some topics.

vrish88 16y ago

Another way is to hash a "salt" password with the domain (or something site specific). So if my salt was "assword" and I put the last 4 characters from the domain name interspersed at the end of my password it would look like this: asswaotrodr. Giving you a unique and complicated password for every site.

randm_prgrmr 16y ago
"Salting" it in that way doesn't increase your security by much? If they looked at your password, once they obtained it, how long would it take them to figure out what you were doing, and thereby be able to derive all your other passwords?
- vrish88 16y ago
  True, if someone were able to get your username and password for a site they may be able to figure out your hashing scheme. But what if someone compromises an entire database? They would use a bot to go out and see what they can access with the given usernames and passwords as is. The suggested password strategy helps to protect against the later case.