4 ms·

And the fact that your passwords are deterministic means that somebody who has one of your passwords can learn the master from it and pwn you everywhere. Some

And the fact that your passwords are deterministic means that somebody who has one of your passwords can learn the master from it and pwn you everywhere. Some non-secure login forms do still exist. Boardgamecore is one of them (shame away, the webmaster seems to think it's too expensive to get a cert and I can't talk sense into him). The whole internet knows my boardgamecore password. I don't care too much though, because I use LastPass and that password is random. The worst you can do with it is make a bad move in my chess game. The fact that my board game password is public doesn't endanger any of my other security. My master password is still entirely out of reach. But if I was using LessPass, you could use rapid offline cracking to derive my master password from my boardgamecore password. If you get lucky or if my master isn't strong enough, in short order you have my email and my bank and hundreds of other things, which I have to go change manually one by one after I figure out how to deal with the fact that all my money's gone. With a deterministic password system, if somebody pwns you somewhere, they've pwnd you everywhere. It is only mildly better than reusing the same password everywhere. The danger of so many points of failure and no failsafety is definitely not worth the theoretical purity of "statelessness" (which you don't even really have because the state is in your head or a Google sheet)

Moru 7y ago
Your bank allows you to move money with just a password? Change to some bank where you get a way of logging in that requires some sort of certs. Ours used to have a small box you had to enter a key that the website provided to you, plus your pincode. Now there is an app that displays where you are logging in and you have to enter your pin to sign. When you transfer money it needs another signature and you can see all the transactions on the same screen before you hit enter.
- hannasanarion 7y ago
  Actually all you need to move money is an account and routing number. In US banks, that's all you need for an ACH pull. No password, no pin, no nothing. Learned that the hard way when a friend accidentally stole $5000 from me because he thought my account number was his.
  - tialaramex 7y ago
    But presumably you can just unwind that? In the UK the "Direct Debit guarantee" paperwork that's included with every form where you give people your account details explains that the bank promises to unwind any transactions that you decide you didn't want. Direct Debit also only works if you're an accredited recipient, because obviously under guarantee the bank is going to want to claw back that money it just refunded and so they need to know the recipient can afford that almost always. The huge global utility company won't go bankrupt if I unwind a monthly utility bill payment, but the fly-by-night vape shop might. Presumably ACH pull is the same?
minitech 7y ago
> And the fact that your passwords are deterministic means that somebody who has one of your passwords can learn the master from it and pwn you everywhere. Don’t use a trivial master password then… if you only need to remember one password, it may as well be one that can’t be cracked with a single fast hash, let alone PBKDF2x100000.
richrichardsson 7y ago
> too expensive to get a cert What? Has he never heard of LetsEncrypt or CloudFlare?

Moru 7y ago

Your bank allows you to move money with just a password? Change to some bank where you get a way of logging in that requires some sort of certs. Ours used to have a small box you had to enter a key that the website provided to you, plus your pincode. Now there is an app that displays where you are logging in and you have to enter your pin to sign. When you transfer money it needs another signature and you can see all the transactions on the same screen before you hit enter.

hannasanarion 7y ago
Actually all you need to move money is an account and routing number. In US banks, that's all you need for an ACH pull. No password, no pin, no nothing. Learned that the hard way when a friend accidentally stole $5000 from me because he thought my account number was his.
- tialaramex 7y ago
  But presumably you can just unwind that? In the UK the "Direct Debit guarantee" paperwork that's included with every form where you give people your account details explains that the bank promises to unwind any transactions that you decide you didn't want. Direct Debit also only works if you're an accredited recipient, because obviously under guarantee the bank is going to want to claw back that money it just refunded and so they need to know the recipient can afford that almost always. The huge global utility company won't go bankrupt if I unwind a monthly utility bill payment, but the fly-by-night vape shop might. Presumably ACH pull is the same?

minitech 7y ago

> And the fact that your passwords are deterministic means that somebody who has one of your passwords can learn the master from it and pwn you everywhere. Don’t use a trivial master password then… if you only need to remember one password, it may as well be one that can’t be cracked with a single fast hash, let alone PBKDF2x100000.

richrichardsson 7y ago

> too expensive to get a cert What? Has he never heard of LetsEncrypt or CloudFlare?