5 ms·

And still this is yet another hacking that has little to do with choosing a bad password but with the use of the wrong algorithm to store it (md5) and poor impl

And still this is yet another hacking that has little to do with choosing a bad password but with the use of the wrong algorithm to store it (md5) and poor implementation of security on the server.

robtoo 15y ago
Choosing (one of) your phone numbers as a password really is all about choosing a bad password. The back-end could be using bcrypt with a ridiculous work factor, and server security could be state of the art, but choosing your phone number as a password will always be a poor decision.
- crocowhile 15y ago
  The point is very very very rarely you actually hear of hacking stories where someone has actually "guessed" a password. Most of the time it's either social hacking or a db dump. Password choice is important to avoid password reuse but I am pretty confident that password guessing is a hugely overestimated risk.
  - sesqu 15y ago
    The News of the World scandal going on now is, to some extent, about guessing the password. However, they were guessing passwords like 0000, which probably isn't quite what you had in mind.
- pbhjpbhj 15y ago
  >but choosing your phone number as a password will always be a poor decision Always? OK, I've reset my HN password to [one of] my phone number. So you can log in as me now? No of course you can't. You don't even know how many digits it is, did I include + for an international number, did I use brackets, hyphens, dots (comme une gars Francais)? How will you connect my online ID with my phone number¹? Once you have my password what are you going to do? Right flames and lose me karma? I can just start a new account if needs be, nothing lost really. For many accounts a phone number is probably a good enough password IMO. For accounts that handle money? No way. For email accounts that receive reset passwords? Not a chance. For posting drivel on tech chat forums ... it'll be fine! -- ¹ If you can I'd prefer you didn't print it.
  - robtoo 15y ago
    FWIW, a couple of minutes googling found 3 seemingly-valid phone numbers for you.
    - pbhjpbhj 15y ago
      Ha, I have 4 (actually 5 but I don't remember the twilio one) ... do you want to give me the end digits for confirmation purposes, last 4 digits should be enough.
      - robtoo 15y ago
        deleted
        pbhjpbhj 15y ago
        Lolz, totally forgot about whois!! Interestingly I searched for the numbers as I'd use them along with a substring of my username and didn't find them. Did you really Google or were you using the term generically? I tried both Google and Bing. Well done now you can destroy my HN karma (no not really).
        robtoo 15y ago
        First google hit for "pbhj" is an seomoz profile for a web person person in the UK, which superficially matches the fact that pbhjpbhj has an account on hacker news and their previous comment here had talked about living in the UK. The seomoz profile lists a couple of websites. One of those sites has a phone number on the /contact page, and the /about page on the other links to another business (not totally sure how I originally found that, but this is currently the quickest way to get there.) That business has a couple more phone numbers listed on their homepage, which also matches the phone numbers on the shopfront on google street view. This can also be cross-checked with whois. A bit more googling (literally) of your names found an alternative (possibly old?) address in the same town, and googling that pulled up a fourth number.
rmc 15y ago
Yes the password scheme (MD5) is wrong. However choosing a password that can be guessed is terrible because a human can brute for that, using the best algorithm in the world isn't going to save you if your password is your phone number.
cookiecaper 15y ago
Considering the abundance of improperly implemented password storage schemes, shouldn't users just presume that their password(s) may be stolen and use unique passwords for each service so that damage is minimized in an attack? It's really all about choosing "bad passwords" if the password exists on more than one site. It is just silly to trust others to implement password security correctly -- use throwaway, randomly generated passwords for all third-party services. I implement this personally by keeping my GPG keypair available, encrypting an email to myself with the relevant login information, and pulling this email up when I need to log in. In most cases it's a simple copy and paste operation and that works great. :)
- RyanMcGreal 15y ago
  No system will be successful if it depends on what its users ought to do.
  - afhof 15y ago
    This is exactly right. The users are not in a position to understand how easy it is to break passwords.
    - cookiecaper 15y ago
      Someone should tell them. Users must become more educated about the forces that operate in computing if they are going to be able to continue to use computers with any reasonable level of reliability or security.
  - cookiecaper 15y ago
    I understand that, but at the same time no system will be successful if it relies on what developers ought to do, especially with the kind of coders that pass for "professional" in our industry. This is going to be an ongoing problem until someone makes it extremely easy for either one side or the other to implement it correctly. With so many divergent development technologies, I reckon it will be much easier to achieve this kind of safety on the client side than the developer side -- LastPass et al are good steps. There has to be a compromise somewhere. Users will have to accept one day that if they don't want important digital data stolen, they are going to have to personally become serious about password security, unless someone finds magic "fix every computer system's password storage methodology" dust somewhere. In the meantime, a user is welcome to be reckless and he can see which method he prefers.

And still this is yet another hacking that has little to do with choosing a bad password but with the use of the wrong algorithm to store it (md5) and poor implementation of security on the server.

robtoo 15y ago

Choosing (one of) your phone numbers as a password really is all about choosing a bad password. The back-end could be using bcrypt with a ridiculous work factor, and server security could be state of the art, but choosing your phone number as a password will always be a poor decision.

crocowhile 15y ago
The point is very very very rarely you actually hear of hacking stories where someone has actually "guessed" a password. Most of the time it's either social hacking or a db dump. Password choice is important to avoid password reuse but I am pretty confident that password guessing is a hugely overestimated risk.
- sesqu 15y ago
  The News of the World scandal going on now is, to some extent, about guessing the password. However, they were guessing passwords like 0000, which probably isn't quite what you had in mind.
pbhjpbhj 15y ago
>but choosing your phone number as a password will always be a poor decision Always? OK, I've reset my HN password to [one of] my phone number. So you can log in as me now? No of course you can't. You don't even know how many digits it is, did I include + for an international number, did I use brackets, hyphens, dots (comme une gars Francais)? How will you connect my online ID with my phone number¹? Once you have my password what are you going to do? Right flames and lose me karma? I can just start a new account if needs be, nothing lost really. For many accounts a phone number is probably a good enough password IMO. For accounts that handle money? No way. For email accounts that receive reset passwords? Not a chance. For posting drivel on tech chat forums ... it'll be fine! -- ¹ If you can I'd prefer you didn't print it.
- robtoo 15y ago
  FWIW, a couple of minutes googling found 3 seemingly-valid phone numbers for you.
  - pbhjpbhj 15y ago
    Ha, I have 4 (actually 5 but I don't remember the twilio one) ... do you want to give me the end digits for confirmation purposes, last 4 digits should be enough.
    - robtoo 15y ago
      deleted
      - pbhjpbhj 15y ago
        Lolz, totally forgot about whois!! Interestingly I searched for the numbers as I'd use them along with a substring of my username and didn't find them. Did you really Google or were you using the term generically? I tried both Google and Bing. Well done now you can destroy my HN karma (no not really).
        robtoo 15y ago
        First google hit for "pbhj" is an seomoz profile for a web person person in the UK, which superficially matches the fact that pbhjpbhj has an account on hacker news and their previous comment here had talked about living in the UK. The seomoz profile lists a couple of websites. One of those sites has a phone number on the /contact page, and the /about page on the other links to another business (not totally sure how I originally found that, but this is currently the quickest way to get there.) That business has a couple more phone numbers listed on their homepage, which also matches the phone numbers on the shopfront on google street view. This can also be cross-checked with whois. A bit more googling (literally) of your names found an alternative (possibly old?) address in the same town, and googling that pulled up a fourth number.

rmc 15y ago

Yes the password scheme (MD5) is wrong. However choosing a password that can be guessed is terrible because a human can brute for that, using the best algorithm in the world isn't going to save you if your password is your phone number.

cookiecaper 15y ago

Considering the abundance of improperly implemented password storage schemes, shouldn't users just presume that their password(s) may be stolen and use unique passwords for each service so that damage is minimized in an attack? It's really all about choosing "bad passwords" if the password exists on more than one site. It is just silly to trust others to implement password security correctly -- use throwaway, randomly generated passwords for all third-party services. I implement this personally by keeping my GPG keypair available, encrypting an email to myself with the relevant login information, and pulling this email up when I need to log in. In most cases it's a simple copy and paste operation and that works great. :)

RyanMcGreal 15y ago
No system will be successful if it depends on what its users ought to do.
- afhof 15y ago
  This is exactly right. The users are not in a position to understand how easy it is to break passwords.
  - cookiecaper 15y ago
    Someone should tell them. Users must become more educated about the forces that operate in computing if they are going to be able to continue to use computers with any reasonable level of reliability or security.
- cookiecaper 15y ago
  I understand that, but at the same time no system will be successful if it relies on what developers ought to do, especially with the kind of coders that pass for "professional" in our industry. This is going to be an ongoing problem until someone makes it extremely easy for either one side or the other to implement it correctly. With so many divergent development technologies, I reckon it will be much easier to achieve this kind of safety on the client side than the developer side -- LastPass et al are good steps. There has to be a compromise somewhere. Users will have to accept one day that if they don't want important digital data stolen, they are going to have to personally become serious about password security, unless someone finds magic "fix every computer system's password storage methodology" dust somewhere. In the meantime, a user is welcome to be reckless and he can see which method he prefers.