3 ms·

Considering the abundance of improperly implemented password storage schemes, shouldn't users just presume that their password(s) may be stolen and use unique p

Considering the abundance of improperly implemented password storage schemes, shouldn't users just presume that their password(s) may be stolen and use unique passwords for each service so that damage is minimized in an attack? It's really all about choosing "bad passwords" if the password exists on more than one site. It is just silly to trust others to implement password security correctly -- use throwaway, randomly generated passwords for all third-party services. I implement this personally by keeping my GPG keypair available, encrypting an email to myself with the relevant login information, and pulling this email up when I need to log in. In most cases it's a simple copy and paste operation and that works great. :)

RyanMcGreal 15y ago
No system will be successful if it depends on what its users ought to do.
- afhof 15y ago
  This is exactly right. The users are not in a position to understand how easy it is to break passwords.
  - cookiecaper 15y ago
    Someone should tell them. Users must become more educated about the forces that operate in computing if they are going to be able to continue to use computers with any reasonable level of reliability or security.
- cookiecaper 15y ago
  I understand that, but at the same time no system will be successful if it relies on what developers ought to do, especially with the kind of coders that pass for "professional" in our industry. This is going to be an ongoing problem until someone makes it extremely easy for either one side or the other to implement it correctly. With so many divergent development technologies, I reckon it will be much easier to achieve this kind of safety on the client side than the developer side -- LastPass et al are good steps. There has to be a compromise somewhere. Users will have to accept one day that if they don't want important digital data stolen, they are going to have to personally become serious about password security, unless someone finds magic "fix every computer system's password storage methodology" dust somewhere. In the meantime, a user is welcome to be reckless and he can see which method he prefers.
crocowhile 15y ago
This is likely to be a unique password actually, because it's relevant to the service the user was logging into, and it's only 5 chars (many website would not even accept it because it's too short). I am just saying that every other week there is a new blog post with password analysis of leaked passwords: how many are 123456 and blah blah blah. I think it's time to cut some slack to the users and start blame HEAVILY whoever is taking care of the system or programming the service. (BTW: you'd be better off using supergenpass or stanford PwdHash)
- cookiecaper 15y ago
  Is there a reason one of those is better? They produce more predictable passwords and require me to enter my real password on untrusted machines.
  - crocowhile 15y ago
    How do you go about fetching and gpg decrypting an email on an untrusted machine?

RyanMcGreal 15y ago

No system will be successful if it depends on what its users ought to do.

afhof 15y ago
This is exactly right. The users are not in a position to understand how easy it is to break passwords.
- cookiecaper 15y ago
  Someone should tell them. Users must become more educated about the forces that operate in computing if they are going to be able to continue to use computers with any reasonable level of reliability or security.
cookiecaper 15y ago
I understand that, but at the same time no system will be successful if it relies on what developers ought to do, especially with the kind of coders that pass for "professional" in our industry. This is going to be an ongoing problem until someone makes it extremely easy for either one side or the other to implement it correctly. With so many divergent development technologies, I reckon it will be much easier to achieve this kind of safety on the client side than the developer side -- LastPass et al are good steps. There has to be a compromise somewhere. Users will have to accept one day that if they don't want important digital data stolen, they are going to have to personally become serious about password security, unless someone finds magic "fix every computer system's password storage methodology" dust somewhere. In the meantime, a user is welcome to be reckless and he can see which method he prefers.

crocowhile 15y ago

This is likely to be a unique password actually, because it's relevant to the service the user was logging into, and it's only 5 chars (many website would not even accept it because it's too short). I am just saying that every other week there is a new blog post with password analysis of leaked passwords: how many are 123456 and blah blah blah. I think it's time to cut some slack to the users and start blame HEAVILY whoever is taking care of the system or programming the service. (BTW: you'd be better off using supergenpass or stanford PwdHash)

cookiecaper 15y ago
Is there a reason one of those is better? They produce more predictable passwords and require me to enter my real password on untrusted machines.
- crocowhile 15y ago
  How do you go about fetching and gpg decrypting an email on an untrusted machine?