3 ms·

Logging into devices you don't own, for example.

knaik94 4y ago
I log in to devices I don't own using a password+2factor. I have a long but memorable password that I just type in. I don't have some obtuse password where I require a password manager to log-in, I refuse to use the suggested password that chrome generates. What is the point of a password I don't remember? I am going to link this helpful xkcd comic https://xkcd.com/936/ https://xkcd.com/936/ that was published August 10, 2011 that is still relevant.
- stetrain 4y ago
  If you type your password into a device you don’t own, what value is left in the password? Shouldn’t you basically consider it compromised at that point? If you rely on remembering your passwords, do you also keep them unique for every website?
  - brookst 4y ago
    It’s easy to have memorable and unique passwords for every website. You just create a personal hash algorithm to derive a password from the site name. For instance: number of letters in site name + second letter of site name in caps + last letter of site name + number of repeat letters in site name + (! if even number of letters, * if odd) + capitalized first letter google.com = 6Oe1!G bestbuy.com = 7Ey0*B Longer rules than that, but once you remember than you can derive the password for any site. If an adversary gets a few of your passwords and the sites they’re for, it would be easy to crack the rules. But that’s not an attack vector that typical hackers are exploring.
    - stetrain 4y ago
      I’ll give my grandma your number so you can walk her through this easy system the next time she needs to sign in.
      - brookst 4y ago
        Probably easier to just have me generate them and hold on to all of her passwords. She can call me when she needs a password. I charge $20/month if it’s just social media and stuff. Free if it includes online banking. Besides, I didn’t say this approach is right for everyone. For the HN crowd it should be easy.

I log in to devices I don't own using a password+2factor. I have a long but memorable password that I just type in. I don't have some obtuse password where I require a password manager to log-in, I refuse to use the suggested password that chrome generates. What is the point of a password I don't remember? I am going to link this helpful xkcd comic https://xkcd.com/936/ https://xkcd.com/936/ that was published August 10, 2011 that is still relevant.

stetrain 4y ago
If you type your password into a device you don’t own, what value is left in the password? Shouldn’t you basically consider it compromised at that point? If you rely on remembering your passwords, do you also keep them unique for every website?
- brookst 4y ago
  It’s easy to have memorable and unique passwords for every website. You just create a personal hash algorithm to derive a password from the site name. For instance: number of letters in site name + second letter of site name in caps + last letter of site name + number of repeat letters in site name + (! if even number of letters, * if odd) + capitalized first letter google.com = 6Oe1!G bestbuy.com = 7Ey0*B Longer rules than that, but once you remember than you can derive the password for any site. If an adversary gets a few of your passwords and the sites they’re for, it would be easy to crack the rules. But that’s not an attack vector that typical hackers are exploring.
  - stetrain 4y ago
    I’ll give my grandma your number so you can walk her through this easy system the next time she needs to sign in.
    - brookst 4y ago
      Probably easier to just have me generate them and hold on to all of her passwords. She can call me when she needs a password. I charge $20/month if it’s just social media and stuff. Free if it includes online banking. Besides, I didn’t say this approach is right for everyone. For the HN crowd it should be easy.