5 ms·

Stop using the same password anywhere. There are password management system that do encryption client side, have extensions for every major browser, have mobile

Stop using the same password anywhere. There are password management system that do encryption client side, have extensions for every major browser, have mobile apps, support two-factor authentication, will prepopulate both registration and login forms and more. It's EASIER to use a password manager with very strong, unique passwords than it is to not. Not to mention the eliminated risk of "where did I use this password that just got leaked". How many more leaks and how many more times do I have to repeat this to get people to take it seriously. Every time people whine that it's too much work (it's not, it seriously isn't) but they don't think about how much of a hassle these leaks can be. NPM, PS3, BitCoin reserves, how many more diverse things need to be hacked for people to realize that its simply a matter of time?

RyanMcGreal 15y ago
> Stop using the same password anywhere. You might as well say, "Stop being human." That's never the right solution to network problems that require high reliability.
- yew 15y ago
  It's the right solution for anyone who actually cares about security. No amount of indignation (and no amount of concern for security in your own work) will prevent third parties that don't care about security from leaking your data wherever possible.
  - RyanMcGreal 15y ago
    Network security isn't a person problem, it's a system problem. You can't fix system problems with personal solutions.
    - SoftwareMaven 15y ago
      Good security comes in layers. You are right that you can't control all the layers, but you can make the layers you do control stronger. In today's world (which isn't ideal) that means good password management.
    - gwillen 15y ago
      But security across multiple sites _has_ to be fixed on the person end, because it can't be fixed on the system end. If you use the same password for 10,000 sites, there's no fix on the 'system' end to make them all secure, because they're all run by different people. It only takes one of them to fuck up.
      - rhizome 15y ago
        Third option: there is no "fix," on either end, so telling people to change all their passwords is pointless.
        yew 15y ago
        I fixed it for myself by using a password manager. I only have to worry about securing the (encrypted) database, which is comparatively trivial. I'm still vulnerable to the "supercomputer cracks your encryption" attack but that's orders of magnitude better than having my bank account compromised because some blog leaked my universal password. Edit: If there were no fix, changing all of your passwords would be the only option besides letting the Internet at large have your accounts. Unless I'm misreading you.
        rhizome 15y ago
        The example was 10,000 sites, so changing all of your passwords being the only option is no option at all.
- dfc 15y ago
  My reccommendation is to use "nonce + domain name" for all of the sites you need passwords for and then hash it. $ echo password@$(echo nonce+hackernews.com|md5sum|tr [[:lower:]] [[:upper:]]) password@FB85C2F638706D4BE4192391387C2879 The above format gives you lower, upper, digit and special character.
  - rbonvall 15y ago
    I wish I could do something like this all the time, but there are always some sites that force you to put symbols in your password, or to use both lower and upper case, or to be between 6 and 8 characters long, or whatever weird requirement they thought would be a good idea. And since I can't (and don't want to) remember which sites enforce which restriction, I end up having to resort to writing my passwords in a text file.
    - JonnieCache 15y ago
      https://www.pwdhash.com https://www.pwdhash.com is a browser extension that does exactly this automatically. Oh and hash functions won't output symbols or banned chars. They output numbers and you can choose to represent those numbers in whatever mad way that you want, typically as hex, ie. letters and digits. The length might be a problem but there's nothing to stop you truncating the hash.
      - gst 15y ago
        Be careful when using PwdHash. The used hashing mechanism is quite weak. If you don't have a long high-entropy master password, it should be feasible for a site-owner to brute-force your master-password based on the site-specific password.
      - rbonvall 15y ago
        Yes, but then I have to remember for which sites did I truncate the hash, for which I converted the hash to hexadecimal, etc.
    - dfc 15y ago
tomjen3 15y ago
Do they work on all platforms (Linux, Windows, Android, MacOX and IOS)? Do they automatically sync (so I don't end up being locked out of one account)? Can I be sure they won't be shut down and thereby leave me cut of from all my online services? And what do I do when the password manager is, inevitably, broken into? It seems to me that a password manager is a great theoretical idea, but they don't really work in practice.
- drivebyacct2 15y ago
  >Do they work on all platforms (Linux, Windows, Android, MacOX and IOS)? Do they automatically sync (so I don't end up being locked out of one account)? Can I be sure they won't be shut down and thereby leave me cut of from all my online services? Yes, yes, yes (make a text backup, another supported feature, also every device would have a local copy, etc, etc) >And what do I do when the password manager is, inevitably, broken into? Why? Because you left it open and unencrypted? How about, just not doing that? Mine is locked every time I close the browser. If you're paranoid only unlock it when you need to enter a site. Not only that, but even if your master password is "stolen" somehow... it's a single password to change and your other passwords are secure. Again, if you're paranoid, you'd at least have a list of the sites that you have to worry about. >It seems to me that a password manager is a great theoretical idea, but they don't really work in practice. It seems to me that you really don't understand what is out there or what you're talking about. These things are true of not just LastPass but other solutions as well.
  - tomjen3 15y ago
    You are right, I don't understand what I out there because I haven't look. Based on your response I have determined that it might be worth looking into, but I don't know which to choose. But by broken into I mean hacked, as in 'due to $INSECURE_FEATURE $SOMEBODY copied the entire database and now have all your passwords'. If somebody breaks into my home and steals my computer, I can call the police (and activate the tracking beacon).
    - drivebyacct2 15y ago
shocks 15y ago
Actually, I don't think you should trust anyone or anything with your passwords except for yourself. Trusting any one system is giving yourself a single point of failure. EMAIL: - Take the time to learn a couple of strong passwords for your email. You can almost always reset forgotten passwords, don't forget that. - Insure you have two-step login enabled for your email service should it be supported, and make sure you have all the secret questions answers memorised. - By the way, secret questions are stupid. It's easier for me to get you to tell me your mothers maiden name and birthday than it is to make you tell me your password. - Have a phone number and other emails associated with your main email accounts, if possible. OTHER STUFF: - Never use the same password at one site. - Develop a personal "scheme" that lets you form passwords easily. For example, combine a couple of short words/sentences you know, some numbers related to the service (e.g. got an 'i' in the URL? add 99), add some #@~!"£$ with similar rules. Develop something that works for you. Now when you approach a service you use, you should already have a solid idea what the password is. - Write down "reminders" but not actually passwords on paper. Don't label them. Write other things that don't make sense. Put it in your desk draw. - Can't do that? PGP/Truecrypt/bcrypt/whatever a text file. Forgot your password? Press the forgot password button.

RyanMcGreal 15y ago

> Stop using the same password anywhere. You might as well say, "Stop being human." That's never the right solution to network problems that require high reliability.

yew 15y ago
It's the right solution for anyone who actually cares about security. No amount of indignation (and no amount of concern for security in your own work) will prevent third parties that don't care about security from leaking your data wherever possible.
- RyanMcGreal 15y ago
  Network security isn't a person problem, it's a system problem. You can't fix system problems with personal solutions.
  - SoftwareMaven 15y ago
    Good security comes in layers. You are right that you can't control all the layers, but you can make the layers you do control stronger. In today's world (which isn't ideal) that means good password management.
  - gwillen 15y ago
    But security across multiple sites _has_ to be fixed on the person end, because it can't be fixed on the system end. If you use the same password for 10,000 sites, there's no fix on the 'system' end to make them all secure, because they're all run by different people. It only takes one of them to fuck up.
    - rhizome 15y ago
      Third option: there is no "fix," on either end, so telling people to change all their passwords is pointless.
      - yew 15y ago
        I fixed it for myself by using a password manager. I only have to worry about securing the (encrypted) database, which is comparatively trivial. I'm still vulnerable to the "supercomputer cracks your encryption" attack but that's orders of magnitude better than having my bank account compromised because some blog leaked my universal password. Edit: If there were no fix, changing all of your passwords would be the only option besides letting the Internet at large have your accounts. Unless I'm misreading you.
        rhizome 15y ago
        The example was 10,000 sites, so changing all of your passwords being the only option is no option at all.
dfc 15y ago
My reccommendation is to use "nonce + domain name" for all of the sites you need passwords for and then hash it. $ echo password@$(echo nonce+hackernews.com|md5sum|tr [[:lower:]] [[:upper:]]) password@FB85C2F638706D4BE4192391387C2879 The above format gives you lower, upper, digit and special character.
- rbonvall 15y ago
  I wish I could do something like this all the time, but there are always some sites that force you to put symbols in your password, or to use both lower and upper case, or to be between 6 and 8 characters long, or whatever weird requirement they thought would be a good idea. And since I can't (and don't want to) remember which sites enforce which restriction, I end up having to resort to writing my passwords in a text file.
  - JonnieCache 15y ago
    https://www.pwdhash.com https://www.pwdhash.com is a browser extension that does exactly this automatically. Oh and hash functions won't output symbols or banned chars. They output numbers and you can choose to represent those numbers in whatever mad way that you want, typically as hex, ie. letters and digits. The length might be a problem but there's nothing to stop you truncating the hash.
    - gst 15y ago
      Be careful when using PwdHash. The used hashing mechanism is quite weak. If you don't have a long high-entropy master password, it should be feasible for a site-owner to brute-force your master-password based on the site-specific password.
    - rbonvall 15y ago
      Yes, but then I have to remember for which sites did I truncate the hash, for which I converted the hash to hexadecimal, etc.
  - dfc 15y ago

tomjen3 15y ago

Do they work on all platforms (Linux, Windows, Android, MacOX and IOS)? Do they automatically sync (so I don't end up being locked out of one account)? Can I be sure they won't be shut down and thereby leave me cut of from all my online services? And what do I do when the password manager is, inevitably, broken into? It seems to me that a password manager is a great theoretical idea, but they don't really work in practice.

drivebyacct2 15y ago
>Do they work on all platforms (Linux, Windows, Android, MacOX and IOS)? Do they automatically sync (so I don't end up being locked out of one account)? Can I be sure they won't be shut down and thereby leave me cut of from all my online services? Yes, yes, yes (make a text backup, another supported feature, also every device would have a local copy, etc, etc) >And what do I do when the password manager is, inevitably, broken into? Why? Because you left it open and unencrypted? How about, just not doing that? Mine is locked every time I close the browser. If you're paranoid only unlock it when you need to enter a site. Not only that, but even if your master password is "stolen" somehow... it's a single password to change and your other passwords are secure. Again, if you're paranoid, you'd at least have a list of the sites that you have to worry about. >It seems to me that a password manager is a great theoretical idea, but they don't really work in practice. It seems to me that you really don't understand what is out there or what you're talking about. These things are true of not just LastPass but other solutions as well.
- tomjen3 15y ago
  You are right, I don't understand what I out there because I haven't look. Based on your response I have determined that it might be worth looking into, but I don't know which to choose. But by broken into I mean hacked, as in 'due to $INSECURE_FEATURE $SOMEBODY copied the entire database and now have all your passwords'. If somebody breaks into my home and steals my computer, I can call the police (and activate the tracking beacon).
  - drivebyacct2 15y ago

shocks 15y ago

Actually, I don't think you should trust anyone or anything with your passwords except for yourself. Trusting any one system is giving yourself a single point of failure. EMAIL: - Take the time to learn a couple of strong passwords for your email. You can almost always reset forgotten passwords, don't forget that. - Insure you have two-step login enabled for your email service should it be supported, and make sure you have all the secret questions answers memorised. - By the way, secret questions are stupid. It's easier for me to get you to tell me your mothers maiden name and birthday than it is to make you tell me your password. - Have a phone number and other emails associated with your main email accounts, if possible. OTHER STUFF: - Never use the same password at one site. - Develop a personal "scheme" that lets you form passwords easily. For example, combine a couple of short words/sentences you know, some numbers related to the service (e.g. got an 'i' in the URL? add 99), add some #@~!"£$ with similar rules. Develop something that works for you. Now when you approach a service you use, you should already have a solid idea what the password is. - Write down "reminders" but not actually passwords on paper. Don't label them. Write other things that don't make sense. Put it in your desk draw. - Can't do that? PGP/Truecrypt/bcrypt/whatever a text file. Forgot your password? Press the forgot password button.