7 ms·
I Know What Your Password Was Last Summer
- spacecadet 3y agoI crack alot of hashes, people pick really bad passwords. Ive had tools running on raspberry pi's crack client passwords in meetings with them... in minutes...
- joshuamcginnis 3y agoWhat app or service login did you crack with your clients in these meetings?
- spacecadet 3y agoTheir network passwords... For what its worth, I dont go in intending to crack anything or I hope not. Its just more work for me when I discover a simple password keeping the network secure.
- mewpmewp2 3y agoIs this a sales shtick for security services of some sort that you do to your clients in meetings?
- spacecadet 3y agoNo, its OSINT, the work is already happening.
- henriquez 3y agoI love that the title is a reference to a truly bad horror movie for teenagers from two decades ago. Thanks for the memories!
- rollulus 3y agoNot mentioned in the article, but I bet seasonal/time-related passwords are due to password rotation policies. I work for a company too slow or stupid to have understood how counterproductive such policy is, and all my passwords are an update of the former. Because we humans cannot remember multiple strong passwords.
- Brajeshwar 3y agoAll of my Bank passwords are variations of Swear Words!
- mooreds 3y agoYes, NIST changed their guidance to advise against password rotation for this exact reason. I think the answer is distributed password managers, myself.
- rvnx 3y agoIt’s not necessarily management. When you run large IT systems, external auditors come into your systems and say : 1) no password rotation = bad 2) no password format enforcement = bad Though it’s absurd to force people to have a password between 6 and 8 chars for example, because it limits the amount of possibilities.
- bongodongobob 3y agoNo, password rotation has not been standard best practice for quite some time now. Best practice is long passwords with no rotation. For humans. Service/admin accounts should be rotating constantly.
- rvnx 3y agoApparently EY or KPMG are not aware of that, yet they make the rules
- instagib 3y agoWe had a randomly rotating admin position for security theater and network admin to keep things separate. Legally you can save passwords on the most secure network and realistically only remember one password. You have to memorize a lot of passwords otherwise. No phones. The NSA password reset questionnaire is hilariously a great life memory quiz. Almost everyone needs to reset some passwords daily even though we had the phone number keypads with special characters around. How to remember passwords was a routine conversation because certain systems had admin passwords to remember or passwords that would change at odd intervals or single account multiple user passwords. It came down to “how long after a password reset do you actually need to change the password? Does it check for past passwords?” There were passwords written down in not so secret places because the admin would not always be at work. Eventually we had to adopt token authorization which is a mess to implement also. I loved the security meetings only to discuss how screwed we were once they started enforcing policies.
- pseufaux 3y agoI always wonder why employers don't just set passwords for their users and only give them the option to randomize them. Seems like an ideal solution, if using passwords is a requirement.
- mewpmewp2 3y agoMaybe it would be fine if it was random 4 words like in the XKCD, but otherwise it would cause people to plaster sticky notes everywhere and hardcode it in their computers, no?
- reifyx 3y agoif you work from home, a sticky note with a strong password might be safer than a memorized employee-chosen password
- mewpmewp2 3y agoBut then imagine once in a while they have to go out to work, they might have to take this along with them and then both laptop and the sticky note together are vulnerable for either accidental theft or intentional.
- pseufaux 3y agoAgreed though I'd argue sticky notes happen even with user supplied passwords. When I worked at a university, I cannot tell you how often I found a sticky not on the bottom of a keyboard with a list of passwords.
- SAI_Peregrinus 3y agoRequiring SSO mostly does this, except for the SSO passphrase. That should be randomly generated, but usually isn't.
- playingalong 3y agoSome employers just buy a 1Password license for their staff.
- kemotep 3y agoLove the recommendation for diceware style passwords. You can easily remember 4 to 6 random words. You really will be surprised how quickly it is to memorize and type after a day or two. Mixing them up with what separator (if any) that you use, and if you number/special character substitute that adds dozens of possible permutations on a single password. And just using 4-letter words (over 100,000 in the English language) leads to a 100 quintillion possible passwords without any separator or character substitutions. The next requirement should be no arbitrary changes to passwords. End users should be able to pick a strong 16 character password (based on uniqueness and the other password strength tools they recommend in the article) and only change it if they forgot it or a breach of their account is suspected.
- roflmaostc 3y ago+1 You can even make proper sentences which makes it easier to memorize them more quickly For KeePassXC I have something like: ilikeeatingicecreamonsundaysaftermovies Much safer than anything like Xak1k99u??.1 which no one can remember efficiently
- zwirbl 3y agoI usually make up a sentence in my local German dialect. Where I live it's not at all unusual to write texts or chat in it and it oftentimes barely resembles German. Once while playing Counterstrike 1.6 and using public chat some Germans asked if we were Swedish because of that. It definitely messes up dictionary attacks
- velcrovan 3y agoShameless self promotion: https://dicewordbook.com https://dicewordbook.com
- bluish29 3y agoThis reminds me of my teenage years. I used to use passwords that do not rely on personal facts (i.e birthday) or social relationzs (i.e my city..etc) but tried to be smart and relied on creating passwords that is related to what I feel because I thought that it is harder for people to know that. So I had a password "Ihate_My_Math_Teacher" for anything that is related to study for a while.
- pavel_lishin 3y agoI tried doing this with "forgot password?" reminders, and ended up getting locked out of an email account in high school, because of course I had no idea what the answer to "who is the girl you love most" was - I set it in middle school! Not only was that a few years ago, that answer probably changed on a weekly basis!
- LuciBb 3y ago[flagged]
- pixl97 3y agoCan someone message Dang to ban this account?
- subtra3t 3y agoIf anybody is curious about what the account commented, this is the other comment from the same account: --- I created a portfolio with Mrs Marlena she has awesome trading strategy and it's been a life-changer for me! If you want to level up your trading game and start making right speculation on trading gains, sign up by following her on INSrTA g ram @** and we'll both get some sweet perks. Let's conquer the market together!
- smokel 3y agoDo I understand things correctly if they claim to have cracked 31,200 passwords of which 481 were "TooBlue2022", and they then go on to think that this is a password used by multiple people? (To be more precise, this is not claimed directly for the top 10, but it is implied for the season words.) Is it nog a bit more likely that there was some duplication in the hashes? Or that this password is used by one prolific account creator? Or that it is the default password after signup for some blue service?
- k8svet 3y ago> Is it nog a bit more likely that there was some duplication in the hashes? Depending on the type of hashes... Absolutely not.
- Shrezzing 3y agoIn the same theme, something to add to their list of common passwords is the What3Words database of locations https://what3words.com https://what3words.com It's something like 50trillion sets of looks-random strings. That's quite a lot, but if the list could be narrowed very significantly to get some likely results by selecting locations in: 1) cities where a company is physically located 2) large capital & global cities 3) significant landmarks I see sysadmins using the tool all the time as a temporary password generator.
- amelius 3y ago... but it was useless because you used 2FA.
- immibis 3y agoParts of this article appear to be AI-generated. 1. The section beginning with "If you are interested in the respective hashcat masks for the passwords cracked above," is most obviously AI-generated as it makes no sense. Quote: > <Passw0rd1><Passw0rd2> > > Mask: ?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1 > > Explanation: This mask is for a pattern that starts and ends with angle brackets. Inside, it follows a pattern of "Passw0rd" followed by a digit, repeated twice. However, Hashcat doesn't directly support angle brackets in its mask. An option would be to handle these characters separately or use a custom charset (?1) to represent them. Angle brackets aren't special characters in masks: https://hashcat.net/wiki/doku.php?id=mask_attack https://hashcat.net/wiki/doku.php?id=mask_attack If angle brackets were special characters in masks and had to be represented by ?1 as a workaround, this mask is unrelated to the explanation, since it would match passwords consisting only of angle brackets. "handle these characters separately" isn't a thing. The mask doesn't have anything to do with matching "Passw0rd". Several other masks from the page do not match their accompanying passwords. Most of them are just showing the uppercase letters, lowercase letters and digits in the password. E.g. "We matched Hello123World with a mask matching 1 uppercase letter, 4 lowercase letters, 3 digits, 1 uppercase letter, and 4 lowercase letters." This doesn't explain why anyone should use that mask instead of, say, 1 uppercase letter, 4 lowercase letters, 2 digits, 1 uppercase letter, and 5 lowercase letters. This is obviously not the mask they used, but an AI working backwards from the password. 2. The password "Cloudy-Envelope-Rainbow-Dinosaur" is 32 characters long, including the hyphens, not 29 as the article says. The password "Sunset$Guitar$Puzzle$Journey" consists of 28 characters, including the dollar signs, not 27 as the article says. 3. The "Conclusion" section smells strongly of AI. Windows was only mentioned in passing, yet the conclusion says the whole article is about Windows. MFA wasn't mentioned at all until this point. Defence in depth wasn't mentioned.
- broast 3y agoMy personal favorite method for passwords is come up with a passphrase I can remember, encode it to base 64, and use the encoded string as the password. If its not too long, the encoded version is usually not hard to memorize either.
- akerl_ 3y agoWhy?
- jmclnx 3y agoI usually do this: tr -cd "[:alnum:]" < /dev/urandom | fold -w 20 | sed 10q Then I use an encrypted text file via Emacs to store my passwords
- an_ko 3y agoThanks, I'll add base64 as one of the trivial transformations to my ongoing brute-forcing effort of all your passwords, multiplying total search effort by a tiny constant. I'm joking. But what if I weren't? Especially if you're going to announce this on the internet, it sounds far more effective to add 1 character to the end of your passphrase instead, since each exponentiates any brute force effort, and isn't defeatable by a simple pattern. (Or announce on the internet that you're doing something far more complex, like running bcrypt on all your passphrases to generate your passwords. That would make an attacker's life significantly more difficult than base64.) (Or always lie on the internet about how you generate your passwords. I hope that's what you're already actually doing.)
- 3y ago
- tamaharbor 3y agoIf use of a password manager is encouraged, who is monitoring the security of the password manager?
- velcrovan 3y agoPretty much everybody
- lopkeny12ko 3y agoI don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a rule for which to use for certain types of websites. Like, I really don't get it. Why not just use a password manager. I always tell these people to just sign up for a password manager and they always resist and say no. I must be missing something obvious. Edit: And just as I posted this comment, another bizarre personal strategy for creating passwords: https://news.ycombinator.com/item?id=39335853 https://news.ycombinator.com/item?id=39335853 Just use a password manager! Basically all password managers will generate a random string for a password when you add a new credential. You never even have to look at it or know what it is.
- bruce343434 3y agoA password manager relies on a single point of failure secret (master password), while the website-hash approach relies on a single point of failure secret (master key derivation algorithm). It's really no different, so I think there must be some human biased thinking at play. Except the password manager requires a central or synchronizing computer system, while the in-head key derivation approach requires no such thing. The trade off is that pass mgnrs give more convenience, but have slightly more failure modes (not knowing the master password, not having access to the synchronization or master vault, not wanting to log into a pass mngr on a potentially compromised computer when you only need a single password you are willing to sacrifice) while the in-head approach has a single one: not remembering the derivation method. ETA: both are sensitive to sites changing names or URLs. But password managers more so (requiring extra searching and clicks) while in a mental key derivation context, you would probably remember "oh, it's protonmail." without explicitly needing to distinguish "login.proton.me" from their old URL. But, that does make the key derivation approach slightly more susceptible to phishing. Not seeing the password autofill at least gives mental pause.
- paulmd 3y ago
- l72 3y agoWe (tech professionals) really need to be hosting things like vaultwarden for our extended family. That is what I do, and have had good success. I even keep my vaultwarden on a private network and have an always on wireguard vpn on all my family's devices.
- sotix 3y agoI tried to do this, but vaultwarden wouldn’t let me set it up because I wasn’t using https even though it’s a local network only accessed via WireGuard. Any tips on how to set that up?
- l72 3y agoI run vaultwarden in docker and use jwilder/nginx-proxy and jrcs/letsencrypt-nginx-proxy-companion to add an SSL proxy. It is nice, because it has the option to keep http open on the subdomain for doing let's encrypt stuff, but the actually SSL site will be internal only.
- ben98 3y ago[dead]