5 ms·

lol >One of the passwords that I know by heart is a famous classic quote clumsily translated in a mix of French and Dutch. It is long, it can not be brute-forc

lol >One of the passwords that I know by heart is a famous classic quote clumsily translated in a mix of French and Dutch. It is long, it can not be brute-forced because of its length and I am pretty sure it is not present in any of the rainbow tables. I never spell it out, let alone write it down, but it is in my muscle memory as I haven't changed it for years. One keylogger OR phishing attempt and his super complex and secure password is ruined. with no 2FA to protect him.

akimbostrawman 2y ago
If a system used for logging in has a keylogger its game over anyways since it could just copy 2FA (excluding hardware token) or cookies.
- dharmab 2y ago
  2FA doesn't necessarily require entering a code. A lot of 2FA schemes use a push notification where the user confirms the login on a separate device. Session cookies are a problem, some services provide a way to invalidate all session cookies, but it's often buried deeply in settings and users aren't aware to find the button after a compromise.
- echoangle 2y ago
  How would a keylogger steal cookies? There are hardware keyloggers that only record typed text.
  - TeMPOraL 2y ago
    For almost everyone on the planet, being spied on by a hardware keylogger is about as likely to happen as getting eaten by a shark. Security is important, but not the be-all, end-all. People really should get their priorities and threat models straight, and start counting in denial of service and data loss due to security system being incompatible with human beings as a cost.
  - akimbostrawman 2y ago
    Most modern malware are software suits with multiple data extraction feature. Getting a hardware keylogger is extraordinary unlikely and at that point why not also consider video surveillance or evil maid attacks.
BlackFly 2y ago
Malware can sniff one password in a similar way that malware can read your password manager's vault. So yeah, one malware and all your unique website passwords might need to be rotated after a recovery anyways. If the 2fa was a yubikey or some other unique made-for-purpose device, the accounts wouldn't need to be recovered, but TFA is talking about microsoft authenticator so it could very well be on the compromised device. The most irritating thing about security is people treating it as one dimensional: more or less secure. 2FA changes security in a complex way.
Y_Y 2y ago
I assumed everyone salts their memorised passwords. Like you add something that's a function of the thing you're logging into, in a way that's not atrociously obvious. I think (hope) that anything beyond "superpassword1+facebook" is going to be adequate to stop a successful phish cascading to other accounts.
- thaumasiotes 2y ago
  > I assumed everyone salts their memorised passwords. Like you add something that's a function of the thing you're logging into, in a way that's not atrociously obvious. You're thinking of something other than salting. A salt isn't secret. The point is to make sure that the same password on two services, or on two users of the same service, doesn't have the same hash each time.
  - Y_Y 2y ago
    You're dead right. It was an improper use of a specific technical term and that sort of thing is very annoying. Thank you for your service.
- autoexec 2y ago
  That only matters if you reuse a memorized password. If I have my hacker news password memorized but never use it for anything else there's no need to worry about it.

akimbostrawman 2y ago

If a system used for logging in has a keylogger its game over anyways since it could just copy 2FA (excluding hardware token) or cookies.

dharmab 2y ago
2FA doesn't necessarily require entering a code. A lot of 2FA schemes use a push notification where the user confirms the login on a separate device. Session cookies are a problem, some services provide a way to invalidate all session cookies, but it's often buried deeply in settings and users aren't aware to find the button after a compromise.
echoangle 2y ago
How would a keylogger steal cookies? There are hardware keyloggers that only record typed text.
- TeMPOraL 2y ago
  For almost everyone on the planet, being spied on by a hardware keylogger is about as likely to happen as getting eaten by a shark. Security is important, but not the be-all, end-all. People really should get their priorities and threat models straight, and start counting in denial of service and data loss due to security system being incompatible with human beings as a cost.
- akimbostrawman 2y ago
  Most modern malware are software suits with multiple data extraction feature. Getting a hardware keylogger is extraordinary unlikely and at that point why not also consider video surveillance or evil maid attacks.

BlackFly 2y ago

Malware can sniff one password in a similar way that malware can read your password manager's vault. So yeah, one malware and all your unique website passwords might need to be rotated after a recovery anyways. If the 2fa was a yubikey or some other unique made-for-purpose device, the accounts wouldn't need to be recovered, but TFA is talking about microsoft authenticator so it could very well be on the compromised device. The most irritating thing about security is people treating it as one dimensional: more or less secure. 2FA changes security in a complex way.

Y_Y 2y ago

I assumed everyone salts their memorised passwords. Like you add something that's a function of the thing you're logging into, in a way that's not atrociously obvious. I think (hope) that anything beyond "superpassword1+facebook" is going to be adequate to stop a successful phish cascading to other accounts.

thaumasiotes 2y ago
> I assumed everyone salts their memorised passwords. Like you add something that's a function of the thing you're logging into, in a way that's not atrociously obvious. You're thinking of something other than salting. A salt isn't secret. The point is to make sure that the same password on two services, or on two users of the same service, doesn't have the same hash each time.
- Y_Y 2y ago
  You're dead right. It was an improper use of a specific technical term and that sort of thing is very annoying. Thank you for your service.
autoexec 2y ago
That only matters if you reuse a memorized password. If I have my hacker news password memorized but never use it for anything else there's no need to worry about it.