5 ms·

Hmm, looks like account sign-up doesn't use SSL, and includes the ability to include your password in the confirmation email. Probably worth being careful with

Hmm, looks like account sign-up doesn't use SSL, and includes the ability to include your password in the confirmation email. Probably worth being careful with password choice if you're going to sign-up to this. Don't use one of your existing ones! Other than that, I'm so glad to see Myst back!

mhurron 13y ago
>Don't use one of your existing ones! Well you never should.
- redblacktree 13y ago
  Aye, but people do. Often. I suggest to people that they set up a system that uses some permutation of the domain name or company name to uniqueify their passwords. This way, you only have to remember one password, plus your system, and you have unique passwords everywhere. On the subject of red flags during signup, a password length restriction is always a red flag to me. If you're hashing my password, you don't care how long it is, right? If you limit length, I assume it's stored in plain text.
- criley2 13y ago
  >Well you never should. All of my accounts hooked to finance, or email, etc, are all unique strong passwords. However, I have a throwaway password for throwaway sites, or sites I'm unsure of the security for. Can anyone explain why using the same junk password for forums, crappy webgames, temporary reddit accounts, etc is a problem? Why should I take up the brain-space to memorize a unique password for a site like this?
  - robmil 13y ago
    You don't need to take the brain-space — use a password manager like 1Password or LastPass, plus a YubiKey for two-factor auth, and you can use unique passwords everywhere.
  - bargl 13y ago
    Don't use any brain space for any passwords (except one ofcourse). https://lastpass.com/ https://lastpass.com/ Steve Gibson uses it, I won't pretend to be as capable of speaking to it's benefits so I encourage you to listen to Security Now. Edit: Last pass can be loaded once in the browser, and if you link it to a yubikey it is much more secure. http://blog.lastpass.com/2010/07/lastpass-gets-green-light-from-security.html http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f....
    - druiid 13y ago
      I personally prefer Dashlane as it has a desktop interface as well. Not a big fan of only having the password manager in the browser, myself.
    - criley2 13y ago
      I use lastpass sometimes, but it seems very insecure to keep passwords on my machine. I don't like keeping lastpass with a master password because typing a strong, long master password every single time I want any password is not a use case I enjoy, and I certainly don't want to lock up my passwords with something that is easily defeatable. And without a strong master password locking every attempt to use lastpass, it becomes far, far less secure than memorizing passwords.
      - bargl 13y ago
        I honestly can't do it justice. See what Steve has to say. http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f... http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f.... Also consider linking to a yubikey. https://helpdesk.lastpass.com/security-options/multifactor-authentication-options/yubikey-authentication/ https://helpdesk.lastpass.com/security-options/multifactor-a... EDIT: DO NOT FOR ANY REASON DO THIS >for this reason I recommend writing your passwords down on a piece of paper you keep in your wallet or purse. I cannot respond directly to Munin but anyone who suggest that is going to lead you to this http://www.telegraph.co.uk/news/uknews/crime/10276460/David-Miranda-was-carrying-password-for-secret-files-on-piece-of-paper.html http://www.telegraph.co.uk/news/uknews/crime/10276460/David-... Someone could get a hold of your wallet and take a pic of your passwords then put them back and you'd never know you'd been compromised. And Lastpass uses the trust no one mentality so you don't have to trust them. They never see your password it's encrypted using your password and yubikey if you have one.
  - fmax30 13y ago
    I used to use a site called bugmenot to get accounts like these but now as the passwords there have stopped working i have started to use throwaways. Also my throw away password is 123456789 :P. I was just thinking if my account is not publicly listed then I can just have a really complicated username and use a really simple password. (Complicated as in a SHA 2 or MD5 hash of your real name ). (Just thinking loud)
    - coryfklein 13y ago
      What throwaway password do you use for sites with password complexity restrictions? (You know, requiring 1 uppercase, 1 lowercase, 1 special character, etc.)

mhurron 13y ago

>Don't use one of your existing ones! Well you never should.

redblacktree 13y ago
Aye, but people do. Often. I suggest to people that they set up a system that uses some permutation of the domain name or company name to uniqueify their passwords. This way, you only have to remember one password, plus your system, and you have unique passwords everywhere. On the subject of red flags during signup, a password length restriction is always a red flag to me. If you're hashing my password, you don't care how long it is, right? If you limit length, I assume it's stored in plain text.
criley2 13y ago
>Well you never should. All of my accounts hooked to finance, or email, etc, are all unique strong passwords. However, I have a throwaway password for throwaway sites, or sites I'm unsure of the security for. Can anyone explain why using the same junk password for forums, crappy webgames, temporary reddit accounts, etc is a problem? Why should I take up the brain-space to memorize a unique password for a site like this?
- robmil 13y ago
  You don't need to take the brain-space — use a password manager like 1Password or LastPass, plus a YubiKey for two-factor auth, and you can use unique passwords everywhere.
- bargl 13y ago
  Don't use any brain space for any passwords (except one ofcourse). https://lastpass.com/ https://lastpass.com/ Steve Gibson uses it, I won't pretend to be as capable of speaking to it's benefits so I encourage you to listen to Security Now. Edit: Last pass can be loaded once in the browser, and if you link it to a yubikey it is much more secure. http://blog.lastpass.com/2010/07/lastpass-gets-green-light-from-security.html http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f....
  - druiid 13y ago
    I personally prefer Dashlane as it has a desktop interface as well. Not a big fan of only having the password manager in the browser, myself.
  - criley2 13y ago
    I use lastpass sometimes, but it seems very insecure to keep passwords on my machine. I don't like keeping lastpass with a master password because typing a strong, long master password every single time I want any password is not a use case I enjoy, and I certainly don't want to lock up my passwords with something that is easily defeatable. And without a strong master password locking every attempt to use lastpass, it becomes far, far less secure than memorizing passwords.
    - bargl 13y ago
      I honestly can't do it justice. See what Steve has to say. http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f... http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f.... Also consider linking to a yubikey. https://helpdesk.lastpass.com/security-options/multifactor-authentication-options/yubikey-authentication/ https://helpdesk.lastpass.com/security-options/multifactor-a... EDIT: DO NOT FOR ANY REASON DO THIS >for this reason I recommend writing your passwords down on a piece of paper you keep in your wallet or purse. I cannot respond directly to Munin but anyone who suggest that is going to lead you to this http://www.telegraph.co.uk/news/uknews/crime/10276460/David-Miranda-was-carrying-password-for-secret-files-on-piece-of-paper.html http://www.telegraph.co.uk/news/uknews/crime/10276460/David-... Someone could get a hold of your wallet and take a pic of your passwords then put them back and you'd never know you'd been compromised. And Lastpass uses the trust no one mentality so you don't have to trust them. They never see your password it's encrypted using your password and yubikey if you have one.
- fmax30 13y ago
  I used to use a site called bugmenot to get accounts like these but now as the passwords there have stopped working i have started to use throwaways. Also my throw away password is 123456789 :P. I was just thinking if my account is not publicly listed then I can just have a really complicated username and use a really simple password. (Complicated as in a SHA 2 or MD5 hash of your real name ). (Just thinking loud)
  - coryfklein 13y ago
    What throwaway password do you use for sites with password complexity restrictions? (You know, requiring 1 uppercase, 1 lowercase, 1 special character, etc.)