5 ms·

>Well you never should. All of my accounts hooked to finance, or email, etc, are all unique strong passwords. However, I have a throwaway password for throwaw

by criley2 13y ago

>Well you never should. All of my accounts hooked to finance, or email, etc, are all unique strong passwords. However, I have a throwaway password for throwaway sites, or sites I'm unsure of the security for. Can anyone explain why using the same junk password for forums, crappy webgames, temporary reddit accounts, etc is a problem? Why should I take up the brain-space to memorize a unique password for a site like this?

robmil 13y ago
You don't need to take the brain-space — use a password manager like 1Password or LastPass, plus a YubiKey for two-factor auth, and you can use unique passwords everywhere.
bargl 13y ago
Don't use any brain space for any passwords (except one ofcourse). https://lastpass.com/ https://lastpass.com/ Steve Gibson uses it, I won't pretend to be as capable of speaking to it's benefits so I encourage you to listen to Security Now. Edit: Last pass can be loaded once in the browser, and if you link it to a yubikey it is much more secure. http://blog.lastpass.com/2010/07/lastpass-gets-green-light-from-security.html http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f....
- druiid 13y ago
  I personally prefer Dashlane as it has a desktop interface as well. Not a big fan of only having the password manager in the browser, myself.
- criley2 13y ago
  I use lastpass sometimes, but it seems very insecure to keep passwords on my machine. I don't like keeping lastpass with a master password because typing a strong, long master password every single time I want any password is not a use case I enjoy, and I certainly don't want to lock up my passwords with something that is easily defeatable. And without a strong master password locking every attempt to use lastpass, it becomes far, far less secure than memorizing passwords.
  - bargl 13y ago
    I honestly can't do it justice. See what Steve has to say. http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f... http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f.... Also consider linking to a yubikey. https://helpdesk.lastpass.com/security-options/multifactor-authentication-options/yubikey-authentication/ https://helpdesk.lastpass.com/security-options/multifactor-a... EDIT: DO NOT FOR ANY REASON DO THIS >for this reason I recommend writing your passwords down on a piece of paper you keep in your wallet or purse. I cannot respond directly to Munin but anyone who suggest that is going to lead you to this http://www.telegraph.co.uk/news/uknews/crime/10276460/David-Miranda-was-carrying-password-for-secret-files-on-piece-of-paper.html http://www.telegraph.co.uk/news/uknews/crime/10276460/David-... Someone could get a hold of your wallet and take a pic of your passwords then put them back and you'd never know you'd been compromised. And Lastpass uses the trust no one mentality so you don't have to trust them. They never see your password it's encrypted using your password and yubikey if you have one.
    - DanBC 13y ago
      Steve Gibson has some flaws, and you really shouldn't be listening to him for any kind of security advice. If you have obsolete hard drives you might find his spinrite product useful.
      - bqe 13y ago
        Anyone remember his theory that removing raw socket access in Windows XP will stop the impending doom of spoofed packets and mass DDoS? http://www.theregister.co.uk/2001/06/25/steve_gibson_really_is_off/ http://www.theregister.co.uk/2001/06/25/steve_gibson_really_...
    - mseebach 13y ago
      Bruce Schneier thinks it's OK to keep your password on a piece of paper in your wallet. https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo... But, of course, don't write the password to an encrypted drive on a piece of paper that you keep with the drive.
- Gormo 13y ago
  Are there any advantages of LastPass over KeePass? I've always been very wary about storing passwords in a third-party hosted webapp.
  - coryfklein 13y ago
    I'm not familiar with KeePass, but I can tell you that LastPass does not know your master password. They just keep an encrypted copy of your password database which gets decrypted locally when you type in the password. For this reason, if you lose your master password, LastPass can't unlock your passwords for you. You'll have to go to the NSA for that.
  - rpdillon 13y ago
    I'm not a security expert, but this seems to be a fair question. I use KeePass (have for years). One of my problems with LastPass is that the whole system is bootstrapped over HTTPS, which is has some insecurities. Essentially, LastPass sends your browser JavaScript via HTTPS which is then used to encrypt all your passwords using AES and send them over the net. The problem is that the original JavaScript payload could be compromised by third parties that have access to the root CA. I realize that revelations about HTTPS insecurity are new and limited to nation-state attacks, but we're talking about all your passwords, here. Putting HTTPS insecurity aside, we really shouldn't be implementing crypto in JavaScript. http://www.matasano.com/articles/javascript-cryptography/ http://www.matasano.com/articles/javascript-cryptography/ KeePass is both native and open-source, so it avoids many of the problems that LastPass presents, IMHO. Simply install the client program and sync via SparkleShare, git, Dropbox, UbuntuOne, Google Drive, etc.
    - orthecreedence 13y ago
      Ehh, going to come out and say Matasano is wrong here. You can do crypto in JS, just don't download it every time (distribute signed packages via browser add-ons). The part of the article that attacks extensions just makes a bunch of assumptions (like, you're going to download scripts and eval them from your extension). It's a leap. Plus that article attacks JS doing crypto that the server will decrypt (which, yes is useless, use TLS). It doesn't address using browser add-ons to do AES encryption, have your data stored on the server in encrypted form, and only decrypted when you download it again. Is this method flawed? Only if you do a web-app instead of a browser add-on. Once you package the client code, it can be just as hard to break as something like KeePass (assuming the add-on itself has a decent security policy, ie don't eval()code from random places). Plus, modern browsers now have "window.crypto" which provides a PRNG. So there goes that argument. The article is just completely wrong in many ways. The only valid point I see it make is about garbage collection and potential for reading decrypted memory directly (MANY languages have this problem, not just JS). One of the points you brought up is extremely valid though: LastPass is closed-source, so it's nearly impossible to truly validate the crypto. Keepass (I also use it) is a much better option, and great when paired with some sort of sync utility.
- MichaelGG 13y ago
  >Steve Gibson uses it, I won't pretend to be as capable of speaking to it's benefits so I encourage you to listen to Security Now. The last person you should take security advice is from Steve Gibson. He's done an amazing job of making himself out to be a "security expert" but his understanding of security is ... exceedingly limited. Read this post to see one example how he just, like, doesn't understand anything at all: https://www.grc.com/ssl/ev.htm https://www.grc.com/ssl/ev.htm
fmax30 13y ago
I used to use a site called bugmenot to get accounts like these but now as the passwords there have stopped working i have started to use throwaways. Also my throw away password is 123456789 :P. I was just thinking if my account is not publicly listed then I can just have a really complicated username and use a really simple password. (Complicated as in a SHA 2 or MD5 hash of your real name ). (Just thinking loud)
- coryfklein 13y ago
  What throwaway password do you use for sites with password complexity restrictions? (You know, requiring 1 uppercase, 1 lowercase, 1 special character, etc.)

by criley2 13y ago

robmil 13y ago

You don't need to take the brain-space — use a password manager like 1Password or LastPass, plus a YubiKey for two-factor auth, and you can use unique passwords everywhere.

bargl 13y ago

Don't use any brain space for any passwords (except one ofcourse). https://lastpass.com/ https://lastpass.com/ Steve Gibson uses it, I won't pretend to be as capable of speaking to it's benefits so I encourage you to listen to Security Now. Edit: Last pass can be loaded once in the browser, and if you link it to a yubikey it is much more secure. http://blog.lastpass.com/2010/07/lastpass-gets-green-light-from-security.html http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f....

druiid 13y ago
I personally prefer Dashlane as it has a desktop interface as well. Not a big fan of only having the password manager in the browser, myself.
criley2 13y ago
I use lastpass sometimes, but it seems very insecure to keep passwords on my machine. I don't like keeping lastpass with a master password because typing a strong, long master password every single time I want any password is not a use case I enjoy, and I certainly don't want to lock up my passwords with something that is easily defeatable. And without a strong master password locking every attempt to use lastpass, it becomes far, far less secure than memorizing passwords.
- bargl 13y ago
  I honestly can't do it justice. See what Steve has to say. http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f... http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f.... Also consider linking to a yubikey. https://helpdesk.lastpass.com/security-options/multifactor-authentication-options/yubikey-authentication/ https://helpdesk.lastpass.com/security-options/multifactor-a... EDIT: DO NOT FOR ANY REASON DO THIS >for this reason I recommend writing your passwords down on a piece of paper you keep in your wallet or purse. I cannot respond directly to Munin but anyone who suggest that is going to lead you to this http://www.telegraph.co.uk/news/uknews/crime/10276460/David-Miranda-was-carrying-password-for-secret-files-on-piece-of-paper.html http://www.telegraph.co.uk/news/uknews/crime/10276460/David-... Someone could get a hold of your wallet and take a pic of your passwords then put them back and you'd never know you'd been compromised. And Lastpass uses the trust no one mentality so you don't have to trust them. They never see your password it's encrypted using your password and yubikey if you have one.
  - DanBC 13y ago
    Steve Gibson has some flaws, and you really shouldn't be listening to him for any kind of security advice. If you have obsolete hard drives you might find his spinrite product useful.
    - bqe 13y ago
      Anyone remember his theory that removing raw socket access in Windows XP will stop the impending doom of spoofed packets and mass DDoS? http://www.theregister.co.uk/2001/06/25/steve_gibson_really_is_off/ http://www.theregister.co.uk/2001/06/25/steve_gibson_really_...
  - mseebach 13y ago
    Bruce Schneier thinks it's OK to keep your password on a piece of paper in your wallet. https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo... But, of course, don't write the password to an encrypted drive on a piece of paper that you keep with the drive.
Gormo 13y ago
Are there any advantages of LastPass over KeePass? I've always been very wary about storing passwords in a third-party hosted webapp.
- coryfklein 13y ago
  I'm not familiar with KeePass, but I can tell you that LastPass does not know your master password. They just keep an encrypted copy of your password database which gets decrypted locally when you type in the password. For this reason, if you lose your master password, LastPass can't unlock your passwords for you. You'll have to go to the NSA for that.
- rpdillon 13y ago
  I'm not a security expert, but this seems to be a fair question. I use KeePass (have for years). One of my problems with LastPass is that the whole system is bootstrapped over HTTPS, which is has some insecurities. Essentially, LastPass sends your browser JavaScript via HTTPS which is then used to encrypt all your passwords using AES and send them over the net. The problem is that the original JavaScript payload could be compromised by third parties that have access to the root CA. I realize that revelations about HTTPS insecurity are new and limited to nation-state attacks, but we're talking about all your passwords, here. Putting HTTPS insecurity aside, we really shouldn't be implementing crypto in JavaScript. http://www.matasano.com/articles/javascript-cryptography/ http://www.matasano.com/articles/javascript-cryptography/ KeePass is both native and open-source, so it avoids many of the problems that LastPass presents, IMHO. Simply install the client program and sync via SparkleShare, git, Dropbox, UbuntuOne, Google Drive, etc.
  - orthecreedence 13y ago
    Ehh, going to come out and say Matasano is wrong here. You can do crypto in JS, just don't download it every time (distribute signed packages via browser add-ons). The part of the article that attacks extensions just makes a bunch of assumptions (like, you're going to download scripts and eval them from your extension). It's a leap. Plus that article attacks JS doing crypto that the server will decrypt (which, yes is useless, use TLS). It doesn't address using browser add-ons to do AES encryption, have your data stored on the server in encrypted form, and only decrypted when you download it again. Is this method flawed? Only if you do a web-app instead of a browser add-on. Once you package the client code, it can be just as hard to break as something like KeePass (assuming the add-on itself has a decent security policy, ie don't eval()code from random places). Plus, modern browsers now have "window.crypto" which provides a PRNG. So there goes that argument. The article is just completely wrong in many ways. The only valid point I see it make is about garbage collection and potential for reading decrypted memory directly (MANY languages have this problem, not just JS). One of the points you brought up is extremely valid though: LastPass is closed-source, so it's nearly impossible to truly validate the crypto. Keepass (I also use it) is a much better option, and great when paired with some sort of sync utility.
MichaelGG 13y ago
>Steve Gibson uses it, I won't pretend to be as capable of speaking to it's benefits so I encourage you to listen to Security Now. The last person you should take security advice is from Steve Gibson. He's done an amazing job of making himself out to be a "security expert" but his understanding of security is ... exceedingly limited. Read this post to see one example how he just, like, doesn't understand anything at all: https://www.grc.com/ssl/ev.htm https://www.grc.com/ssl/ev.htm

fmax30 13y ago

I used to use a site called bugmenot to get accounts like these but now as the passwords there have stopped working i have started to use throwaways. Also my throw away password is 123456789 :P. I was just thinking if my account is not publicly listed then I can just have a really complicated username and use a really simple password. (Complicated as in a SHA 2 or MD5 hash of your real name ). (Just thinking loud)

coryfklein 13y ago
What throwaway password do you use for sites with password complexity restrictions? (You know, requiring 1 uppercase, 1 lowercase, 1 special character, etc.)