9 ms·

Whats terrifying is that they are referring to "their password" and not their passwords. Password reuse is much worse that having a weak password. Hackers only

by seanieb 12y ago

Whats terrifying is that they are referring to "their password" and not their passwords. Password reuse is much worse that having a weak password. Hackers only brute force high value targets, everyone else should just aim to have unique passwords for every service they use. However, the average person can only remember 5-10 unique passwords and they have many many accounts...password reuse. For the average person password managers aren't an option for normal people, so we have a big problem.

deleted 12y ago
[deleted]
- ihaveajob 12y ago
  This. Or a similar pattern thereof that's harder to guess even by the administrator of a malicious site with access to one such password. Like your random string followed by the first and third letter of the domain.
  - valarauca1 12y ago
    That would lead to shorter passwords. Normally domain names are pretty long, and just containing a common string like .com doesn't make inverting hashes any easier.
- r00fus 12y ago
  The problem with the 2nd approach is password restrictions (some of which, stupidly, reduce the key space rather than increase it - all uppercase required on some banks? yes it happens). Another annoying but logical constraint is the one where sites query your pwd for references to the site itself and tell you not to include that - another strike against that appending approach. The requirements vary, are conflicting and change over time. I tried your approach, but then gave up after repeatedly forgetting what restrictions applied for which site - altering my specific password and making it non-memorable. Enter 1Password.
- hackuser 12y ago
  > Create a simple random character string "tjxmvg123" that you can remember easily. Append the name of the website you are using to the end of this. I.E.: tjxmvg123hackernews.com Am I missing something? I'm surprised to be the first to point out that this is very dangerous advice (to the extent bad passwords are dangerous). All it does is add one, easily guessable bit of information -- for the first password the attacker seeks. And after someone has the first password, this method adds zero security; the attacker then has the passwords for every other website.
- mikeash 12y ago
  I don't think that's a good approach. A good approach to me is one which works when a large number of people do it and attackers are aware of it. Appending the site name to a shared password in order to make it unique is security through obscurity, and won't help you at all if attackers know about the technique. There is something to be said for the philosophy of, "I don't have to run faster than the bear, I just have to run faster than you." But in this particular case, at least, it's not hard to do better than that.
  - joshjdr 12y ago
    I think it's a decent approach, in spirit. Don't use the domain name as suggested; come up with your own algorithm based on the website or whatever else. Combining a fixed string with a variable component based on the website is easy to remember and different from site to site. It's not too hard to make to make all your passwords long and complex with this approach, too. For most purposes- Thumbs up!
    - mikeash 12y ago
      I think it all comes down to how you do the combining. For example, if you take a fixed secret string, append the site name, SHA256 the whole mess, and then derive a password from the hash, that's reasonably secure and only requires you to memorize one secret. The downside is that you need to perform SHA256 whenever you want the password for a particular site. But if you take a fixed password and merely concatenate something derived from the site name to get the site-specific password, that's not secure. You're counting on the attacker not figuring out your "something derived from" and that's security by obscurity. (Unless your algorithm involves mixing in some hard-to-guess secret, but then you're back at my suggestion above with a bit of extra stuff tacked on.)
      - joshjdr 12y ago
        This was just a response to the "'Aunt Tillie'-types" comment and replies. I'm not trying to preach to the HN reader. If the average user were setting a password for their google account, and their fixed string was U$erN4m3* and their variable component was the URL backwards moc.elgoog, to create the password U$erN4m3*moc.elgoog they are far, far beyond typical password security. You, Sir, with due respect, are correct, but are a few steps past practical or easy to remember.
- Terr_ 12y ago
  This is one I've been recommending to "Aunt Tillie"-types, because it involves fairly little computer-savvy: 1. Memorize a single prefix that has at least an uppercase letter, a number, and a symbol, to be used with all passwords. (e.g. j8$F) 2. Use a physical journal or pad of paper to note down each site's password restrictions (e.g. "no symbols") and a personal hint to the rest of the password. 3. Your password is the prefix (minus any unsupported characters) plus the answer to the hint. So the hint "No symbols, They All Float Down Here" might become j8fPennyWise. "Feet On The Road" might be j8$fFlintstones. ___ This minimizes what people have to memorize, is secure against casual attacks by people in the same physical area, is strong against attackers who might try to replace "password4hn" with "password4reddit", and doesn't require any sort of special software.
  - aroman 12y ago
    This strikes me as a really good strategy. Thanks for sharing. At first I thought you were going to advocate the "just pick a prefix and then append the name of the site after it", like Go123facebook and Go123gmail. Which is, of course, quite awful because one plaintext reversing of one password may very well defeat all of the other passwords.
    - Terr_ 12y ago
      I figure if people are going to write things down on sticky notes anyway, it might as well be part of the system. Hmmm... also, there's a failure-mode with systems that notice the prefix and reject future passwords as "too similar to one you used before". Users would have to deviate from the strategy somehow.
  - diversewhat 12y ago
    You just have to watch out for hackers who are also cruciverbalists...
    - Terr_ 12y ago
      True, but you're probably safe from hackers XOR cruciverbalists.
kijin 12y ago
> For the average person password managers aren't an option Why not? Every major browser in its default configuration offers to remember your passwords, and some will even offer to sync them across all your devices. The only thing that's missing is an offer to generate random passwords automatically, for which you currently need an add-on/extension. But even without that ability, the browser is already a pretty decent password manager.
- crazygringo 12y ago
  Because it breaks ALL the time. On plenty of sites, Chrome/FF/IE/etc. will fail to recognize a user or password field. They'll often fail to recognize them at account creation. Sometimes you'll need multiple accounts on a single domain, which Chrome can't handle (for example). I could go on and on... Browsers remember passwords as a mere convenience, when it happens to work. They are in no way "proper" password managers, which are encrypted with a master password, can be exported and backed up, handle multiple accounts, etc...
  - kijin 12y ago
    Good point. But since some of the best password managers are already open source, I wonder what's preventing browser vendors from integrating at least some of the functionality. A good password manager not only helps contain the damage of leaked passwords, but also does a very good job at protecting users from phishing attacks at similar-looking domains. All the browsers have been pretty stagnant on this front for the last few years. I suspect they've been hoping that everyone will move to an SSO platform in which the browser vendors themselves have a vested interest (Mozilla Persona, Google account, Microsoft account).

by seanieb 12y ago

deleted 12y ago

[deleted]

ihaveajob 12y ago
This. Or a similar pattern thereof that's harder to guess even by the administrator of a malicious site with access to one such password. Like your random string followed by the first and third letter of the domain.
- valarauca1 12y ago
  That would lead to shorter passwords. Normally domain names are pretty long, and just containing a common string like .com doesn't make inverting hashes any easier.
r00fus 12y ago
The problem with the 2nd approach is password restrictions (some of which, stupidly, reduce the key space rather than increase it - all uppercase required on some banks? yes it happens). Another annoying but logical constraint is the one where sites query your pwd for references to the site itself and tell you not to include that - another strike against that appending approach. The requirements vary, are conflicting and change over time. I tried your approach, but then gave up after repeatedly forgetting what restrictions applied for which site - altering my specific password and making it non-memorable. Enter 1Password.
hackuser 12y ago
> Create a simple random character string "tjxmvg123" that you can remember easily. Append the name of the website you are using to the end of this. I.E.: tjxmvg123hackernews.com Am I missing something? I'm surprised to be the first to point out that this is very dangerous advice (to the extent bad passwords are dangerous). All it does is add one, easily guessable bit of information -- for the first password the attacker seeks. And after someone has the first password, this method adds zero security; the attacker then has the passwords for every other website.
mikeash 12y ago
I don't think that's a good approach. A good approach to me is one which works when a large number of people do it and attackers are aware of it. Appending the site name to a shared password in order to make it unique is security through obscurity, and won't help you at all if attackers know about the technique. There is something to be said for the philosophy of, "I don't have to run faster than the bear, I just have to run faster than you." But in this particular case, at least, it's not hard to do better than that.
- joshjdr 12y ago
  I think it's a decent approach, in spirit. Don't use the domain name as suggested; come up with your own algorithm based on the website or whatever else. Combining a fixed string with a variable component based on the website is easy to remember and different from site to site. It's not too hard to make to make all your passwords long and complex with this approach, too. For most purposes- Thumbs up!
  - mikeash 12y ago
    I think it all comes down to how you do the combining. For example, if you take a fixed secret string, append the site name, SHA256 the whole mess, and then derive a password from the hash, that's reasonably secure and only requires you to memorize one secret. The downside is that you need to perform SHA256 whenever you want the password for a particular site. But if you take a fixed password and merely concatenate something derived from the site name to get the site-specific password, that's not secure. You're counting on the attacker not figuring out your "something derived from" and that's security by obscurity. (Unless your algorithm involves mixing in some hard-to-guess secret, but then you're back at my suggestion above with a bit of extra stuff tacked on.)
    - joshjdr 12y ago
      This was just a response to the "'Aunt Tillie'-types" comment and replies. I'm not trying to preach to the HN reader. If the average user were setting a password for their google account, and their fixed string was U$erN4m3* and their variable component was the URL backwards moc.elgoog, to create the password U$erN4m3*moc.elgoog they are far, far beyond typical password security. You, Sir, with due respect, are correct, but are a few steps past practical or easy to remember.
Terr_ 12y ago
This is one I've been recommending to "Aunt Tillie"-types, because it involves fairly little computer-savvy: 1. Memorize a single prefix that has at least an uppercase letter, a number, and a symbol, to be used with all passwords. (e.g. j8$F) 2. Use a physical journal or pad of paper to note down each site's password restrictions (e.g. "no symbols") and a personal hint to the rest of the password. 3. Your password is the prefix (minus any unsupported characters) plus the answer to the hint. So the hint "No symbols, They All Float Down Here" might become j8fPennyWise. "Feet On The Road" might be j8$fFlintstones. ___ This minimizes what people have to memorize, is secure against casual attacks by people in the same physical area, is strong against attackers who might try to replace "password4hn" with "password4reddit", and doesn't require any sort of special software.
- aroman 12y ago
  This strikes me as a really good strategy. Thanks for sharing. At first I thought you were going to advocate the "just pick a prefix and then append the name of the site after it", like Go123facebook and Go123gmail. Which is, of course, quite awful because one plaintext reversing of one password may very well defeat all of the other passwords.
  - Terr_ 12y ago
    I figure if people are going to write things down on sticky notes anyway, it might as well be part of the system. Hmmm... also, there's a failure-mode with systems that notice the prefix and reject future passwords as "too similar to one you used before". Users would have to deviate from the strategy somehow.
- diversewhat 12y ago
  You just have to watch out for hackers who are also cruciverbalists...
  - Terr_ 12y ago
    True, but you're probably safe from hackers XOR cruciverbalists.

kijin 12y ago

> For the average person password managers aren't an option Why not? Every major browser in its default configuration offers to remember your passwords, and some will even offer to sync them across all your devices. The only thing that's missing is an offer to generate random passwords automatically, for which you currently need an add-on/extension. But even without that ability, the browser is already a pretty decent password manager.

crazygringo 12y ago
Because it breaks ALL the time. On plenty of sites, Chrome/FF/IE/etc. will fail to recognize a user or password field. They'll often fail to recognize them at account creation. Sometimes you'll need multiple accounts on a single domain, which Chrome can't handle (for example). I could go on and on... Browsers remember passwords as a mere convenience, when it happens to work. They are in no way "proper" password managers, which are encrypted with a master password, can be exported and backed up, handle multiple accounts, etc...
- kijin 12y ago
  Good point. But since some of the best password managers are already open source, I wonder what's preventing browser vendors from integrating at least some of the functionality. A good password manager not only helps contain the damage of leaked passwords, but also does a very good job at protecting users from phishing attacks at similar-looking domains. All the browsers have been pretty stagnant on this front for the last few years. I suspect they've been hoping that everyone will move to an SSO platform in which the browser vendors themselves have a vested interest (Mozilla Persona, Google account, Microsoft account).