5 ms·

What's the best way nowadays to protect yourself as a user against this? You certainly can't trust anyone to store your password securely, so you're forced to h

by ah- 11y ago

What's the best way nowadays to protect yourself as a user against this? You certainly can't trust anyone to store your password securely, so you're forced to have a strong password per site, and it's impossible to memorize that many passwords. I'm currently using Password Hasher (https://chrome.google.com/webstore/detail/password-hasher-plus-pass/glopbmohkffbnplcjbbbfmmimfhfnhgd https://chrome.google.com/webstore/detail/password-hasher-pl...), but that only works well because I mostly use just one machine.

yuvadam 11y ago
Use a password manager. KeepassX is a good choice if you only trust yourself (and your backups). LastPass and 1Password are good choices if you don't care about letting others host your (supposedly encrypted) passwords.
- imrehg 11y ago
  Thumbs up for KeePassX too! Also, there's Mitro, encrypted password manager living inside a Chrome extension: https://www.mitro.co/ https://www.mitro.co/
- mannkind 11y ago
  > LastPass and 1Password are good choices if you don't care about letting others host your (supposedly encrypted) passwords. That statement doesn't apply to 1Password; AgileBits does not host your data.
  - becausecomputer 11y ago
    1Password works with Dropbox, unless you manage the storage and backup manually.
    - tetrep 11y ago
      > 1Password works with Dropbox... Because it has the amazing feature of storing all your passwords in a file. It's nothing like the features offered by lastpass with respect to serving you your passwords from a remote host and if you can't trust your password manager to KDF & encrypt then you really shouldn't be using it as it's doubtful it's properly generating secure passwords.
jiayo 11y ago
I am using KeePass Password Safe v2 (while on Windows), and KeePassX on linux and OS X. I use a strong password, and a key file, which is just a blob of random bytes. The encrypted password database (.kdbx) is published to Dropbox, which handles sync across devices. The key file (.key) stays on an encrypted USB stick on my physical keychain, and is physically backed up in a few safe places. It is never published online. This makes it effectively a second factor. I have a domain, example.com, which is set up for wildcard email forwarding. When I sign up for a service, I use servicename@example.com (recently I have started obscuring this a bit more, e.g. srvcnm.49jg49kf34@example.com). This limits password reset exposure, and also the ability for other services that are in cahoots with each other to link my accounts together by email address. Everything connected to this domain (registrar, DNS provider, email provider) is protected by separate TOTP 2FA tokens. I simply do not access any authenticated services if I don't have access to KeePass and my password vault. I have over 250 entries in my vault. At this point, it's less about remembering and generating passwords than it is about keeping track of what I've signed up for and when. Some things, you only look at once every few years, and my S.O.P. before KeePass was usually password resets. For extremely high value accounts, I have memorized a "prefix" which I prepend to generated passwords. This limits exposure in the case my entire password database leaks, to just things like hackernews, reddit and other low value services. I do not use KeePass for my dropbox password, because I could end up locked out entirely. So this is really 3 things to remember: Password vault password, Dropbox password, and high security prefix. There are some weaknesses in this scheme. As another user mentioned below, I am not invulnerable to an @N style hijacking. Someone could socially engineer my registrar, DNS provider or email provider, hijack my email and then initiate a password reset. I'm not sure how to defend against this. Common knowledge is to not use custom domains, since it's easier to hijack example.com than gmail.com, but for me the value of having unique email accounts per service is too high to give up. The other obvious point of vulnerability is keyloggers and trojans that attack the KeePass processes directly. This is not something I've spent a lot of time thinking about. It is a scorched earth scenario, and in that case I won't be the only one in trouble. This method has served me well for over 5 years. I've acknowledged there's some flaws here, but I fundamentally do not trust any of the online password management services (LastPass, 1Password, etc.) and I find the idea of paying to store/access them distasteful at best and extortionate at worst. edit: I also use KeePass to generate my security questions. Very few online services are savvy enough to use a one-way hash on these questions, that are the keys to the castle. I've had to recite these to support reps over the phone, who can see them in clear text. e.g., What was the name of the street you grew up on? => xcmqbbpgpuuxyrdw What was your first pet's name? => owuynnfhwscgigciq
deleted 11y ago
[deleted]
hobarrera 11y ago
pass[1] is a pretty good choice. But you also have to make sure your provider really follows decent security practices. gandi.net is a pretty decent provider not full of BS (as their slogan states). [1]: http://zx2c4.com/projects/password-store/ http://zx2c4.com/projects/password-store/
ufmace 11y ago
I've come to the conclusion that the most important thing by far is a different password for every site. If you do nothing else, figure out a way to do that. It's probably also a good idea to make sure that your security question answers are anything but the actual answers to those questions. I prefer looking up random words for each one, and storing them in the Lastpass entry for the site. I view password complexity and obsessing over how hard it would be to crack your password hash with various setups to be of little value. If they're far enough in to get your password hash, it's better to assume they can see and do anything and everything on the site even if they can't crack your password. If you've actually used a different password on every site, there isn't much left to worry about. Still, if you're using a password manager, it's cheap to make all of your passwords long, random strings with upper, lower, numbers, and specials, so why not do it?

by ah- 11y ago

yuvadam 11y ago

Use a password manager. KeepassX is a good choice if you only trust yourself (and your backups). LastPass and 1Password are good choices if you don't care about letting others host your (supposedly encrypted) passwords.

imrehg 11y ago
Thumbs up for KeePassX too! Also, there's Mitro, encrypted password manager living inside a Chrome extension: https://www.mitro.co/ https://www.mitro.co/
mannkind 11y ago
> LastPass and 1Password are good choices if you don't care about letting others host your (supposedly encrypted) passwords. That statement doesn't apply to 1Password; AgileBits does not host your data.
- becausecomputer 11y ago
  1Password works with Dropbox, unless you manage the storage and backup manually.
  - tetrep 11y ago
    > 1Password works with Dropbox... Because it has the amazing feature of storing all your passwords in a file. It's nothing like the features offered by lastpass with respect to serving you your passwords from a remote host and if you can't trust your password manager to KDF & encrypt then you really shouldn't be using it as it's doubtful it's properly generating secure passwords.

jiayo 11y ago

I am using KeePass Password Safe v2 (while on Windows), and KeePassX on linux and OS X. I use a strong password, and a key file, which is just a blob of random bytes. The encrypted password database (.kdbx) is published to Dropbox, which handles sync across devices. The key file (.key) stays on an encrypted USB stick on my physical keychain, and is physically backed up in a few safe places. It is never published online. This makes it effectively a second factor. I have a domain, example.com, which is set up for wildcard email forwarding. When I sign up for a service, I use servicename@example.com (recently I have started obscuring this a bit more, e.g. srvcnm.49jg49kf34@example.com). This limits password reset exposure, and also the ability for other services that are in cahoots with each other to link my accounts together by email address. Everything connected to this domain (registrar, DNS provider, email provider) is protected by separate TOTP 2FA tokens. I simply do not access any authenticated services if I don't have access to KeePass and my password vault. I have over 250 entries in my vault. At this point, it's less about remembering and generating passwords than it is about keeping track of what I've signed up for and when. Some things, you only look at once every few years, and my S.O.P. before KeePass was usually password resets. For extremely high value accounts, I have memorized a "prefix" which I prepend to generated passwords. This limits exposure in the case my entire password database leaks, to just things like hackernews, reddit and other low value services. I do not use KeePass for my dropbox password, because I could end up locked out entirely. So this is really 3 things to remember: Password vault password, Dropbox password, and high security prefix. There are some weaknesses in this scheme. As another user mentioned below, I am not invulnerable to an @N style hijacking. Someone could socially engineer my registrar, DNS provider or email provider, hijack my email and then initiate a password reset. I'm not sure how to defend against this. Common knowledge is to not use custom domains, since it's easier to hijack example.com than gmail.com, but for me the value of having unique email accounts per service is too high to give up. The other obvious point of vulnerability is keyloggers and trojans that attack the KeePass processes directly. This is not something I've spent a lot of time thinking about. It is a scorched earth scenario, and in that case I won't be the only one in trouble. This method has served me well for over 5 years. I've acknowledged there's some flaws here, but I fundamentally do not trust any of the online password management services (LastPass, 1Password, etc.) and I find the idea of paying to store/access them distasteful at best and extortionate at worst. edit: I also use KeePass to generate my security questions. Very few online services are savvy enough to use a one-way hash on these questions, that are the keys to the castle. I've had to recite these to support reps over the phone, who can see them in clear text. e.g., What was the name of the street you grew up on? => xcmqbbpgpuuxyrdw What was your first pet's name? => owuynnfhwscgigciq

deleted 11y ago

[deleted]

hobarrera 11y ago

pass[1] is a pretty good choice. But you also have to make sure your provider really follows decent security practices. gandi.net is a pretty decent provider not full of BS (as their slogan states). [1]: http://zx2c4.com/projects/password-store/ http://zx2c4.com/projects/password-store/

ufmace 11y ago

I've come to the conclusion that the most important thing by far is a different password for every site. If you do nothing else, figure out a way to do that. It's probably also a good idea to make sure that your security question answers are anything but the actual answers to those questions. I prefer looking up random words for each one, and storing them in the Lastpass entry for the site. I view password complexity and obsessing over how hard it would be to crack your password hash with various setups to be of little value. If they're far enough in to get your password hash, it's better to assume they can see and do anything and everything on the site even if they can't crack your password. If you've actually used a different password on every site, there isn't much left to worry about. Still, if you're using a password manager, it's cheap to make all of your passwords long, random strings with upper, lower, numbers, and specials, so why not do it?