Hacker News Reader

Comment by cgb223 | Hacker News Reader

Probably not a great idea to post your phone password on a public forum...

He used the term "preferred", in the past tense. I think we can safely assume that he has a different passcode or device now.

The likelihood that anyone who sees this will also ever have physical access to their phone is astronomical.

My disk encryption password is 1223334. Doesn't do you much good when you have to be sitting in front of my computer to use it.

> The likelihood that anyone who sees this will also ever have physical access to their phone is astronomical.

Presumably you mean (that likelihood)^{-1}.

Not sure if I miss any sarcasm here, but why would you chose a such weak password for disk encryption?

Why would I choose something I can’t remember? There are a couple of scenarios: either someone has all the time in the world to crack the password, in which case it doesn’t matter how complex it is. Or they don’t have a lot of time and are typing it in by hand, in which case guessing 1223334 is fairly unlikely.

What about the following scenario?

An associate (personal, professional, business, etc.) of yours knows your HN handle and has read your post, above.

At some point, that associate is with you when you are using your computer. You briefly leave your machine unattended and unlocked for whatever reason (e.g. restroom).

Your associate now may be able to compromise your security.

Extending the above scenario: what happens when the above post draws the attention of people who decide to become an associate of yours after the fact (aka "spearphishing")?

You’re right, I’m going to track him down and befriend him in person now that I know his passcode. That’s worth my time and money instead of, I don’t know, just beating him with a shovel until he tells me his password. Or picking a victim I already know. Or any other number of far more likely and easily executed schemes.

Social engineering has the "advantage" that the compromise may go undetected longer than with cruder methods such as torture.

I think picking a passcode based on something other than pure randomness (let alone a TV show you like) is almost as bad.

Yep, that's why I changed it to a random one as soon as I found the site that randomizes such things.

Why? How do you know who he/she is?

Reply on news.ycombinator.com