Hacker News Reader

Comment by blowski | Hacker News Reader

Use a paper notepad. Generate passwords by opening a dictionary at random for 3 words, with a random number at the end.

It’s not as good as, say, 1Password but it’s more likely to get used. Combine it with the browser or OS level password manager. It’s good enough for grandma, definitely better than “kitten4” that she’s currently using everywhere.

On a tangent, stereotyping this as “grandma” is a bit unfair. Most of my colleagues are college educated males in their 20s, some of them developers. And their passwords are rubbish, with no password manager, and no 2fa.

View on HN

Aside from how painful that sounds, paper notepads can easily get lost. And if she's out and wants to check stuff on her phone (or trying to check her bank account at my aunt's home, or whatever), is she supposed to carry it all around and risk getting it stolen? If that's the implication, I'd rather she just have kitten4 at that point.

(And re: the grandma thing: it's nothing specific to grandmas, it's because the moment you suggest your audience is "college educated developers in their twenties" as in your case, people throw the notion of UI/UX out the window and recommend you suggest they compile their own kernel first. It seems you just can't win.)

We are obviously talking about a different stereotype. My “grandma” already keeps various notepads - recipes, appointments, address books. And she never has an urgent need to check her bank account while at Auntie Rita’s. As such, this fits her needs and workflow.

Yeah. In fact most likely, she's already written down "kitten4" in a notepad somewhere, because she doesn't trust herself to remember. So asking her to use a slightly longer password is not a massive change.

If we make a crude risk assessment, it is way more likely that her account will be randomly hacked by a botnet if she has "kitten4" as a password than someone actively stealing her purse to get her passwords. And if the notebook with passwords was stolen/lost, she would at least know it and be able to take preventive measures.

For most people, writing (good and unique) passwords down in a notepad is a way more secure system than having the same bad password for every account.

You only need unique passwords and a username.

Having a botnet guessing the random "kitten4" password for a random user account, is as likely as having your purse stolen for the passwords on that note. FWIW "m" is almost a secure password on a root account with an SSH that allows password authentication, even if you allow brute force attacks. Imperically speaking, obvisouly it's going to fail in the end but I hope you get my drift.

> FWIW "m" is almost a secure password on a root account with an SSH that allows password authentication

This is very counter-intuitive. Is the idea that guessing both the username and the password together is much harder than guessing the password when you already know the username?

In the kitten4 example, I would guess most botnets are working from a list of usernames/email addresses that they got from leaks.

Thanks, I missunderstood GP about how kitten4 was used.

> Is the idea that guessing both the username and the password together is much harder than guessing the password when you already know the username?

No, to be clearer no one in the last 6 years has ever tried "m" as a password on my root accounts.

I feel very strongly that there is too much stigma around passwords, kitten4 is a nice password if you use it only once.

> Use a paper notepad.

That's what my grandpa does. After failing to find his gmail address in it, he went through the "forgotten password" process. Then, after needing it the third time, we found the old password in the notebook, which was now wrong...

3 words isn't nearly enough. Typically you'd want at least 6-7, or ideally 8-9.

Depends on what you're protecting. Try not to lose sight of the idea that security doesn't exist in a vacuum.

Xkcd's classical correct course battery staple is about 40 bits is entropy, while being selected uniformly at random from a fairly large pool of words.

I can assure you that the average user wouldn't get above 15 - 20 bits with self selected words. That's often worse than most current passwords.

Reply on news.ycombinator.com