Hacker News Reader

Comment by Wowfunhappy | Hacker News Reader

I really don't like this website. The criteria appears to be "things Mozilla thinks technology companies should be doing", and not necessarily related to privacy.

For example—sites get downgraded if they don't require strong passwords. Now, maybe websites should require strong passwords, that's a completely reasonable position to take. But if you, the user, are using a strong password, whether or not others are required to use strong passwords has no impact on your privacy. Especially because privacy ≠ security.

View on HN

I agree. This site seems unnecessarily inflammatory and confrontational. Purely elitist PR publicity nonsense instead of educational. It's a bad look on Mozilla and it turns me off.

Talk up your own features instead of smearing other people's products. Products that aren't even your competition, I might add!

It's flame bait for its own sake, trying to take advantage of outrage culture in an attention economy.

Be better, Mozilla.

The site has a section that explains the criteria including that Mozilla didn't decide on them alone but with other non-profits.

Regarding passwords: "If the product uses passwords for remote authentication, it must require that strong passwords are used, including having password strength requirements. Any non-unique default passwords must also be reset as part of the device’s initial setup. This helps protect the device from vulnerability to guessable password attacks, which could result in a compromised device."

https://foundation.mozilla.org/en/privacynotincluded/about/m...

> sites get downgraded if they don't require strong passwords

Assuming "strong", as usual, means uses upper+lower letters, numbers, symbols, etc., this directly contradicts NIST's current password recommendations. They recommend enforcing a minimum length instead, and recommend a "minimum minimum" of 8. They also recommend checking passwords against a set of the most common ones from leaks. The NCSC's top 100k list is good (pre-filtering those under your minimum helps too--only 47k remain after removing pws under 8 chars): https://github.com/danielmiessler/SecLists/blob/master/Passw...

From my understanding, the only real way to create a password is to make it really, really long. Like, "Sometimes 10 people will get together on Friday night. Wow!" Or whatever you want. Makes it easy to remember. Personally I just usually string a bunch of random numbers and upper/lower/special characters - 40 of them. Just like this: https://www.youtube.com/watch?v=rERApU26PcA

I tried long memorable passphrases for a time, but a few of my passphrases were not as memorable as I expected and I ended up having to reset several of them. Eventually I got fed up with it and switched to an offline FOSS password manager and use generated passwords from that. To unlock the password manager, I use a single long passphrase that I am confident I can remember. Now I worry that I'm putting all my eggs in one basket, but at least my passwords won't be guessed or forgotten.

Right. I always make sure to write them all down, as I won't remember either.

But they are to make sure that random hackers don't gain access. Nobody is really going to break into my office and steal my passwords, as I am not an international spy.

> if you, the user, are using a strong password, whether or not others are required to use strong passwords has no impact on your privacy

That only applies if the site only gives you access to your own data. If your friends grant you access to some of their data, your poor security compromises their privacy.

The most absurd claims are for the Nintendo Switch. They blame it for having a third-party software which collect real vehicle driving data and send its data to the third-party's server.

https://foundation.mozilla.org/en/privacynotincluded/nintend...

By the same logic, Firefox has a third-party software(Hacker News) which collect and send data to the third-party's server. Gosh I shall be scared.

Or they are so lacking the technical analysis. Lego apps for example:

https://foundation.mozilla.org/en/privacynotincluded/lego-hi...

They conclude it's safe because they can use it offline... after they download and install the special smartphone apps to their smartphone. Seriously I see no smartphone that honor my privacy. By using the smartphone, it's already fail. Also, It seems they don't say that based on reverse engineering effort to make sure the app do nothing wrong. If I was a malicious app developer, I just store the data to the local storage and upload it the next convenient time the network access is available.

> whether or not others are required to use strong passwords has no impact on your privacy.

It's worth considering, though, that attackers may target sites that don't mandate strong passwords, because the password hashes in the site's database are likely to be easier to crack (and users with simple passwords are likely to reuse those passwords).

Once an attacker has chosen to target that site, that increases the chances that they find themselves able to read your data regardless of the password you used, because they'll have access to the whole database.

In fact, a site which hasn't put the engineering effort into enforcing strong passwords (not even a simple regex, let alone more complex approaches like checking for compromised passwords against the haveibeenpwned database) is also likely to have undervalued security in other areas, again making them a target.

It also works the other way though. If attackers target the site, they'll know some users have weak passwords, so if you have a strong password, they'll move on quickly to easier targets.

I'd say on the whole it evens out.

I don’t see this as even remotely “evening out” the parent comment.

If a site mandates strong passwords, it is more likely to follow other best practices like throttling login attempts and locking accounts after too many failed attempts (either per account or per IP).

If attackers target the site, they should only have a limited number of attempts before they start getting thwarted.

It would take a lot of attempts (exact numbers will vary) just to determine if a given user’s credentials are strong or not, so the adversary has already wasted significant effort on the accounts they will eventually “move on” from. If the site has throttling and/ or account lockout, the adversary should not be able to determine who has weak versus strong passwords.

> and locking accounts after too many failed attempts (either per account

This is not a best practice, this is a DoS.

All good points, thanks for your input. I liked it as I haven’t seen a similar ones from a reptile company but agree it could be better.

> I haven’t seen a similar ones from a reptile company

I know this is a typo, but it's also an excellent pun.

What is it a typo of?

Presumably reputable.

Reply on news.ycombinator.com