Hacker News Reader

Hacker News

Comment by RockyMcNuts | Hacker News Reader

Full thread

RockyMcNuts

good article on how to fix insecure passwords -

http://www.slate.com/articles/technology/technology/2009/07/...

take a phrase - ask not what you can do for your country -> Anwycd4yc

for each site mix in some letters from the domain, ie 2nd two letters of amazon -> maAnwycd4yc

bingo - easy to remember - strong - unique for each site

password safe like keypass is also good. occasionally you get services with silly password rules where your generator function doesn't return a valid password.

still important to have 2 factor on that one email account that has your banks etc., otherwise one encounter with one of these bad boys and it's all over -

http://www.google.com/search?q=usb+keylogger&tbm=isch

View on HN

It's really quite amazing that I can use 2 factor authentication both my google accounts and facebook. When I see people get "hacked" and lose access to their email and facebook I always advise them to turn it on. Ironically, they decide that its too much work to protect themselves and would rather take the risk. For non-techies I think that mentality is quite common, its quite scary. I wonder if its possible to have an user friendly, secure authentication system.

User friendly secure system: a brick with a smiley face painted on it.

They just don't know the merits of two factor authentication. That's said, however, as both services allows users to "remember" the sessions for a lengthier period of time, it's still insecure to sign in two those services even with two-factor authentication.

What attack can you make with the "remembered browsers" feature that you couldn't do without it? Stealing someone's computer and password and doing things with that?

XKCD has an infographic on password security:

http://xkcd.com/936/

This isn't really true. Its four English words, which is four "choice variables" if you're sampling from an English words character set.

Four choice variables each with tens of thousands of possibilities, yes, yielding greater entropy at lower cognitive cost.

Put another way, Oxford lists over 250000 words in English. There are 26 letters. So we have:

250000^4 = 4 x 10^21 combinations

26^(~10 characters) = ~10^14 combinations

Even counting for capitolization and numbers and symbols, you get something like:

72^(~10) = 4 x 10^18

Except that nobody will use the full range of the Oxford dictionary.

Yeah, well, even if you use 1/8 of the Oxford dictionary you're still around parity with a 10-symbol password using lower case, capitols, symbols and numbers. At which point we fall back to Randall's observation- one is a whole hell of a lot easier to remember than the other.

The comic actually had a mouseover punch line about people like you:

> To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize.

You are the "someone who does not".

Please do the calculations described in the comic and tell us what your results are.

This is a silly advice. When you do this for lots of websites you most likely won't remember all of them correctly. I think the best solution is using a password manager (KeepassX, Lastpass, etc) which store the passwords in an encrypted file (only requiring one master password). Put that encrypted file into Dropbox and the passwords are available across all your devices as well as online.

Actually, I do exactly this, and I do remember them all correctly. The key is to be consistent about WHAT you mix in from the site. I also use 1Password, but it's frankly a pain on the iPhone (there's no good way for them to integrate with Mobile Safari), and it's handy to be able to use my passwords on others' computers without having to look them up.

Why not just make your password 'AskNotWhatYouCanDoForYourCountry'? That seems pretty strong to me.

If someone gets hold of your password from one source, the goal is that they won't be able to use it in other places, hence the "ma" from Amazon in his example.

If I have maAskNotWhatYouCanDoForYourCountry then someone seeing it could possible guess the relevance of the ma, and try ew or hn, etc. on this site.

Woth maAnwycd4yc on the other hand, without being told, are you going to guess that maybe it's a generic password with a small site-specific portion?

Some websites cut your password off at twelve or even six characters. What this means is that your long password when you enter it into the password form is only 'AskNot'. That's not so hard to brute force.

To avoid confusion some websites let you type in x characters, but only take the first y characters.

That works too.

My main reason is: a pain to type on a mobile device

As others mentioned: may also get truncated or not accepted as a valid password due to length; if you added Amazon in there somewhere it might be easy to reverse engineer for other sites

Well, I would think one should avoid using a famous quotation outright.

My passwords tend to be based off nonsense sentences. Personalized nonsense I can remember, but nonsense nonetheless.

I personally use a really stupid trick for remembering my passwords - use profanities, vulgarities and "things that you shouldn't say out loud" in your passwords and mix them with something silly. They are infinitely easier to remember then.

That's great until you're on the phone with customer service and you have to tell them your password. Kind of embarrassing.

They should be embarassed about asking you to give your password over the phone.

I've never had to give a web system password over the phone. In which cases would this happen?

Yeah, I actually had to send one of my passwords to one of my friends in SMS (I know, totally insecure etc, but time was more critical at that time than security). I felt a little.... embarrassed afterwards.

I'm far more used to emails cautioning not to reveal my password to anyone since they will never ask for it than to having my password legitimately asked for.

Reply on news.ycombinator.com