Hacker News Reader

Comment by freitzkriesler2 | Hacker News Reader

Ugh I have a smattering of accounts that use the same password before I wised up and started using a generator. My important accounts are secure by 2fa however and a strong password.

One day I'll sit down and just go through them all to fix them. Maybe just pay for wifi on a flight and clean it up.

View on HN

> One day I'll sit down and just go through them all to fix them. Maybe just pay for wifi on a flight and clean it up.

Maybe do it while being connected to a network that isn't infamous for its poor security :)

I'm not super educated on security stuff, but would airplane wifi add any significant risk?

I'd think that as long as your laptop isn't already compromised, and you don't need to use someone's proxy server, HTTPS would be secure enough. I.e., no worse than doing it from home.

The biggest risk is random mobile apps that disable HTTPS certificate checking, run APIs over plain HTTP, etc. On public Wi-Fi, anyone physically near you can intercept or snoop on that traffic.

Browsers generally do a good job of ensuring HTTPS these days, but still you should pay attention to make sure you're on HTTPS when using public Wi-Fi.

HTTPS fixes that

One day I'll sit down and just go through them all to fix them.

I had a spate of going through and putting in 2FA on everything 1Password indicated could have it.

Then, I had another spate of changing all my passwords on accounts I still had in my defunct LastPass. (I switched from LastPass to 1Password before the big breach.)

You should try going through the list and deleting accounts you never use anymore. That one's always fun because many companies try to hide the delete account button or simply don't have one

There are services that do this by using GDPR rights. I think they scan email for "Welcome" emails, then automate the account deletion as far as possible.

We get about 5 emails a year at work through these services, as we don't have a "delete account" button.

My password tool shows me which are oldest. So, quarterly (on tax day) I also make sure to change a few of them.

What's the theory? Nobody is spending a year to crack your passwords or use a leaked password, so either they are strong enough to resist online or offline attacks, or they aren't. If they aren't strong enough, then you would have to rotate much more often than every few years.

Nobody is spending a year to crack your passwords or use a leaked password

How strong is that nowadays? How many bits of entropy?

they may not, but if there is a password dump, you password isn't super old and has been rotated fairly recently

Theory is that I'll rotate out passwords insecure? systems.

One case I know is that in one system my old password was hashed with an older method (which was the right choice at the time) and when I reset I'm now using their updated (right choice today) hash.

Another feature is that services I don't use I'm reminded to close/deactivate.

Assuming we start from the position of having a unique, never-before-seen password for each account (which is what we should all be doing, right?), rotating doesn't do anything.

And if we accept that most people don't use unique, never-before-seen passwords and that a password has been included in a plaintext dump, rotating passwords periodically doesn't even protect from password spray attacks, since someone has likely used that password before and you'll still be vulnerable.

> One day I'll sit down and just go through them all to fix them.

I like to tell this to myself every time I log onto my online banking using the 'Temporary <credit union name>' entry in bitwarden.

One day.

Reply on news.ycombinator.com