Hacker News Reader

Comment by BadassFractal | Hacker News Reader

I'm concerned that this is happening so often that it is no longer raising eyebrows. It's becoming one of those "just how things work on the Internet, get used to it".

View on HN

One of the many reasons using a password manager and having different, random passwords for each site is a good idea.

I agree. As long as the password authentication mechanism is in place, unique, random, and complex passwords are the best way to secure yourself. Unless you can memorize each of these unique passwords yourself, the next best thing is to use a secure password manager program to take care of this for you.

I follow this in practice, but I always have to wonder: what if someone gets my password database and breaks it? It would only take a keylogging trojan to get everything they needed.

I would be in for a world of hurt! Way worse than if a few of my accounts were compromised because I had used the same password. But still, the chances of being compromised are probably much smaller.

As mentioned by other people in other recent threads some good quality password safe programs work with Yubikey, so an attacker needs something you know (your password) and something you have (your Yubikey).

I'd be interested in seeing some robust analysis of password safe software. But "Password safe" and "keepass" appear to be reputable.

I'd also like a native, and trustworthy, password safe for OS X that can work with something like Yubikey.

Is Yubikey superior to something like Keepass/Lastpass/1password?

Yubikey works just like Google Authenticator, except it is a little more convenient to type in the code. (you touch a physical button on the dongle, and it types the code for you)

It does not actually save any passwords. It would replace Google Authenticator or an RSA SecurID FOB.

Now this is convent, provided I don't have to access my password safe on a mobile device without a USB port. Does Yubikey have an app or work with Google Authenticator?

I know I can use LastPass with Google Authenticator to identify trusted devices. Still not perfect, but perfect security would be too inconvenient for anyone to use.

Yubikey would be in addition to the password used on Keepass.

So you need your password and the Yubikey to unlock your password safe.

You could set the Yubikey up to be the password - so you only need the Yubikey to open up Keepass.

It depends on which service you actually use, but to my knowledge almost all of the worthy ones provide pre-generation of one-time passwords. Just get a bunch of those passwords on the paper in some proper place to fear the keyloggers no more.

Either that or 2-factor authentication will catch on and stealing passwords won't be worth anything.

Two-factor makes more sense. Relying on your database never getting hacked is nonsense. Is not a matter of are you getting hacked but when are you going to get hacked... expect getting hacked.

(disclaimer: I am the founder of Authy.com a two-factor auth API)

Blizzard has 2 factor; the secrets for the mobile authenticator seem to have been compromised as well as the hashed passwords.

But secrets for the mobile authenticator are much less sensitive than passwords, which are prone to reuse. It does, however, defeat the security advantage of two-factor authentication.

(I always thought the really smart crackers would break in, modify the application code to weaken the password encryption, and then re-encrypt every password when the user logs in. Come back a few weeks later and collect a bunch of working passwords, with nobody the wiser.)

isn't it inevitable? Rogue employees, dumb mistakes, passwords will always be stolen: what's important is they're stored securely enough that when (not if) they are stolen they are worthless to the people that now hold the passwords.

I suspect the quality of Pen-Testing being carried out or lack of is certianly an area of concern given the frequency.

Reply on news.ycombinator.com