Hacker News Reader

Comment by 1SaltwaterC | Hacker News Reader

"My Apple, Twitter, and Gmail passwords were all robust—seven, 10, and 19 characters"

He lost me at seven.

But the problem was, as far as I remember, not the weaknesses of his passwords. Hell, the hackers didn't even tried to brute force the keys, they just conned their way in. Time and again, the human factor proved to be the weakest link in the security.

Have you ever had to type that apple password in over and over again? Perhaps it's not robust, but that's Apple's "feature".

Especially on a touchscreen keyboard, and/or use a remote control to type it into an Apple TV etc.

Most frustrating thing in the world.

My AppleID password is pretty secure (~25 characters, upper/lower case, alphanumeric, bunch of symbols, etc.) and having to type it in on an iPhone/iPad every time I want to download an app (even a free app, or updating an app I've already purchased) makes me want to cry.

I don't know what my Apple ID is, it's a random sequence of letters (of various casing), symbols and numbers. I have it stored in a different app, so every time apple asks me for it, I cancel the dialog, open that app, copy the password to clipboard, redo the action and paste. I can do it faster than I can explain how to do it.

my gmail password is close to 40 characters. It would be impossible to manage without keepass. I just assume that any password you can recall from memory is not secure enough.

Ditto. I've switched to generating passwords that are as long as the site allows (well, up to 80 or so, with spaces and special characters and whatnot).

I think I'd rather stop reading FUD articles on Wired written by noobs, than give up passwords.

Good for you. But 99.9% of people are not as careful, and will never be. You can't change them. They will continue to use the same password of minimum allowed length for multiple sites, and store it in plain text on their desktop. The designers of technology need to be aware of how it is actually used by real people.

<i>"I just assume that any password you can recall from memory is not secure enough."</i>

Obligatory: http://xkcd.com/936/

I wonder when "correct horse battery staple" will start to become the new "passw0rd123"...

"Please use a password that is not a copy of one you saw on some famous comic, movie or tv series."

Around 20 characters using something like http://xkcd.com/936/ is both safe and reasonably easy to recall.

Unless you actually randomly select the words, I'm fairly sure that the analysis of strength of that strategy is flawed. And if you do randomly select the words, I'm not sure how easy they are to recall. And, I'm really skeptical how easy it is to recall different word sequences for 100 different web sites.

I've quizzed most of the people I've encountered who claim to use this technique. They all use four words that "pop into their head". That's quite a big different from using random words, and almost certainly much weaker.

I tried this method. I probably did use totally random words because I can never remember what the password was and have to reset it every time I want to use the site I'm testing this on!

Learn a foreign language. Thai phrases look pretty random.

Unless you're a hacker from Thailand.

Reply on news.ycombinator.com