Comment by Udo | Hacker News Reader

Comment by Udo | Hacker News Reader

Parent Full thread

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix.

So, let's say for example, my current core is "kgA85kjF3". Then for example, I'd morph that for my Hacker News account to "ZkgA85kjF39!" and my fileserver as "UkgA85kjF3O2". I thought this was a good method of having reasonably long passwords but I'd have to memorize very little per site.

So imagine my surprise, when I created a new password "NkgA85kjF3T3", cracklib found a dictionary word in it. It got worse from there. Through experimentation, I determined that it was indeed the core that was compromised. Any password containing "kgA85kjF3" was compromised.

I have no idea how this happened. If this was not a big cosmic coincidence, if this is not just a random regex filter accident, that means data from at least two known password databases containing my cores has been correlated, and put into cracklib no less. There is really no limit to the imagination regarding what illegitimate databases might contain...

I do something similar, but I then hash the result and use that as the password. That way, if someone gets hold of a couple of passwords, it's harder to derive the "core'.

That's a good procedure, a few weeks ago I'd have deemed you paranoid but obviously there is no practical limit to paranoia anymore ;)

However, the hashing step makes it impractical for me on different devices in certain situations. I don't want to rely on browser extensions or apps either. So I'm changing my passwords to the output of an algorithm I can do in my head now.

For those who aren't aware https://www.pwdhash.com/

Yeah, though I don't use it, since I only found out about it after I had been using my own system for a while.

I do the same, and my "core" is less obscure than yours. I'm worried. What is this cracklib thing? Do I just provide it my password and it tells me stuff?

It's a linux library that checks passwords against a database of known words and patterns. You give it a password and it gives you basically one of two answers: "this is based on a known word" or "nope, never seen anything like it before". The database format looks highly obscure and doesn't lend itself to grepping without much effort.

Is there an easy way to check a password using cracklib via the command line? Preferably on OS X.

It doesn't come with OS X, but I suppose there should be a port available somewhere. Otherwise, Virtualbox and some minimal distro are probably your best bet.

On Linux command line, you just feed the password to it:

  echo "password" | cracklib-check

  brew install cracklib cracklib-words

  echo "lol" | cracklib-check

whynotjustusereallylongpasswordsthatarehardformachinestocrack?

You can also use an algorithm. I do something like create a 'base' that is used for all sites. And then something like take the number of letters in the url google = 6 and add it the beginning. Then take the second letter from the right and last, 'o' and 'e' and add it to the end. In the end you get 6baseoe. Unique password for each website.

Passphrases are a really good idea, but a lot of sites have very short length limits.

Granted if they have limits thats a really big red flag that they're storing your password in plain text, as a hash should always be the same length, so you probably shouldn't sign up there anyway. I remember a few years ago I was signing up for a TD account, and about 5 pages through the signup page it wouldn't allow me to continue because my password was /too secure/ (not their exact wording, but that was basically the problem). What makes it funnier is a lot of sites would reject the password I used at the time as not being secure enough.

I stopped signing up at that point, but I remember getting a phone call (!) from them a couple days later asking why I didn't finish the sign up, and my answer was: because I'm not giving my money to a company that doesn't know how to store passwords!

In Australia, our "welfare" system is taken care of by Centrelink. They have all of your personal details, as well as access to the amount you're getting per fortnight, and job history, resume etc. Lots of stuff you don't want compromised.

They also limit your password to 8 characters.

This is a huge government website that heaps of Australians have to access at least fortnightly.

One of the benefits of learning to program J for me has been to make it easy to remember hard to crack passwords. I have some passwords which are actually runnable J on-liner programs and contain all kind of '#!$' symbols. All I need to do is remember what they do so that I can recreate them.

I've memorized an algorithm instead of trying to remember passwords. I don't actually remember hardly any of my passwords, instead I use this mini algorithm that I came up with to create unique passwords for each site I go to. Each time I go to a site it just takes me a couple seconds to figure out what the password is. I find it a lot easier to remember that one algorithm rather than trying to remember a bunch of passwords or rotating through the same few passwords.

What I've found is that some sites will either truncate your password without telling you or restrict you to 8-20 chars.

Sometimes sites limit you, my bank for example has an 8 character limit.

becausetheyoftenfailwithwebsitesandit'skindofdifficultvaryingthemobscurelybutmeaningfullyenoughonapersitebasis.

itdoesn'tseemanyharderthanthatcrazycomplexschemetheguyabovehad

That's not the point. The idea is to have different passwords for each site and each device. So in this many-words scheme (which will run afoul of a lot of websites' length restrictions on passwords by the way) I'd have to find a good way to encode the site's name or I'd have to tack on at least four specific words to the existing core sentence. That's not something I'll remember with dozens of sites and devices.

Wow, got downvoted for that. I wouldn't have thought this description of how I do passwords is so controversial.

What's so bad about it?

canwegobacktotypinglikethispleaseyou'reruiningthefun

Not to be a spoilsport, but don't most sites allow spaces in passwords anyway?

Most do but some filter for it. Really varies site to site.

Believe me when I say all your personal information is on SOMEONES computer. Everyones is.

I know. If I wanted my information to be "safe", I wouldn't have an online profile at all. For starters, I wouldn't use Google services. It's a matter of limiting exposure at this point. I know the NSA reads my email and can probably log into my home router, but I don't want everybody else to do the same. Otherwise, let's all change our passwords to "password" and be done with it. Just because protection isn't close to 100% doesn't mean I don't want any at all.

can you tell me more about what you mean? for instance if your wife sends you a nude picture through something like oovoo does that guarantee someone has stolen it?

If you're connected to the world wide web and you send/receive data, there's a strong chance that either:

a) Either sending/receiving machine is broken into

b) Someone or something is intercepting your message

c) The service you are using is broken into

There's just too many holes to plug and too many people with expertise in these domains orders of magnitude above ours that they can use to either be malicious, or help our cause.

Your computer/device needs to be secure. Your other parties devices need to be secure. Your connection needs to be secure. Your third parties service needs to be secure. The internet the third party uses needs to be secure. Their data centre needs to be secure. Then their ISP needs to be secure.

All data is online.

I hope only the crypto-hash of my password is stored.

Reply on news.ycombinator.com