Hacker News Reader

Comment by walden42 | Hacker News Reader

Yahoo here. How the hell did the hackers get the passwords in plain text? Were they seriously unencrypted?

They were encrypted, but with no variation between the hashes for per email. https://lastpass.com/adobe/ will show you the password hints associated with the (in my case) 200 people with the same (hashed) password. The clues would be sufficient to guess the password.

I've gone to generating a unique password with a simple random number generator if the end site supports password recovery (in case Chrome's password memorizing system forgets it).

#!/bin/bash if [ $1 ] ; then a=$1 else a=16 fi dd if=/dev/urandom bs=1000 count=1 2>/dev/null | tr -d -c "[:alnum:]" | tr -d '`' | tr -d "'" | tr -d '"' | tr -d '\\' | head -c $a echo

This is not meant as criticism: Is there any particular reason for all the tr pipes? Is there any advantage to using tr instead of base64?

I essentially use the following:

  base64 </dev/urandom | head -c $COUNT | xargs -0

Criticism welcome. Yours is nicer.

I use this for a little more entropy:

    LANG=C tr -dc "[:print:]" < /dev/urandom | fold -w 32 | head -n 1

I much prefer using the program `pwgen`. It's installed on all my Linux boxes and it's available from Cygwin too, and it generates a 'pronounceable' password, which makes it a lot easier to remember and also much easier to copy.

There's also the benefit of fewer moving parts -- with a pipeline like that, I'd be worried about accidentally stripping out some of the randomness. I'm fairly confident that a simple invocation of `pwgen` will work.

Reply on news.ycombinator.com