Hacker News Reader

Comment by eknkc | Hacker News Reader

I use strong passwords generated by 1Password for everything.. except for iCloud. There I have an idiot password.

Why? Because freaking iPhone asks for that when I want to download something from App Store. How do you guys handle that?

View on HN

I don't get Apple's password based security at all. The stupid question/answer thing they forced everyone to do was just crazy.

You have a physical device in your possession. Apple don't seem to have heard about two factor auth. If the only company on the planet that obsessively ties consumer hardware and software into a single cohesive product can't get their shit together the future worries me.

It should be the default (with an opt out for access from non-apple devices) for every Apple service to authenticate with the device as well as the password. Anyone who steals your Apple login but not your phone should have zero chance of accessing your data.

They've had two-step authentication since March of 2013: http://support.apple.com/kb/ht5570

Only available in certain countries though. Mine being one that isn't yet available (Finland).

Their FAQ says it's available in Finland

Except the article seems to be saying that Apple's two-factor auth isn't required to access iCloud backups and that it only protects account details, payment methods, etc.

Adding two-factor gets rid of the security questions and would have prevented them from getting the password though.

Don't use an "idiot" password, use a long password.. Good passwords aren't complex, they're LONG..

"this is a really dumb password" is probably actually a really good password. ;-)

And also, your "problem" is simply your decision to trade security for convenience.

You need to weigh the risks vs. reward and make the choice for yourself. If something goes wrong, at least you'll know why.

The problem is to tap all of that into your phone, every time iOS decides it desperately needs it again, with just stars instead of letters. That's annoying.

It's a pain, but really not that bad. You tweet from your phone (or use email/SMS/whatever else). 20 characters is manageable and secure, as long as it's randomly generated.

If it's randomly generated, it's impossible to remember to fill in on your phone. Unless you have it on a piece of paper in your wallet.

Really? I remember quite a few four-word (xkcd-style) random passphrases.

Bingo. I'm actually thinking of diceware.

20 chars: bu-Y6Bx(94ijk1Y5$kWx

I've got a fairly long iCloud password with upper and lower case letters, numbers, and symbols. After four or so years of typing it on iOS devices, I have the muscle memory to type is extremely fast without thinking about it. In fact, to figure out the actual characters of the password, I have to visually reconstruct the physical typing that I do from muscle memory.

Long passwords (aka the xkcd scheme) aren't secure anymore - https://www.schneier.com/blog/archives/2014/03/choosing_secu...

The only good passwords are ones that stay well away from dictionary words..

Six really random words -- not a sentence -- gives you pretty good security.

Six words chosen from this list http://world.std.com/~reinhold/diceware.wordlist.asc truly at random gives you almost 80 bits of entropy. And six random words are easier to remember than 16 totally random letters.

EDIT seriously, 221073919720733357899776 is a really big search space. If you have a computer that can search a billion per second, it's going to take 1000 computers 1000 years to catalog just 14% of the search space.

The Schneier article is puzzling; the security of the diceware/XKCD scheme doesn't rely on the word list being secret, just on the words from the list being chosen randomly. 4 words randomly chosen from a list of 5000 provide about 49 bits of entropy when the list of words is fully known.

Against an attacker who knows exactly how you chose your password, it's (roughly) the same level of security as a 14-digit numeric code, or an 8 letter case-sensitive alphanumeric code. It's just supposed to be easier to remember.

His point is that using actual, grammatically correct, sentences is not the same as using several random words. As your mobile keyboard autocomplete well knows, after a certain word there are words more probable than others.

How many people use this kind of approach, I don't know. Schneier seems to focus on "three random letters" kind of attacker.

A good password is one that's not known or readily knowable.

There are archives of know passwords -- millions of them. These should be rejected on any online service.

There are tools for guessing passwords. Any password which falls into any of he likely-to-be-guessed divisions should _also_ be rejected.

Dictionary words _could_ work in a sufficiently large namespace. But that's pretty iffy.

Bruce Schneier clearly misunderstood the xkcd scheme.

In fact, the Schneier method for generating passwords is probably worse than the xkcd method because a significant percentage of the people who try to use his method will choose a password with low entropy such as "wtpotusio2fampu" (We The People of he United States...) or "igmhaohcr" (I'm gonna make him an offer he can't refuse).

All I have to do is crawl the internet and calculate, say, the top 5 million n-grams. The resulting 5 million candidate passwords would be far more likely to match a typical Schneier-based password than a corresponding list of 5 million candidate passwords designed to match an xkcd-based password.

The simple rule is this: Don't let users choose a password. They suck at it.

You can use a different password for purchasing apps, and a different password (Apple ID) for your iCloud data.

This goes for Game Center as well. You can use a different one for your mean, nasty, trash talking Gamer persona.

Apple doesn't always make this clear, and I see a lot of people confused about this, but this is an option.

Another login that can use a different Apple ID is Find My iDevice.

OK I must be dumb today, but I can't figure out how to do this and Google isn't helping me either - can you describe, or point me to a link, on how to set this up? Thanks!

I think it's that you can use different Apple IDs for each of these things.

First, create a new Apple ID.

If you want to use this for your App Store account, go into Settings then "iTunes & App Store", and sign out of the previous account. Log in using then different (new) Apple ID.

If you want to use this for your iCloud account, go into your iDevice's Settings, then iCloud, then "Delete Account". It will delete the iCloud data on your phone, but it should still be available on iCloud servers, and any other device hooked up to that account. I haven't looked into how to transfer data from one iCloud into another.

I've memorized a non-idiot password I use solely for iCloud.

lastpass on android has the ability to insert your passwords into app login forms (via a custom keyboard / accessibility API, I think). I don't know if the same is true on iOS

No, but there's hope it'll be supported under iOS8's app extensions and custom keyboards. It does have it's built-in browser for now.

I've been using a scheme that involve easy to type password, like: qwertyuioplkjhgfdsa/ qazcdetgbmju / rtyujhgfvbnm (if you 're wondering how to memorize those password, looks at the QWERTY keyboard). Combining with number and capitalization, I feel pretty good about my odd of surviving the brute force/ dictionary attack. But I can't quite quality the exact amount of combinations for those schemes. Can anyone tell me why this would potentially be a bad idea?

I don't think it will necessarily work because some cracker has just probably added that to their personal dictionary(if they didn't before). It might work if you add 3.14159627 to it or a number/symbol set of your choice. I guess length is fairly key as well.

You should look at some wordlists. A lot of qwerty / qazwsx / asdf combinations appear.

I have 1Password for iPhone and copy the generated password from there every time I need it. Certainly a pain but worth it. In the end, it doesn't take that long: 1Password is on my home screen, the Apple login is favorited and I can type my master password fairly fast. The most annoying part really is switching between apps.

I also have my phone set up for iOS not to ask for the password for 5 or 15 minutes (can't remember the exact option) after I entered it.

TouchID.

Yeah, how about the first time? I mean, I do not buy apps all the time, maybe once a week. And I'd have my battery dead or something like that in between those attempts.

So, I never had a chance to just hold my thumb on the home button and go my way.

I have this problem all the time. My current process is to:

1. open the App store but don't click on anything 2. hit home button 3. launch keepass client 4. navigate to apple account entry 5. copy password 6. double tap home button to bring up multitasking menu 7. tap app store 8. click install 9. paste password

It feels really stupid doing it, but you can get pretty quick at it. I can't wait for my next iPhone upgrade with touchid.

This is really easy. You have one good password for 1pass, and one good password for iCloud.

If you can manage to memorize one, you can memorize two.

My real problem with this is writing the password with numbers, punctuation and stuff on a mobile keyboard. Feels like surgery even if I'd memorize it.

I use 1P on my laptop most of the time so it's not a huge deal. Everything else on the iPhone just remembers credentials.

I know I can force myself to use a great password for iCloud but my point is that most of the time, I'd go for an idiot password rather than forcing myself. Just like most people.

that little voice in your head that is screaming "i hate this" is your problem. It really is not a big deal to type a password, and even to type it a few times, just try to have a more zen attitude about it. It's how passwords work, stop trying to figure out how to defeat your own password, it's doing what it's supposed to do.

A good password doesn't need all that stuff. Just use something of sufficient length. A sentence, for example.

This may help, some special characters dump the keyboard back to the primary keyboard, so create a password that is letters, then numbers/specials, then the ' character, then more letters.

for example, pass2'word would only require you to hit the alt-keyboard switch once.

Check out PasswordPilot on jailbroken devices :)

Reply on news.ycombinator.com