Hacker News Reader

Comment by benihana | Hacker News Reader

A pragmatic one I like to say to non technical people like my mom and sister:

- Have a dedicated email password that is different from every other password you use.

Let's be honest: You should have different passwords for every site, and you should use strong passwords and a manager, but you don't because you're a normal person. At the very least, be pragmatic and have an email password that's separate from every other service password. The idea being, if your random-service-you-signed-up-for-once.com password gets hacked, and your username was your email address, the first thing an attacker will try to do is use that password on your email. So have a strong email password and trust that your gmail account is less likely to be hacked than your random-service account password.

View on HN

I use LastPass and I can't recommend it enough. It's fantastic and I have different passwords for everything simply because I never bother making passwords. I just hit the random function on it.

I still have my email passwords memorized, though.

This is honestly the best service I've ever paid for. It has never failed me, and it substantially improves my life.

I use LastPass and think it's great as well. I've tried to recommend it to others though and the common reply is "that doesn't sound secure enough for company policy".

They don't seem to realise though that their usual approach of sharing passwords over email, using the same password for several logins so it's easy to remember and using easy to remember passwords in general is much more insecure.

Services like LastPass make it practical for you to use impossible to guess passwords, different passwords for every site and let you share passwords securely.

My key argument when I've convinced past employers to implement it: you already outsource all of the hard parts of your security. Antivirus, firewall, AD permissions, server config, all of it. They either bought a product to fit the need or hired a consultant to do the advanced stuff. $12/year is pretty cheap to hire a dedicated team of security wonks to safeguard your passwords, IMO.

It's not the cost that's the issue though, people don't like the idea of passwords being stored in a single place on a internet connected computer. I mention that you can secure password access behind two factor authentication but it doesn't get around the knee-jerk reaction often. Sharing lots of passwords when working with a team remotely is especially painful when password managers are not allowed...

Strip (https://www.zetetic.net/blog/) is a mature and multi-platform local password manager that does not need a cloud connection, and can optionally sync from mobile to a local desktop. Made by the developers of open-source SQLCipher for SQLite, https://github.com/sqlcipher/sqlcipher

I wish they would integrate with iOS8 Safari as an extension.

That's all built in on Safari now. It's dead simple to use. But obviously it only works inside the Apple ecosystem.

I'm surprised Google hasn't built it in to Chrome yet.

Chrome does have a password generator and password syncing though I think the generator is hidden behind a flag still.

Lastpass is surprisingly slow however - and that affects general browsing performance.

I use LastPass too and I am happy with it but I really wish they would do something about that UI. Not a very good experience, IMO.

My issue with lastpass is that it's basically unusable when you don't use it as an extension.

I'm not willing to load a proprietary blob that actively manipulates the dom and passwords every time I visit a page.

I think the best tips for non-savvy people are:

1 - use an iphone for all banking. It's the single hardest system for someone to install spyware on: they are more careful about which apps are in their store than android, and the apps are more isolated. Android apps often have spyware; android install prompts on websites are super sketchy (and cover 1/4 of the screen, perfect to trick older or unfamiliar users into installation), and the permissions are far less granular. Windows is a disaster for secure computing, from viruses to "install this to get 500 smiley faces" to flash with monthly zero-days to fake software installs advertised via google sem.

2 - use gmail, and use 2fa

3 - pay the $30 for the hardware login tokens for your brokerage (and ideally, banking) account

4 - don't use any wifi except home wifi; just use wireless

5 - NO, your friend/cousin/grandchild is not stranded in an airport in Europe

You have to pay for hardware login tokens? In most of Europe, they're not only free, but mandatory.

And, depending on how un-savvy you're talking about, I'd recommend just doing internet banking at your local bank. Just set all regular bills on auto, and configure your account to text you if something unusual happens (like your current account is running low). Then you should only really need internet banking a handful of times a year.

> Just set all regular bills on auto

I realize that opinions on this differ, but I think that automatic bill payment is a horrible security practice.

Just last week I was paying with credit card in which the merchant punched in $5504 by accident instead of $504. Had I not noticed it right away, at least I'd get another chance to correct the error when my credit card bill arrived. With auto-pay, my bank account would have been emptied.

What would you do if some sort of auto pay error emptied your bank account? These things take time to resolve. What if it's a weekend, or a holiday, or you're traveling overseas, or the entity that caused the problem is on strike, or they want a written dispute from you?

I like auto payments for regular payments such as a gym membership of $X/month and even for payments that vary somewhat but are from pretty reliable sources (monthly utilities--maybe) but NOT for credit cards. Credit cards are all sorts of different charges every month for all sorts of things in all sorts of circumstances. You really should look over the charges each month and figure out any that don't look right. Auto payment trains you to ignore something you should train yourself to keep an eye on.

Many banks allow you to set a max for an ebill. However, 99% of my auto payments are fixed amounts, so your scenario doesn't apply. Auto pay is the only thing that keeps my bills paid on time (I suck at paying bills manually).

I wouldn't (and I don't) have autopay on the credit card. Anyway, if suddenly my current account is emptied for some weird reason, I have backup funds that can be transferred to the current account in five minutes on my phone.

Also, I started from the assumption of a non-technical person with "simple finances", so no credit card.

I freely admit that hardware tokens may be more secure, but the more 2FA that uses the standard implemented by Google Authenticator the happier I am. Plus, in my mind it would be cheaper and easier to implement a software only process than to try and convince a CFO that buying, shipping and managing little pieces of hardware will have sufficient ROI.

I also am not holding my breath for even the software 2FA since quite a few of my financial institutions won't even let me use punctuation in my password. Yes, the irony of implementing 2FA lowering the risk of a simple password isn't lost in me.

the simpler one is don't do online banking at all

KeePass plus multiple supported clients have allowed me (and my wife) to manage a unique password per account without too much effort. My eyes really opened when my linkedin leak happened and I realised how many accounts shared that same password.

Alipay differentiates login password and "payment password", and it always asks SMS verification code if one tries to login via VPN, from new device, or from new location. I think that's good practice for websites.

> You should have different passwords for every site, and you should use strong passwords and a manager, but you don't because you're a normal person.

I'm amazed that people favor remembering passwords over using a password manager. With Firefox Sync, or the Chrome equivalent, you have your browser remember the password, every other browser you use syncs with that so it has the password, and you never need to have it memorized. The only thing that's missing for better usability is a built-in "generate and use a random secure password" mechanism.

I think mostly the industry is to blame here. We could have had a universal secure 2fa ages ago. I hope that with the advent of smart watches, 2fa could become more sexy, and hence could get more attention from the industry.

The problem I have with browser password managers is how simple they are to crack. Master passwords are disabled by default (if available at all), and even with a master password, many browsers still don't encrypt them in the password store.

If it syncs, that means that all my passwords are out in "the cloud" somewhere, which means I would be vulnerable everywhere all at once should that one master list ever be compromised.

If it doesn't sync, that means I can only get in from one computer, which is occasionally inconvenient.

So I keep my passwords in my brain, which is always with me, or at least with me at all the times when I might need to use a password.

> If it syncs, that means that all my passwords are out in "the cloud" somewhere, which means I would be vulnerable everywhere all at once should that one master list ever be compromised.

For Firefox Sync, that entire list is encrypted using a client-side key in your browser, and the server has no access to the cleartext.

Sure, but it's still a single point of failure, no? Someone gets that key, they've got my whole digital life. I'd rather keep the key airgapped.

That's what I recommend as well. Once someone has access to your email, the attacker can then use the "forgot your password?" of most sites to get further passwords and access.

I thought I was the only that did this! Only two passwords of mine need to be memorized. Dropbox and Gmail. 1Password for everything else, with a dedicated Dropbox account solely for keeping the 1Password vault backed up (I've had my laptop stolen before, and being locked out because you don't know any password makes for a terrible afternoon).

A good way could be to have a "base" password you then concatenate with the first 4 letters or so in the service

So for Facebook it can be "MYPASS" + "FACE"

And then it's easy to remember. Also you can substitute the first letter which allows it to a number or so

This helps when your password is lost along with thousands / millions of other passwords in a breach -- attackers would be trying to re-use passwords programmatically in bulk and wouldn't detect your algorithm.

But if you were individually targeted i.e. a human attacker is looking at your password, your algorithm would provide access to many of your accounts with little effort.

I used to use this solution, btw, but have now gone to a unique, complex password per site with a password manager.

I also used to use this solution about ten or fifteen years ago and have since moved on to password managers and long passphrases for accounts whose passwords I do not want to store in the password manager.

Reply on news.ycombinator.com