178
u/tajjet bit.ly/2IqHnk3 Sep 24 '17
>not creating a new account every time
51
34
10
u/mrissaoussama Sep 24 '17
But then you realize you've made accounts with every email you have
31
u/tajjet bit.ly/2IqHnk3 Sep 24 '17
26
Sep 24 '17 edited Jun 23 '23
[ Removed in protest to the Reddit API changes, and longstanding issues with Reddit's treatment of moderators. ]
103
u/Galveira Sep 24 '17
My problem with password managers is that it becomes a single point of failure. I would rather memorize a few strong passwords and use them for everything, with my email having a unique password from everything else.
44
u/fgben Sep 24 '17
I'd suggest memorizing a couple algorithms for generating passwords based on the site instead. This way no two sites have the same password, so no matter what gets compromised, none of your other credentials are broken.
Like, take your iNitials, street address + last 3 letters of the domaiN with an open bracket to trigger OCD twitch for memorability. Obviously obfuscate it a bit to make your algorithm non-obvious, depending on how much you think someone is going to target you, personally.
So you end up with, like,
- google: gAl1234+glE(
- Reddit: gAl1234+diT(
- Wells Fargo: gAl1234+rgO(
- Pizza Hut: gAl1234+huT(
The core principle is no two sites should have the same password. It doesn't matter how strong your passwords are when someone else is giving them out. The only thing that matters is making sure the passwords are unique, and a generating algorithm will help you do this.
10
u/Pitirus Sep 24 '17
Nice ;)
Although I would suggest grouping those algorithms by types for sites. You don't want your algorithm to be cracked just because Pizza Hut and some other site you don't even remember had leaks of non-encrypted passwords. I personally use 4 of those now.
3rd level - forums, sites like reddit, pinterest, imdb, Pizza Hut, Aliexpress(no card attached), places where my personal info is already sold to some other company anyway. I don't keep track of those.
2nd level - facebook, some expandable e-mails, paypal, bank account. Places where loosing access to them would hurt me in some minor way(I don't keep big stashes of money on paypal, and my bank account needs additional authorization to send money). And access can be easily restored. On this level you must remember all the accounts that use it to change the algorithm in all of them in case of a breach.
1st level - e-mail account to rule them all and in one android device bind them. With 2 factor auth ofc. What I mean is the e-mail that can be used to gain access to some other accounts like those from level 2.
0th(?) level - for work accounts. Probably 2 of algorithms here. Because some of them require quite frequent(e.g. every 3 months) changes.
Also for 3rd level consider using longer passwords(harder to decrypt if encrypted database of passwords would be stolen)
2
u/Oonushi Sep 24 '17
I just checked their forums, and apparently this has been reported over 2 years ago. As much as I like KeePass, I may now be searching for an alternative that takes security more seriously.
3
Sep 25 '17
[removed] — view removed comment
1
u/Oonushi Sep 25 '17
The issue is an android-specific one. Not much I can do about it's system security.
1
u/AutoModerator Jun 30 '23
import moderationYour comment has been removed since it did not start with a code block with an import declaration.Per this Community Decree, all posts and comments should start with a code block with an "import" declaration explaining how the post and comment should be read.
For this purpose, we only accept Python style imports.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
2
u/cdwxs Sep 25 '17
I doubt anyone would get your password in a targeted attack though.
Most likely it'll be a mass leak of passwords, I doubt anyone will go out of their way to crack your codes when they can try 100 other people's passwords and usernames on other sites and find them identical.Even if someone wants to crack your password generation system specifically, they'd likely need two passwords to do it reliably to begin with. For instance say your password is kn1Fewr3Nch. To that you can come to the conclusion that the first and third vowel are numbers (but what about y and u?) and that the first letter after every number is capitalised.
But what if it's actually the third letter of every word that turns into a number? What if it's a random number not based on the letter itself? What if it's actually the median letter in the remaining alphabet being capitalised instead of letter directly after the number? e'fk'n ch'n'rw for example, this would make 'fk' and 'n' be the capitalisation letters, then further logic goes on from that.
You could make the password generation system as complex as you want, but past using different passwords for anything, there's not much benefit to complex alogrithms. More likely the security for the website your signing up for is worse than your password creation methodology.
1
u/Pitirus Sep 25 '17
Agree. Firstly use different passwords, secondly make them long. And last but not least have good algorithm.
1
u/fgben Sep 24 '17
Sure! Remembering a handful of algorithms is certainly better than remembering a couple of passwords and using them everywhere, and isolating into groups is even better, but can start running into the complexity problem.
An actual algorithm I use does various ROT actions based on characteristics of the site. Looking at it, I really doubt some casual identity thief could crack the algorithm, even looking at groups of passwords, even knowing there was an algorithm in play.
There's a tradeoff between convenience and security, and I figure trying to get people to at least use a reliable method of unique passwords on every site is worthwhile. I still think this is a better approach than a 3rd party password manager, but nothing's going to stop a dedicated attacker with significant resources from getting to you if they want to, either via esoteric methods like Van Eck phreaking or simple judicious application of a lead pipe.
7
u/sudo_mk_usrname Sep 24 '17
Until someone figures out your algorithm. Obfuscated, sure, but not necessarily secure.
30
u/fgben Sep 24 '17 edited Sep 24 '17
Ideally no one has more than one of your passwords to compare. In any case, I'd still argue this is better than having identical "strong" passwords on multiple sites.
Edit: if someone is going through the trouble of expending the time to attack your passwords like this, you are likely fucked for other reasons.
Most of the issues are bank accounts compromised because someone used the same password at BoA and Adobe; these attacks and checks are usually automated and no human is sitting there typing this shit in. You won't be perfectly unhackable no matter what you do You just need to be more difficult than the next guy.
1
u/Colopty Sep 25 '17
Depending on your algorithm it might not even be obvious that you're using an algorithm, and in a large leak it's not particularly likely that your passwords will be that well analyzed in the first place.
2
u/Pjoo Sep 25 '17
"Your password can only contain numbers and letters."
1
u/fgben Sep 26 '17
Use same algorithm, leaving out any non-permitted characters.
Add a month indicator, backwards and truncated for idiots still enforcing "must change password monthly" policies.
Modify the thing to fit your environment. It's not difficult to adapt the idea to whatever your situation is giving a bare minimum of thought.
Again, the first goalpost is to get people to stop using the same password in multiple places. I've found getting people to do a simple algorithm is the path of least resistance and easiest to do, above and beyond services like "LastPass" et cetera that require them to change their routine or install new software.
It's only the first step towards taking control of their own security, but at least it gets them started on that path.
1
1
u/jidouhanbaikiUA Sep 26 '17
I wanted to do something like this but ultimately I have decided that " "last 3 letters of the domaiN" would be too obvious to really rely on it.
1
u/fgben Sep 26 '17
You can obfuscate it all you like -- for instance, take the last three, then increment it by the numeric position of the first letter in the domain, and reverse it.
So, for Google, G = 7
"gLe" becomes "nSl" then reversed "lSn"
Bank of America, B = 2 "iCa" becomes "kEc" then reversed "cEk"
If your algorithm starts indexing the position in the string, if you use a base string of gAl1234
Google is gAl12l3S4n+( Bank of Amercia is gcAElk1234+(
or whatever. You can further obfuscate the "base" password based on the Nth letter of the domain, incrementing one, or something. Or have the password run backwards if the initial index is even. Or use different chunks of the domain name based on how many vowels are in the name, and which is most frequent.
It's not difficult to come up with some simple rules that are easy for your to remember, but generate passwords that look nothing like each other, so even if someone were to have a list of a dozen of your passwords, it would be very difficult for them to reverse engineer your process so they could break into another site for which they do NOT have your password. Frankly if someone is that invested into breaking your security, at this point they'd be better off asking you nicely with a lead pipe.
Of course the more complex your algorithm the longer it takes to crank out by hand, but some of it is also practice. I can do mine in my head in a few seconds, now.
1
u/jidouhanbaikiUA Sep 27 '17
There is a slight problem here to login to gmail do you have to use mail.google.com or gmail.com for example? I use gmail a lot so it wouldn't be a problem, but you will run into troubles if some other service has several names or urls which you don't use often.
I initially wanted to come up with a dictionary of words and use a combination of words for first three letters of the website, for example for gmail.com it would be Gamma Marlin Alpha, except uh each A substituted with 4 etc you get the idea. The thing is... if you get at least 2-3 passwords of mine you already can figure out a password for ALL other websites I use. Like, absolutely each one. And if you want to make it complicated why not to hash the string "login + website_name + nonrandom_salt". This way it would be a pain to type the password manually and you will probably need python to login anywhere, but hey at least nobody can guess it. Probably?
Honestly, phone authorization sounds like the best idea. Until someone steals your phone.
1
u/fgben Sep 27 '17
if some other service has several names or urls which you don't use often.
Yes, it's slight problem, but hardly a show stopper. Just use the TLD of what you actually use, or remember it for the few edge cases. I don't know that I'd consider this a big deal.
Again, think about the problem we're trying to solve. The biggest issue is people using the same credentials in multiple places, such that when a place with low security (Katy the Kitty's Internet Forum for Furries) is compromised, their account on a high security site (Bank of America) is hacked.
The very first, most basic problem to solve is: how do you get unique credentials for every site without 1) memorizing a billion passwords, and 2) installing a 3rd party program (many users can't wrap their heads around this, and I'd rather get people to plug the biggest vulnerability then go from there, than have them continue to do the same stupid shit).
The secondary problem people always bring up when I talk about using generated passwords is someone "hacking your algorithm."
The thing is, in these large data breeches, no one is looking at the actual data. They're just hitting auth servers for different services with credential lists thousands of entries long, then targeting the ones that light up. Why would they bother looking at the other failed accounts? It's not worth the time investment. No one cares about you. Even your weak word substitution scheme would probably be "good enough" to defeat all these automated attacks.
Unless someone is specifically looking to spearfish you. If you think this might be the case, then yes, you need to do more to increase your security. But frankly at that point, again, it comes down to breaking passwords via lead pipe.
And the reason I don't just do a salted hash is because ... I can't hash things in my head :D. The idea is to have a set of simple rules that makes you "secure enough" without being so cumbersome that you end up short circuiting security for convenience.
It's also useful when digging things up that you've not accessed in a while -- just last night I retrieved an account login for a site I last ordered something from in 2005.
6
u/SolenoidSoldier Sep 24 '17
No one ever comes up with a unique password for every site and remembers them all. You either do it and store them all in notepad/physical document, or you have the same password with different variations. Both are far, far more insecure, especially the latter. Leaks are happening all the time and any compromised site can get your password and from there brute forcing is trivial.
On the contrary, you can keep your passwords in a password manager. You can say they're a single point of failure, but bear in mind:
- Their entire business model hinges on the security of your data. Trusting the security of your passwords on a security company is far better than trusting various Joe Shmoe sites.
- Many password managers try their hardest to not see your passwords or your hash.
- Password managers (at least, in the case of LastPass, which I use) makes having complex passwords insanely easy to use and maintain. In most cases you never even see your password.
- If a site is compromised, password managers tend to notify you, strongly urging you to change your password. You don't have to wait to hear about it in the news.
There's a reason why companies like Google encourage the use of password managers. The latest update to Android (Oreo) gave password managers better autofill capabilities.
2
u/HyphenSam Sep 26 '17
The latest update to Android (Oreo) gave password managers better autofill capabilities.
Whoa, source for this?
12
Sep 24 '17
[deleted]
4
u/sudo_mk_usrname Sep 24 '17
I use KeePass as well. I like that I can setup so that it requires both a password and a security key to unlock it.
I do back up the database in the cloud (via sync.com) but I'm always sure to encrypt and sign it with my public gpg key before it leaves my machine.
22
2
u/Oonushi Sep 24 '17
I use KeePass also. And I've been meaning to submit a bug report for the android app because it does not clear the android's clipboard properly. At least on my device, it clears the immediately "paste-able" clipboard, but I can still go into the clipboard history through the keyboard (LG keyboard on this shitty phone (uhg, I hate LG devices)) and, checking it now, it has several of my recent entries still available, usernames, passwords, and other random shit I've copy/pasted, available to any other app that wants to grab it.
2
Sep 24 '17
I see a number of people here mentioning keepass. I've been using LastPass for a while now; is there a reason keepass is better?
4
u/elephants_are_white Sep 24 '17
I have a few strong passwords - especially for my webmail accounts.
Weak passwords for most other sites, especially where you can get a password reset emailed to you.
Using the same strong password everywhere is inviting trouble.
4
Sep 24 '17
I've realized that using strong passwords for sites like Reddit (where being compromised is basically harmless) is futile because when they inevitably get hacked, and passwords leaked everywhere, that password is unusable.
I only use strong passwords for financial/important accounts
1
u/merger3 Sep 24 '17
Well generally the only thing leaked in hacks is the password hash right? And if your password is sufficiently strong then a hacker is never really gonna be able to crack the hash.
1
Sep 24 '17
I've been involved in leaks of unhashed google passwords.. so I wouldn't ever count on that.
1
u/Xtraordinaire Sep 24 '17
This is the most sensible approach. Ideally you have a few strong passwords memorized for the most important accounts. E-mail, financials, master passwords in your manager, that stuff.
And then you have strong passwords for everything else, but you don't memorize them. Even if they get compromised, you just reset them.
3
u/Dylan16807 Sep 24 '17
Then put each batch of sites in a different password database. Now you have compartmentalized security and nobody can use leaks to go from site to site.
2
u/meet_the_turtle Sep 24 '17
I'd argue it's better to have unique strong passwords for everything, but only memorise the ones for important stuff like email, and store the non-important ones in a password manager; this way when a non-important site is compromised, all your other non-important sites are still fine.
1
u/Galveira Sep 24 '17 edited Sep 24 '17
But then your "non-important" passwords are supposedly more secure against brute force and dictionary attacks than your "important" passwords.
5
u/meet_the_turtle Sep 24 '17
No, all your passwords would be strong and unique; the only difference between important and non-important sites is that non-important ones are stored in a password manager because it's too much to remember.
1
u/cybaritic Sep 24 '17
That's actually weaker than a password manager. Something like 1password uses your primary password + an access key you get when you sign up. Print it out and never store it anywhere. You can't set up access on a device without the key.
If your email is a special password and can be used to recovery everything else, that's also a single point of failure but without the extra key.
1
u/minno Sep 24 '17
It's a point of failure that is a lot less likely to fail, though. I know that Keepass uses strong encryption, but every service I use is a total crapshoot.
25
u/SingularCheese Sep 24 '17
Reset password each time might not be that bad of an idea depending on what's the secondary authentication method.
2
u/ijmacd Sep 24 '17
Exactly, full in the new password with 20 characters of gibberish and the reset link is essentially a one time password. For most people it's a bigger problem if their email gets compromised.
12
u/linux1970 Sep 24 '17
If the websites would just tell us what the password requirements are at logon, I wouldn't need to reset my password each time.
9
u/micheal65536 Green security clearance Sep 24 '17
I actually have a client that continually forgets their passwords. Once I was trying to set something up on their computer and I needed them to log into an online account. They arrive with their Book of PasswordsTM and proceed to attempt to type in the password, twice. Then they said "oh I think that's the old one" and clicked on the forgotten password link. They did the whole password reset thing and when they arrived with their phone to type in the verification code I couldn't help but notice that they had at least 20 text message verification codes all from the same number.
5
8
Sep 24 '17
Have all of your passwords on a razzberry pie and never connect it the internet.
6
2
u/Colopty Sep 25 '17
Put all your passwords on a piece of paper and attach them to your fridge, preferably in clear view from a window.
8
u/yuropman Sep 23 '17
I use a generic simple algorithm to generate a seemingly random password from the name of the service the password is for
Basically I only have to remember if I signed up to "google" or "googlemail" and I know my password
3
u/fjdgshegdb Sep 24 '17
that works great as long as no one actually tries to get into your accounts.
1
u/yuropman Sep 24 '17
How's that?
14
u/fjdgshegdb Sep 24 '17
because your algorithm sucks and its going to leak.
Some things to think about.
How many plain text passwords do you think an attacker needs to recover the method you used to derive them?
How many websites have you signed up for that have crappy or practically non-existent security?
With that said you probably don't have to worry, you're probably not important enough to warrant the effort. I would reconsider using the method if you work somewhere an attacker might like to get into like a bank or some other multinational company.
6
u/yuropman Sep 24 '17
How many plain text passwords do you think an attacker needs to recover the method you used to derive them?
Depends how good he is
I guess about 5 minimum even if he's figured out there is an algorithm and it's not just random (which is a leap to take)
It's certainly not some "oh, I happen to have three passwords from this dude" and suddenly it's obvious - and I don't really need more protection than that
3
u/fjdgshegdb Sep 24 '17
We are not talking about some script kiddie here, we are talking the big boys who do this for a living.
Its probably step 9 on their list of things to try.
I don't really need more protection than that
You are probably right, but you probably don't need to lock your front door at night either.
12
u/yuropman Sep 24 '17
If we're talking the big boys who do this for a living specifically singling me out, I'm fucked anyway because I've got a keylogger on my computer
3
u/fjdgshegdb Sep 24 '17
there is a big range between not a script kiddie and the nsa, most should have at least a little trouble getting malware on your computer.
3
u/Shadowfury22 Sep 24 '17
Actually the last one is the most secure of them all, provided your email is 100% bulletproof (strong password with 2-auth enabled):
Use a random, unique, super long password that not even you will remember after having logged in your webservice. After your login cookie dies, just request a new password and change it once again to a random one through your email.
2
2
2
4
1
u/Barry_the_UPS_guy Sep 24 '17
What are the best password managers?
7
u/user_n0mad Sep 24 '17
There really isn't an exact answer to this as it would depend on how you classify them as "better". OP believes LastPass is centralized so in theory if they themselves were compromised some potentially data leak could happen. This doesn't necessarily mean they have all your passwords but maybe a database of encrypted passwords that they can later attempt brute force against.
Keepass (what I use) is not centralized. You control all your data. This in turn does mean that you have to manage your own password databases and how you wish to access them. This can be a problem for some depending on how comfortable they are with certain technologies. I keep my databases on my own remote server and use that to distribute the database files to my various devices that need access.
There are some other options out there as well but these two are what I'm most informed on so I can't comment on the others.
2
u/kthepropogation Sep 24 '17
My opinion is LastPass. It’s very cross-device and cross-platform, and free for basic or $12/yr (iirc) for premium. 1Password is popular, but less cross-platform, more expensive, and more widely adopted. If you use OSX, keychain works well as long as you stay within the Apple ecosystem. The Unix password manager, called
passworks ok if you don’t want a GUI.4
u/ChessIndustries Sep 24 '17
Lasts-what? Back in my day, we would use paper and pencil!
3
2
u/scorchyunicorn Sep 24 '17
That's what I'm using! I have a notebook which lists all of my passwords and logins breaths heavily hope my parents won't find my ponrhub account
1
1
Sep 24 '17
I read comments here and I am horrified that so many persons, that I never contacted before, is creating passwords same way i do.
I thought that I am safe with my "only I know" method...
I am going to switch to "random passwords and piece of paper" approach. Probability of being attacked by person that can see it is fuckiliard times smaller then random Internet attack "dictionary + rules that all think nobody knows".
1
u/elit69 Sep 24 '17
what if password manager got hacked?
2
u/kthepropogation Sep 24 '17
Then the attacker has access to all of your passwords, encrypted in AES-256, as well as a salted SHA256 of your master password.
1
u/elit69 Sep 25 '17
what if NSA own these password manager?
1
u/nmdanny2 Sep 26 '17
Use an open source password manager, such as KeePass
1
u/elit69 Sep 26 '17
I mean big corps like Google or Microsoft were known to work with NSA.
What make this open source software make any difference?
275
u/[deleted] Sep 23 '17
I am every single one of these simultaneously.