Hacker News Reader

Comment by ajross | Hacker News Reader

This. I continue to be saddened at the extent to which "DON'T REUSE PASSWORDS EVER" isn't the first sentence and summary to any discussion of this stuff. Even people who should know better (c.f. posters right here on this site) don't, and those who do get distracted talking about more "interesting" stuff like GPU hashing algorithms instead.

Just don't do it. And tell all your friends.

View on HN

  > "DON'T REUSE PASSWORDS EVER"

You can reuse your password as long as it's for an account that you don't care about. The more secure the account needs to be the more secure that password needs to be. I.e. use the same password for all crap accounts, use a pattern for semi-secure accounts, and use separate, secure passwords for all secure accounts.

I'm kinda shocked that of all the "experts" the reporter talked to, nobody used more than a dozen passwords. I'm no crypto geek, I don't force SSL everywhere, I've never used TOR or anonymous VPNs or anything - but I have a few different password systems that allow me to use and remember semi-unique, word-free passwords on any site I care about. If you were targeting me personally, and you obtained the plaintext of a few dozen passwords, you could probably figure one of them out; if you're running a typical automated attack, you're going to miss me.

I can't possibly be the fastest runner from this bear.

What password systems are you using?

1. Stick non-alpha characters in the middle of words. Not 31337 substitutions; additions. Now your dictionary word isn't a dictionary word anymore.

2. Use the first letter of each word in a phrase. Again, now it's easy to remember but not a dictionary word.

3. Find a way to customize the password for each site in such a way that you can remember the pattern. Use letters from the stock symbol, the dominant color, the domain name, or some other word you associate with that site. Boom - now your password is unique per site.

But it's so hard to. Really. Most people aren't willing to spend the time (I know I'm not). It takes more memorization (unless you use exploitable tricks) and most people think they're mostly safe, so "what's the point?", they think.

Pick one good pass phrase and use it an the encryption key to a gpg-locked file where your auto-generated passwords are stored. This is what I do. There are commercial products that are isomorphic to this process, though I haven't used any of them. Even a web browser will do this for you (sans the auto-generation part), though they're not good at archival or replication of the passwords.

That's not possible. If you use the internet a little bit, you are almost constantly required to chose more and more new passwords. To newspapers sites to comment, to registration forms, to buy tickets to some concert, etc etc. You cannot use different password for each of them. And password systems are overkill for most people (certainly is for me).

Really, what IS sensible is having sensitive sites with different passwords and "who cares" sites with simillar ones. As the author actally says in the end of the article.

Sure it's possible. Use a mentally computable one-way "hash" when creating your passwords, such that you (and only you) can generate a unique password based on some attribute of the system you're creating the password for (name, domain name, etc).

Of course that's also too much work for the average user.

I think single sign-on systems with two factor authentication and other advanced security are a step in the right direction.

Reply on news.ycombinator.com