Hacker News Reader

Comment by jameswyse | Hacker News Reader

This is just a way to create a slightly more complex password, if it's stored as a fast hash (like md5) then it's still going to be very easy to crack.

The problem with this method is that if one of your passwords is leaked and cracked then it wouldn't be too hard to guess how your scheme works. This gets even easier if they have 2 or more of your passwords.

It seems to me that a scheme like this would have to be much more complex, which unfortunately would just make it a pain to use.

I really wish Google, Mozilla, Microsoft, etc would step up and build a better authentication system right in to the browsers, perhaps with public key cryptography like SSH uses - then we'd have automatic logins to any site you decide to trust, and no more passwords.

View on HN

>This is just a way to create a slightly more complex password, if it's stored as a fast hash (like md5) then it's still going to be very easy to crack.

It's not about storage, it is about how to get people to use different passwords. Arguably, the passwords are not very different, but what matters is that they are no longer identic

Its still good advice to people who use the same password on all their accounts. 'just prefix the password with the first three letters of the hostname' will make sure they're slightly better protected in case of a password leak.

We can all agree it's better than using the same password on every site, but the people who do this are very unlikely to adopt such a system.

Try explaining this to a small child or elderly person, it's just not going to work.

The technology to do away with passwords all together already exists, we just need the right people (lets face it, it's probably going to be google) to standardise and implement it. It's no easy job but in my opinion is necessary for the web to move forward.

'just prefix the password with the first three letters of the hostname' ...

I just changed all my passwords so they're prefixed with 'www' but I'm not sure how that will help make them more secure. (j/k)

It's definitely not a fool proof or airtight system, but it's going to be at least a little time consuming to figure out the mechanism. Sure, a concerted effort will still break it, but you can protect yourself a bit more from a "0-day" hack than the alternatives: same password everywhere.

We definitely need better authentication methods. For example, why couldn't Google open up their 2 factor authentication method? Why is it that my battle.net account can have better security than my bank account?

Frustrating!

Googles two-factor authentication system is open sourced.

https://code.google.com/p/google-authenticator/

They include a JavaScript implementation and a PAM module. In fact, Dreamhost just implemented two factor auth that uses the Google Authenticator app last week. It works really well.

http://wiki.dreamhost.com/Enabling_Multifactor_Authenticatio...

In addition, Clavid OpenID integrates with the Google Authenticator app if you're an openID user.

I've been looking at the Yubikey+LastPass combo, which can also integrate with Google two-factor if you install a helper app. It seems like a nice solution, except that I'm really not a fan of the LastPass user experience.

in most password leak situations the issue is that you've used the same password elsewhere.. if it doesn't work, move on. It's unlikely you would be targeted specifically in such a situation.

If you make your password somewhat longer, it gets exponentially harder to crack.

mozilla is building browserid, while it does not get rid of passwords, it might be one spot where you can deply something like that. when integration within your browser happens, maybe we are not even far off...

Reply on news.ycombinator.com