Hacker News Reader

Comment by Terr_ | Hacker News Reader

This is one I've been recommending to "Aunt Tillie"-types, because it involves fairly little computer-savvy:

1. Memorize a single prefix that has at least an uppercase letter, a number, and a symbol, to be used with all passwords. (e.g. j8$F)

2. Use a physical journal or pad of paper to note down each site's password restrictions (e.g. "no symbols") and a personal hint to the rest of the password.

3. Your password is the prefix (minus any unsupported characters) plus the answer to the hint.

So the hint "No symbols, They All Float Down Here" might become j8fPennyWise. "Feet On The Road" might be j8$fFlintstones.

___

This minimizes what people have to memorize, is secure against casual attacks by people in the same physical area, is strong against attackers who might try to replace "password4hn" with "password4reddit", and doesn't require any sort of special software.

View on HN

"Use a password manager" is so much easier to explain and teach.

A password manager is another tool that the user needs to learn, another moving part in a system that really shouldn't be so complex.

It's good advice, but it's by no means simpler than the alternative.

"in a system that really shouldn't be so complex" [citation needed]

Do you actually have a less complex way to reliably identify a person at the other end of a computer network?

(physical keys using NFC stuff are pretty exciting, but the tech isn't in place yet... until then we're stuck with "something you know" and the limits of human memory vs computer power)

Did you know that the CIA was one of the early investors in 1Password?

Not seriously, but I'm just saying. If you are really concerned about security I have a hard time understanding this concept.

Most people aren't worried about being secure from the CIA, we're worried about being secure from random criminals at the airport or the cafe. If the CIA wants you, they can just kidnap you and lock you away anyway.

And when "Aunt Tillie" installs a keylogging trojan, it's Game Over. Not only that, but she had no idea how to make backups.

A paper pad, on the other hand, is extremely secure against cyberattack, and she has tons of experience with managing it and creating backups. And it's almost what she was gonna do anyway.

Oh, right. I forgot that users no longer have to key in passwords after they have been recorded on a paper pad. Paper pads are extremely secure (sic).

I think the point is that these schemes are still vulnerable to one of the most common types of malware. It speaks to the fact that by far the greatest threat to your password security is from cyber sources, and likely not from your physical desk, so we might as well take advantage of that to help people out.

> > A paper pad, on the other hand, is extremely secure against cyberattack

> Paper pads are extremely secure (sic).

Stop right there, asshole. You're doctoring quotes and changing their meaning. That's not the correct usage of (sic) either.

> I forgot that users no longer have to key in passwords

1. Not all passwords are commonly-entered.

2. Passwords collected together in a defined file format are a richer target than ad-hoc collection thank forms-with-password-fields used in one of multiple possible browsers.

This strikes me as a really good strategy. Thanks for sharing.

At first I thought you were going to advocate the "just pick a prefix and then append the name of the site after it", like Go123facebook and Go123gmail. Which is, of course, quite awful because one plaintext reversing of one password may very well defeat all of the other passwords.

I figure if people are going to write things down on sticky notes anyway, it might as well be part of the system.

Hmmm... also, there's a failure-mode with systems that notice the prefix and reject future passwords as "too similar to one you used before". Users would have to deviate from the strategy somehow.

You just have to watch out for hackers who are also cruciverbalists...

True, but you're probably safe from hackers XOR cruciverbalists.

Reply on news.ycombinator.com