Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror

Slashdot videos: Now with more Slashdot!

  • View

  • Discuss

  • Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

×

Comment: Re:Why? (Score 4, Insightful) 269

Profanity is a crutch.

Empty platitudes repeated by people who dislike profanity for the sake of feeling good about themselves. Profanity is one of many tools that people can use to express themselves, and it is completely unrelated the strength of the points being argued. The sun is fucking hot, the sky is damn blue, and shit like "profanity is the sign of a weak argument" is ignorant and fallacious.

Comment: Re:Memorizing site-unique passwords isn't possible (Score 1) 263

by hatemonger (#49374991) Attached to: Generate Memorizable Passphrases That Even the NSA Can't Guess
For someone who does want an online identity, password management software is by far the best option for anyone with a moderately valuable one. Of course there isn't a perfect solution, but it would be wronger than wrong to suggest that since there are ways to subvert password management software, then it's no better than memorization. A good camera angle or keylogger will steal your memorized passwords as you type them just as easily as it will from a password manager. Easier, in many cases. And your "single point of failure" argument is weakened by the fact that even a moderate password locking a database of one of the popular password managers would be resistant to years of offline attack. I mean, sure, the lack of convenience is an argument against using a password manager, but it's also an argument against wearing a seatbelt. It's needlessly risky to type a memorized password into a site where you have no visibility on what they're doing with it, what security they have in place to detect breaches, or even if they'd notify you when your credentials were stolen. Monitoring your credit report is a valuable part of a defense in depth but not as an alternative to good password practices.

Comment: Re:Memorizing site-unique passwords isn't possible (Score 1) 263

by hatemonger (#49371327) Attached to: Generate Memorizable Passphrases That Even the NSA Can't Guess
Not really. If "Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn1" isn't safe, your choice of mixed song lyrics probably isn't, either, asuming a malicious actor is trying to figure out the input when they know the MD5 output. And if they've compromised a site that was storing your password in plaintext, your password strength is completely irrelevant. Like I said, the real issue is password reuse, and it's impossible for a human to memorize good, unique passwords for every site they visit. Password managers are the only solution for people who value their online identity.

Comment: Re:How about... (Score 2) 263

by hatemonger (#49350023) Attached to: Generate Memorizable Passphrases That Even the NSA Can't Guess
Yes, "don't outrun the bear; outrun your companion" is a fair strategy in computer security. But if you're made of particularly juicy and delicious man-meats (which would be analogous to having your name be Brian Krebs or Jennifer Lawrence or being a Google employee or having a three letter twitter handle), some bears might decide that it's worth a little extra effort to run you down instead. It's a personal decision as to how much effort you're willing to put into protecting your online identity.

Comment: Re:Yes, but.... (Score 1) 263

by hatemonger (#49349971) Attached to: Generate Memorizable Passphrases That Even the NSA Can't Guess
I'm not so sure about "probably". I'd say it's probable that if they're restricting length then at some point they were being stupid like storing passwords in a VARCHAR(8), but lots of times those restrictions get kept for backwards compatibility even after they've upgraded how they're storing passwords. The best canary in the coalmine is whether they'll email or display your old password as part of the password reset process.

Comment: Re:Memorizing site-unique passwords isn't possible (Score 1) 263

by hatemonger (#49349917) Attached to: Generate Memorizable Passphrases That Even the NSA Can't Guess
That's a tough battle to fight. Users, when faced with making a decision between fulfilling their immediate digital urge and being safe, will choose to fulfill their digital urge 99% of the time. If "being safe" was an option presented via dialogue box, 99% of the 1% that initially chose to be safe will repeat the action so they can make the digital urge fulfillment choice instead.

Comment: Re:How about... (Score 1) 263

by hatemonger (#49349835) Attached to: Generate Memorizable Passphrases That Even the NSA Can't Guess
So the bad guy just got the password database from hacking slashdot and sees your password is sahcorrecthorsebatterystaple. The bad guy pulls up another password leak from hellokittyislandadventure.com, and sees an account with the same email address uses the password hlocorrecthorsebatterystaple as a password. It's entirely possible they'll figure it out given enough data points. You're right that it's an edge case, since nowadays the bad guys aren't doing much of that since there are so many users using "letmein" and "Password1", so you have to make a decision. Given the number of places you're reusing your password strategy, your knowledge (or lack thereof) of trends in identity theft via password leaks, and the value you place in your online identity, is it worth using password management software instead of memorizing a password algorithm?

In favor of password managers, when banks do stupid stuff like that you can use the software to make truly random passwords that follow those requirements. No need to modify your algorithm to fit within stupid restrictions.

Comment: Re:Memorizing site-unique passwords isn't possible (Score 1) 263

by hatemonger (#49349735) Attached to: Generate Memorizable Passphrases That Even the NSA Can't Guess
Well, no. That's an entirely different type of attack, requiring entirely different skills and resources. Script kiddies are perfectly able to download a bunch of leaked databases, look for username or email address matches between them, read the passwords in plaintext, guess that you're using the site name or url to modify your passwords, and then try your username and password on amazon or banking or webmail sites. They're not going to be able to say "Man, look at that guy's password! I should hack a trojan onto his computer by backtracing his IP address using a Visual Basic GUI!"

Also of note, KeePass has defenses against keyloggers.

Comment: Re:Memorizing site-unique passwords isn't possible (Score 1) 263

by hatemonger (#49349623) Attached to: Generate Memorizable Passphrases That Even the NSA Can't Guess
Every everything is vulnerable. You have to make choices to minimize your vulnerability given the current risk environment. You're millions of times more likely to have your password leaked because it was stored in an insecure manner on a vulnerable server than to be subjected to a crowbar hack, so you should prioritize your defense accordingly.

Comment: Re:Memorizing site-unique passwords isn't possible (Score 2) 263

by hatemonger (#49349557) Attached to: Generate Memorizable Passphrases That Even the NSA Can't Guess
Treating numerous accounts as "low security" and reusing your passwords across them is still dangerous, in my opinion, but it's up to you whether the effort of storing those extra passwords in your password management program is worth the added security. Information gleaned from multiple "low security" accounts could potentially be combined to get access to your high security accounts. And once you get password management software set up, I've found it's much easier than remembering and typing, even for the accounts I don't care about. Autofill is glorious, and I really love never having to play the game of "have I already registered for this site?"

Comment: Re:Wait a sec (Score 3, Informative) 263

by hatemonger (#49349447) Attached to: Generate Memorizable Passphrases That Even the NSA Can't Guess
Exactly the opposite: "Encryption works" was one of the key points made by Edward Snowden. The NSA found it much easier to just bypass encryption. There are some instances where we suspect the NSA has had a hand weakening or backdooring some algorithms (like recommending odd seed values for elliptic curve cryptography) but nothing definitive.

Comment: Memorizing site-unique passwords isn't possible (Score 5, Insightful) 263

by hatemonger (#49349375) Attached to: Generate Memorizable Passphrases That Even the NSA Can't Guess
Diceware is a great recommendation, but you're missing one key consideration: password reuse is a larger danger to users than is having a weak password. The Apple iCloud hack is one of the few in recent memory where a password-related breach wasn't tied to password reuse. What happens most of the time is that a site is vulnerable to SQL injection gets their users table stolen, and "bad guys" use that information to try accounts on related sites. If the compromised website was using a bad (i.e. fast) password hashing algorithm, then having a good password will protect you a little, but you're playing with fire. Password cracking techniques have been advancing exponentially, as has GPU power. But if this site is using reversible encryption or storing passwords in plaintext (which still happens with alarming frequency) then all your other accounts are at risk from the one breach regardless of how great your password is. Of course, if they're using a good password algorithm like PBKDF2 or bcrypt, even a mediocre password will be relatively safe. But what are the chances that every site you've registered with is using a good password algorithm? Probably zero. How can you check the password storing technique of a site you're about to register with? You can't.

Yeah, you could make an algorithm to modify your password across sites so that you can memorize it yet it'll be different, but as "bad guys" combine information from multiple leaks, any algorithm you come up with will be vulnerable to reverse engineering. Especially if your online identity is valuable. The real solution is to use password management software like KeePass, LastPass, or 1Password. Lock your password program with your good password from Diceware, and use unique, truly random passwords for all the websites you've registered on.

+ - Passphrases You Can Memorize That Even The NSA Can't Guess 2

Submitted by HughPickens.com
HughPickens.com (3830033) writes "Micah Lee writes at The Intercept that coming up with a good passphrase by just thinking of one is incredibly hard, and if your adversary really is capable of one trillion guesses per second, you’ll probably do a bad job of it. It turns out humans are a species of patterns, and they are incapable of doing anything in a truly random fashion. But there is a method for generating passphrases that are both impossible for even the most powerful attackers to guess, yet very possible for humans to memorize. First, grab a copy of the Diceware word list, which contains 7,776 English words — 37 pages for those of you printing at home. You’ll notice that next to each word is a five-digit number, with each digit being between 1 and 6. Now grab some six-sided dice (yes, actual real physical dice), and roll them several times, writing down the numbers that you get. You’ll need a total of five dice rolls to come up with each word in your passphrase. Using Diceware, you end up with passphrases that look like “cap liz donna demon self”, “bang vivo thread duct knob train”, and “brig alert rope welsh foss rang orb”. If you want a stronger passphrase you can use more words; if a weaker passphrase is ok for your purpose you can use less words. If you choose two words for your passphrase, there are 60,466,176 different potential passphrases. A five-word passphrase would be cracked in just under six months and a six-word passphrase would take 3,505 years, on average, at a trillion guesses a second.

After you’ve generated your passphrase, the next step is to commit it to memory.You should write your new passphrase down on a piece of paper and carry it with you for as long as you need. Each time you need to type it, try typing it from memory first, but look at the paper if you need to. Assuming you type it a couple times a day, it shouldn’t take more than two or three days before you no longer need the paper, at which point you should destroy it. "Simple, random passphrases, in other words, are just as good at protecting the next whistleblowing spy as they are at securing your laptop," concludes Lee. "It’s a shame that we live in a world where ordinary citizens need that level of protection, but as long as we do, the Diceware system makes it possible to get CIA-level protection without going through black ops training""

% APL is a natural extension of assembler language programming; ...and is best for educational purposes. -- A. Perlis

Working...