How many passwords do you use online?

[Ghost]

I wrote an article today that explains how pretty much any webmaster can steal your passwords online. It can be done with established software such as WordPress, XenForo, etc. Pretty much any site that takes your login information can store it without encrypting it to then access other online accounts you have, get into your email potentially, and mess with your life.

So, my question is - How many passwords do you have memorized / do you use?

I have 4 "base passwords" and each one has 2-3 alterations, so I have around 10-12 unique passwords - but that's just for critical things like email, banks, etc. For forum, blog, and other sign ups (on sites not owned by massive organizations) I use a separate 1-2 passwords with a couple alterations, so that adds a few more.
Alterations means that "ghost" could be a password, and an alteration would be "ghost#32" and another would be "ghost55!". Obviously that is not my base password, but that's an example

Feel free to answer the question in the poll & tell us what you do to protect your data, finances, and other online holdings!

 

[Tealk]

So I use a separate 30 digit password for each website and this includes uppercase, lowercase, numbers and special characters.
All are stored in a password safe which is also secured with a 30 digit password.
Therefore I will not participate in the survey because it theoretically goes into infinity.

 

[Ghost]

That's very safe of you. Good job. You should be proud - A lot of people stick to 10-12 character passwords, use the same ones, and when they write them down they either do it on paper in their desk or on a file stored in their PC desktop...usually not encrypted either.
I added a new poll option for you! "To Infinity and Beyond!"

 

[Tealk]

I added a new poll option for you! "To Infinity and Beyond!"

Thanks

I even go so far as to use my own email address for most websites. This will also make it harder if the password becomes known.

 

[Ghost]

Thanks
I even go so far as to use my own email address for most websites. This will also make it harder if the password becomes known.

Have you ever heard of the concept of longer is better? In the sense that "hello this is my password today" is more secure than "h3@!#F-x" because of the character length...
What do you think of that?

 

[Tealk]

"hello this is my password today"

yes, but that depends on many factors. You can also write "aA1!0000000000000000000000000000" and in many cases it is hard to hack that.

 

[Antero360]

Tell me why this sounds like a great opportunity for social engineering XD

 

[Tealk]

You have to explain that to me.

 

[Antero360]

You have to explain that to me.

Social engineering: Trying to get enough information about someone to try to lower the amount of guess work for credentials

 

[Antero360]

I wrote an article today that explains how pretty much any webmaster can steal your passwords online. It can be done with established software such as WordPress, XenForo, etc. Pretty much any site that takes your login information can store it without encrypting it to then access other online accounts you have, get into your email potentially, and mess with your life.

So, my question is - How many passwords do you have memorized / do you use?

I have 4 "base passwords" and each one has 2-3 alterations, so I have around 10-12 unique passwords - but that's just for critical things like email, banks, etc. For forum, blog, and other sign ups (on sites not owned by massive organizations) I use a separate 1-2 passwords with a couple alterations, so that adds a few more.
Alterations means that "ghost" could be a password, and an alteration would be "ghost#32" and another would be "ghost55!". Obviously that is not my base password, but that's an example

Feel free to answer the question in the poll & tell us what you do to protect your data, finances, and other online holdings!

Perfect example of social engineering giving out too much information about password structure

So I use a separate 30 digit password for each website and this includes uppercase, lowercase, numbers and special characters.
All are stored in a password safe which is also secured with a 30 digit password.
Therefore I will not participate in the survey because it theoretically goes into infinity.

Perfect example of social engineering.. giving out too much information about password storage and storage password length

 

[Tealk]

You can have as much information as you want when the passwords are generated by a program. The information has no advantage at all.

 

[Antero360]

You can have as much information as you want when the passwords are generated by a program. The information has no advantage at all.

That may be true, but let me ask you what password gen do you use?

 

[Tealk]

Keepass

 

[Antero360]

Keepass

Sir, are you aware of this beauty right here? lol

Severe vulnerabilities uncovered in popular password managers

Passwords stored in RAM could lead to theft, but the report has to be considered in a risk-based context.

www.zdnet.com

 

[Tealk]

However, many password managers are affected by this problem and it is also called in combination with windows, which I do not use.
But also the danger is very limited.
still better than entrusting your passwords to an external service

 

[sn0w]

Sir, are you aware of this beauty right here? lol

Severe vulnerabilities uncovered in popular password managers

Passwords stored in RAM could lead to theft, but the report has to be considered in a risk-based context.

www.zdnet.com

The article is moot.
If "i accidently installed evil stuff on my pc" is your attack vector, then you're screwed either way.
Instead of digging around in RAM, that software could just log what keys you pressed and which programs were focused while you pressed them.

Password managers protect you from losing a bunch of accounts when a hashed (or cleartext) password of one account is leaked.
It doesn't (and can't) protect you from infecting your PC with shady software.

Perfect example of social engineering.. giving out too much information about password storage and storage password length

Security by obscurity never works.
If the password is long and complex enough you gain nothing from knowing the parameters.
For example: Knowing that my CodeForum password is 56 characters of upper/lower letters, numbers, and special chars, doesn't get you one iota closer to "cracking" it.
Simply because there are way too many combinations to try them all in a reasonable amount of time.

Spoiler

If you want some numbers:
My password has around ~350 bits of entropy.
Entropy tells you the average cost of randomly hitting the right password while brute-forcing it.
An entropy of n means that, on average, you will need 2^n-1 guesses before you hit a match.
In my case that means doing 2^349 guesses (that's a number with 106 digits).

If CodeForum is badly configured and uses a fast hash like SHA-1,
and if you happen to have 8 modern GPUs laying around that can (together) reach around 8-10 billion SHA-1 guesses per second,
you'd have to wait around 4x10^87 years until you find a match.

Renting a datacenter with 4096 GPUs would drop you down to 8x10^84 years.

Enslaving some countries to crack my password with one trillion GPUs (10^18) would still need 2x10^60 years.

So either way the universe should reach it's heat death before you get there.

 

[sn0w]

I wrote an article today that explains how pretty much any webmaster can steal your passwords online

Neat article
It's always good to make people aware of such dangers.

 

[Antero360]

The article is moot.
If "i accidently installed evil stuff on my pc" is your attack vector, then you're screwed either way.
Instead of digging around in RAM, that software could just log what keys you pressed and which programs were focused while you pressed them.

Password managers protect you from losing a bunch of accounts when a hashed (or cleartext) password of one account is leaked.
It doesn't (and can't) protect you from infecting your PC with shady software.



Security by obscurity never works.
If the password is long and complex enough you gain nothing from knowing the parameters.
For example: Knowing that my CodeForum password is 56 characters of upper/lower letters, numbers, and special chars, doesn't get you one iota closer to "cracking" it.
Simply because there are way too many combinations to try them all in a reasonable amount of time.

If you want some numbers:
My password has around ~350 bits of entropy.
Entropy tells you the average cost of randomly hitting the right password while brute-forcing it.
An entropy of n means that, on average, you will need 2^n-1 guesses before you hit a match.
In my case that means doing 2^349 guesses (that's a number with 106 digits).

If CodeForum is badly configured and uses a fast hash like SHA-1,
and if you happen to have 8 modern GPUs laying around that can (together) reach around 8-10 billion SHA-1 guesses per second,
you'd have to wait around 4x10^87 years until you find a match.

Renting a datacenter with 4096 GPUs would drop you down to 8x10^84 years.

Enslaving some countries to crack my password with one trillion GPUs (10^18) would still need 2x10^60 years.

So either way the universe should reach it's heat death before you get there.

Thank you Dr. Captain Obvious

 

[sn0w]

What do you mean?
You were spreading blatant misinformation and didn't mark it as sarcasm or joke in any way.

 

[Antero360]

The article is moot.
If "i accidently installed evil stuff on my pc" is your attack vector, then you're screwed either way.
Instead of digging around in RAM, that software could just log what keys you pressed and which programs were focused while you pressed them.

Password managers protect you from losing a bunch of accounts when a hashed (or cleartext) password of one account is leaked.
It doesn't (and can't) protect you from infecting your PC with shady software.



Security by obscurity never works.
If the password is long and complex enough you gain nothing from knowing the parameters.
For example: Knowing that my CodeForum password is 56 characters of upper/lower letters, numbers, and special chars, doesn't get you one iota closer to "cracking" it.
Simply because there are way too many combinations to try them all in a reasonable amount of time.

If you want some numbers:
My password has around ~350 bits of entropy.
Entropy tells you the average cost of randomly hitting the right password while brute-forcing it.
An entropy of n means that, on average, you will need 2^n-1 guesses before you hit a match.
In my case that means doing 2^349 guesses (that's a number with 106 digits).

If CodeForum is badly configured and uses a fast hash like SHA-1,
and if you happen to have 8 modern GPUs laying around that can (together) reach around 8-10 billion SHA-1 guesses per second,
you'd have to wait around 4x10^87 years until you find a match.

Renting a datacenter with 4096 GPUs would drop you down to 8x10^84 years.

Enslaving some countries to crack my password with one trillion GPUs (10^18) would still need 2x10^60 years.

So either way the universe should reach it's heat death before you get there.

You do realize that there are such things as rainbow tables and lists of already hacked, usually most common, passwords that you can run any password up against right? Also, why would you use SHA-1... SHA256/SHA512 are better.

What do you mean?
You were spreading blatant misinformation and didn't mark it as sarcasm or joke in any way.

How is the article "misinformation"?

What do you mean?
You were spreading blatant misinformation and didn't mark it as sarcasm or joke in any way.

And as far as my comment is concerned, "no duh" that a key logger could be installed in order to track your input. but again, the focus of the "misinformation" I was "spreading" according to you.. was in regards to vulnerabilities found in password managers. But again, what do I know, right?