2023 Security Check-up Reminder

Slur Generator said:
Why does password length and complexity even matter? NONE is going to brute force it! if your password is exposed its complexity doesn't matter.
Click to expand...
Shit pisses me off so much. The site asks you to make a 32 character password with uppercase, lowercase, numbers, punctuation, foreign characters, emojis and ancient runes... then they store your password on an unencrypted notepad document. Then you get the same email every time: "Oopsies! We had a breachy-weachy and your data is compromised! Soooowwwyyyy :("
Sexy Senior Citizen said:
I keep my passwords on a little sticky note that I move to a different place in my cubicle daily.
Click to expand...
Are you a Deus Ex NPC?
 
  • Like
  • Agree
Reactions: ekolet, Stalphos Johnson, 6thRanger and 8 others
AnOminous said:
And then you have some retarded shit for every site that you can't possibly remember unless you're Rain Man and have to use crutches like post-it notes under your keyboard and password managers. These passphrases usually also use more characters so the fact you're getting less entropy per character is outweighed by the fact you're probably using more characters in the first place.

The xkcd cartoon just isn't wrong. Even if the attacker knows you're using exactly this as a technique, it only slightly shortens their time to crack your passphrase, which is probably in the quadrillions of years anyway, especially if you just smush a bunch of dictionaries together into a giant file and generate randomly from that.
Click to expand...
I have probably a hundred different accounts in my password manager. Do you think I should use unique passphrases for each of them? The real crutch is password re-use, lowering your overall security because— as you say— you aren't Rain Man and can't remember a hundred different passphrases.

The main advantage of password managers is automating the selection & use of strong, unique passwords. It's true that this creates a single point of failure if someone were to keylog and steal your password vault. That's why physical vault decryption keys like Yubikey are important.

I realize there are also fancy attacks based on reading memory directly to scoop a password manager's master key, once they key has been unlocked with a master password + token. I don't know how common these attacks are in practice. It's also true that offline password storage (a notebook, old tablet, whatever) is immune to such attacks. If your PC has been compromised, though, they'll still get you when you type individual passwords to log in or renew sessions. So that's why it's important to reformat and rotate passwords occasionally.

If they're unique and sufficiently long, I'll concede that English passphrases are still good enough. Just did some back of the napkin math; there are 40,000 English words in common use per Google, so a passphrase of 4 common words (with reuse) has 40,000^4 permutations. At a single-GPU hash rate of maybe 24,000 h/s per Hashcat numbers I Googled, that would take 3 million years to crack with a dictionary attack. Good enough for anyone who isn't targeted by government agencies.
 
Last edited:
  • Informative
  • Agree
Reactions: supremeautismo, Marvin, AnOminous and 3 others
fish king said:
Don't even use the same email for Facebook and kiwi farms. Personally I have an email just for kiwi farms.
Click to expand...
I was thinking more your Facebook or Twitter sock for posting hot takes rather then one tied to your name. That would be your professional and friend group identity.
 
AStupidMonkey said:
lol @ all the dumbfucks in this thread explaining exactly how they choose/format/store their passwords.

Hope no one has an internet hate-boner for any of you. :story:
Click to expand...
The whole point of choosing a smart password scheme is that it doesn't matter if an attacker knows what the scheme is, because it's intrinsically secure. Anything else is security through obscurity.
 
  • Like
  • Agree
Reactions: Neo-Nazi Rich Evans, supremeautismo, Wright and 6 others
fish king said:
Don't even use the same email for Facebook and kiwi farms. Personally I have an email just for kiwi farms.
Click to expand...
See, what you need to do is go even further and make a while separate identity just for the farms.
Here's your new face dox: https://thisrentaldoesnotexist.com/img-new/face.jpg
Your apartment: https://thisrentaldoesnotexist.com/img-new/hero.jpg
Your cat: https://thesecatsdonotexist.com/
Your profile information: https://www.fakepersongenerator.com/
Next thing you're gonna want to do is get a time zone calculator and select a region of the world to be from. Then set limits on your computer so you can't accidentally post during the hours you're supposed to be asleep.
 
  • Like
  • Thunk-Provoking
  • Informative
Reactions: ekolet, Autistic Joe, DiggieSmalls and 10 others
quackrock said:
The whole point of choosing a smart password scheme is that it doesn't matter if an attacker knows what the scheme is, because it's intrinsically secure. Anything else is security through obscurity.
Click to expand...
If you literally tell people your scheme, they can eliminate 90% of possible passwords and brute-force you 9-10 times faster.

Funny that you took this personally as if I was singling you out tho. lol But don't let that stop you from re-reading this thread and seeing the shit I'm actually talking about. We are in the company of some real dumb motherfuckers.
 
  • Like
  • Informative
  • Agree
Reactions: scallion, folly magnet, Cold Root Beer and 3 others
TheBigZee said:
I've got the modpack. I'll run it on Linux with strace and see if I can figure out exactly what it tries to do. Assuming it tries to do anything/doesn't just outright crash on Linux.

I've only got Linux and I'm not going to set up a windows VM with GPU passthrough for this.
Click to expand...
When I get a chance I will take a look as well.

For the time being I checked all of the jar files using VirusTotal and one of them stood out in both cases.

The same file in each .zip was modified within the past few weeks and have interesting names from a prior upload. Note how the first submission was submitted shortly after the file was likely last modified, indicating whoever was involved uploaded it while working on it.
1678338223259.png
1678339015525.png
 
  • Informative
  • Like
Reactions: Autistic Joe, folly magnet, reptile baht spaniard rid and 1 other person
AStupidMonkey said:
lol @ all the dumbfucks in this thread explaining exactly how they choose/format/store their passwords.

Hope no one has an internet hate-boner for any of you. :story:
Click to expand...
If they have ability to break my password/encryption, learning that I'm using a particular password manager or that I'm using a passphrase of random words or an alphanumeric password is beyond trivial.
 
  • Agree
  • Like
Reactions: Klaptrap, Neo-Nazi Rich Evans, Personal Jesus and 2 others
Matt Damon said:
If they have ability to break my password/encryption, learning that I'm using a particular password manager or that I'm using a passphrase of random words or an alphanumeric password is beyond trivial.
Click to expand...
Again, nobody's singling you out. But I guess if you think the slipper fits, it's not my job to slap the cock out of your mouth. lol
 
  • Autistic
  • Mad at the Internet
Reactions: Klaptrap, Wright, Personal Jesus and 2 others
This would be a good time to ask this question.

I get a reminder in the email to sign in to my id.me account to keep it from expiring. What is id.me and why should I care?
 
AStupidMonkey said:
If you literally tell people your scheme, they can eliminate 90% of possible passwords and brute-force you 9-10 times faster.
Click to expand...
quackrock said:
At a single-GPU hash rate of maybe 24,000 h/s per Hashcat numbers I Googled, that would take 3 million years to crack with a dictionary attack. Good enough for anyone who isn't targeted by government agencies.
Click to expand...
3 million years divided by 10 is 300,000 years. That's for a weaker passphrase scheme.

I make no apologies for retards ITT reusing passwords, though.
 
  • Like
  • Informative
  • Dumb
Reactions: AStupidMonkey, Marvin, Aidan and 2 others
You must log in or register to reply here.
Back