Re:Things I Learnt from a Senior Software Engineer
by jchook on Sunday August 25, 2019 @09:28PM
(#20796844)
I had to learn the hard way
[ Parent
| on HN ]
Re:Things I Learnt from a Senior Software Engineer
by Moru on Monday August 26, 2019 @05:53AM
(#20798505)
I worked with home support for an ISP. A few times I was at a customer helping with a router and the mother call her son to get the password for the router. Not always a nice password...
Re:Things I Learnt from a Senior Software Engineer
by philwelch on Monday August 26, 2019 @01:02PM
(#20801538)
I very much believe in offensive passwords/passphrases (maybe not for wireless routers) specifically because:
(a) You're not supposed to tell anybody what they are.
(b) Offensive passphrases are easier to remember.
Re:Things I Learnt from a Senior Software Engineer
by ses1984 on Monday August 26, 2019 @05:04PM
(#20803762)
Also easier to crack if an attacker knows that detail.
Re:Things I Learnt from a Senior Software Engineer
by philwelch on Tuesday August 27, 2019 @01:08AM
(#20806497)
Not that it narrows it down that much.
Re:Things I Learnt from a Senior Software Engineer
by ses1984 on Tuesday August 27, 2019 @09:20AM
(#20809255)
You could probably throw out 90% or more of dictionary words for your permutations, I'd say that is significant enough to paint a target on your back.
Re:Things I Learnt from a Senior Software Engineer
by philwelch on Tuesday August 27, 2019 @08:46PM
(#20815859)
If your password is derived from a four word phrase (per the XKCD formula, which isn’t the only one), potentially all of the individual words could be inoffensive in isolation. There’s no obvious way to operationalize the human intuition of offense in a way that restricts the search space if you’re smart about it.
Re:Things I Learnt from a Senior Software Engineer
by ses1984 on Tuesday August 27, 2019 @09:31PM
(#20816098)
It all depends on if you have anything worth cracking. Sure, if your average hn reader encrypts a password db with a dirty four word phrase, that reader will be fine because no one is willing to rub two pennies together to crack that.
On the other hand if you're protecting secrets actually worth something...