News for hackers. Stuff that matters.
Re:Double Blind Passwords a.k.a. Horcruxing by Hackbraten on Tuesday December 22, 2020 @01:45AM (#25503658)
> I've actually had an attacker contact me personally (that is, actually chatting with me live) and ask me to sign up for his forum under the hope that I would reuse my valuable account's password on the forum.

How did you eventually find out their true motivation?

Re:Double Blind Passwords a.k.a. Horcruxing by Thorrez on Tuesday December 22, 2020 @02:06AM (#25503756)
I had one of the most valuable accounts in a video game, so attackers of all kinds were constantly contacting me. I was immediately suspicious of anyone who contacted me. I signed up for the forum with a password from my password manager (I like toying with attackers). I told him I signed up, and a few minutes later he said there was a problem with my account and asked if I used a password manager. I said yes. He said to sign up without it because the site doesn't support it. I tried arguing with him that that makes no sense. But arguing with someone who's lying and refuses to admit it is generally not productive, and the argument got nowhere.

His idea to make me sign up without a password manager was illogical anyways. If I use a password manager on his site, it should be obvious I use a password manager for my video game account, so me halting my password manager usage for his site wouldn't help him get my video game account.

Re:Double Blind Passwords a.k.a. Horcruxing by GoblinSlayer on Tuesday December 22, 2020 @03:24AM (#25504181)
All security eventually relies on obscurity, it's a bad idea to disclose your security practices. Use hunter2 as password for junk sites.
Re:Double Blind Passwords a.k.a. Horcruxing by Thorrez on Tuesday December 22, 2020 @11:37AM (#25508057)
From a humor point of view that would be a good idea, something like "dontbothertryingtostealmyaccount".

I also agree somewhat about obscurity. Notice that I haven't said what password manager I use, or where I store it. The fact that I use a password manager I don't consider sensitive though.

Re:Double Blind Passwords a.k.a. Horcruxing by lstamour on Tuesday December 22, 2020 @04:08AM (#25504405)
By that same logic, use disposable email addresses and the password doesn’t matter? I mean, this kind of thing only holds up while you don’t care to enter any data about yourself and re-visit the site later. Those who need to be anonymous can provide junk info to junk sites, sure, but for everything else, there’s email and 2FA TOTP codes and password managers for a reason... largely because OAuth and FIDO2 aren’t universal yet I suppose ;-)
Re:Double Blind Passwords a.k.a. Horcruxing by red0point on Tuesday December 22, 2020 @03:53AM (#25504321)
Can you elaborate on why all security will eventually rely on obscurity?
Re:Double Blind Passwords a.k.a. Horcruxing by GoblinSlayer on Tuesday December 22, 2020 @04:49AM (#25504608)
It's jokingly called Fleming's cryptanalysis: if there's a secret key, you just send James Bond to steal it.
Re:Double Blind Passwords a.k.a. Horcruxing by Thorrez on Tuesday December 22, 2020 @11:40AM (#25508115)
The only type of obscurity that would protect me against that type of attack is if I myself am entirely obscure. By having one the most valuable accounts in a video game, I've already given up on that.
Re:Double Blind Passwords a.k.a. Horcruxing by jerezzprime on Tuesday December 22, 2020 @08:13AM (#25505889)