Hackers hold 7 million Dropbox passwords ransom

[nil 81]

That's another thing. Since I use a proper password manager, I've no reason to create a weak one =P.

Edited October 18, 2014 by nil

[Skeezix the Cat 3,087]

I had a system for creating my passwords. I'd progressively make a new one every few months and whatever services I started using in that time will keep the password, but new services get the new one. The actual system I mentioned was how I created new passwords, they all have two things in common but even if you knew one of my passwords and knew the similarities, you probably wouldn't be able to guess the other ones at this point. I haven't made a new password in like two years though, lol

[Floofies 2,468]

That doesn't help anything when most passwords are stolen by getting them from hacked databases or through third party applications that sell the information to people like the Russian Business Network. Having a way overly complicated password is useless. Once you have something moderately complex, you're fine from brute force attacks or dictionary attacks.

You can't really do much about that, other than using sites that only use PGP keys. The site you're logging into shouldn't know what your password is, if it's truly secure.

[NeX 1,753]

You can't really do much about that, other than using sites that only use PGP keys. The site you're logging into shouldn't know what your password is, if it's truly secure.

 

This x1000. I get people at work all the time (basic tech support) that don't know their password, and expect the company or service to simply tell them what their password is.  If they know your password, then they have a decryption algorithm in place, which means their encryption is useless if someone gets their hands on it. Much easier to make an encryption and never worry about decryption for passwords at least. That's why every password recovery utility i've ever had to use (for myself or at the behest of someone else) has simply used alternate verification and then reset the password to a random series of characters, until such a time as the account holder changes it themselves.

 

Foolish mortals.

[Kavawuvi 6,083]

You can't really do much about that, other than using sites that only use PGP keys. The site you're logging into shouldn't know what your password is, if it's truly secure.

Yes. Private keys aren't transmitted from your computer, and you can encrypt them with a password which is also not transmitted from your computer. The only thing stored on a database is your public key. I use public keys in place of a password for ssh with my Halo server and raspberry pi.

 

The only downside is portability. If you wanted to use a public terminal, you'd need to bring your key, perhaps in a flash drive. You'd need some sort of security to prevent the key being stolen from the flash drive.

 

This x1000. I get people at work all the time (basic tech support) that don't know their password, and expect the company or service to simply tell them what their password is.  If they know your password, then they have a decryption algorithm in place, which means their encryption is useless if someone gets their hands on it. Much easier to make an encryption and never worry about decryption for passwords at least. That's why every password recovery utility i've ever had to use (for myself or at the behest of someone else) has simply used alternate verification and then reset the password to a random series of characters, until such a time as the account holder changes it themselves.

 

Foolish mortals.

 

I mentioned on "Everything's fucking shit" about the textbook website emailing my password to me in plain text. Now it's in my inbox in plain text. I bet it's stored in plain text. If it's encrypted, I'm sure whatever decrypts it can be stolen easily if the database is hacked, making encryption useless.

 

Edited October 19, 2014 by 002

[NeX 1,753]

I mentioned on "Everything's fucking shit" about the textbook website emailing my password to me in plain text. Now it's in my inbox in plain text. I bet it's stored in plain text. If it's encrypted, I'm sure whatever decrypts it can be stolen easily if the database is hacked, making encryption useless.

 

Holy balls.....

But yes, that was precisely my point.

[nil 81]

I'm not sure if you guys heard of 2 factor authentication..

[Floofies 2,468]

I'm not sure if you guys heard of 2 factor authentication..

I use it on every site that has it. I just enabled it for Dropbox, too.

[Kavawuvi 6,083]

I'm not sure if you guys heard of 2 factor authentication..

I don't have a cellphone. Edited October 19, 2014 by 002

[nil 81]

The second factor is most commonly a cell phone but doesn't have to be (and it would suck if you didn't have cellular connection or something..). Dropbox supports the Google Authenticator app for mobile devices including tablets which you have (and Apple would use push notification or iMessage or something?). I avoid enabling multi factor for services that don't provide backup codes, though.

Edited October 19, 2014 by nil