excellent piece on the impact of metadata collecting on privacy. thank you.
Hereâs something I simply donât get. Why would you set your password to a phrase of personal significance? Why would you choose a favorite song, or singer, or whatever? Why do Christians set their password to im4given? Wouldnât it maybe make sense to choose something hard to guess? I mean, if you chose something random like Hippo7black, itâs not terribly hard to remember unless you have the IQ of a hammer. You donât have to go full throttle with h$67G_qQ or whatever.
As time goes by I am more and more convinced that I will never get a cell phone.
In Passpack, I have 107 accounts configured. Some of them are holding multiple passwords. A lot of sites â like newspapers and other services â have never been entered.
I canât possibly remember that many ârandomâ phrases.
Â
Â
Er, 'cepting I do, of course. TOTALLY RANDOM. waaaaaaay hard for you to guess. Donât even bother.
So whatâs your point? Itâs necessary to set your password to ILUBieber, because you have 107 accounts? I only have two passwords for everything (not counting the digits youâre sometimes forced to add.) Neither one is anything even my most intimate friends would ever guess.
As time goes by I am more convinced that Iâll get rid of mine, once the contract is up. Itâs awful convenient though, and it would be tough to give up on the addictive little buggers.
Another thought: do they still make dumb phones?
Thereâs no such thing as perfect security, and I donât think itâs really feasible to protect yourself against a sufficiently dedicated attack aimed against you, personally.
But I donât have to outrun the tiger, I just have to outrun you.
(Put another way: I always lock my bike up next to a nicer bike that is not locked up as securely. Yes, someone COULD still take my bike, but I have ensured that I am not the easiest or most attractive target.)
Youâve got it right: use a password manager. That way you only have to remember one hard-to-guess password, not a hundred. (xkcdâs correct horse battery staple example isnât bad but takes a prohibitively long time to type on every touchscreen keyboard Iâve ever used â someone needs to design one whose password mode still autocompletes words but doesnât store the words youâve used or the order you used them in â and pronounceable passwords are easier to remember than gibberish while having more entropy than real words.)
And use two-factor authentication wherever possible.
Of course, youâre still pretty much fucked if someone steals your phone â again, I donât think itâs possible to protect against a specific, targeted, sufficiently dedicated attack â but if youâre just trying to keep yourself insulated against the next big bulk attack, thatâs very doable.
Memorability. We remember stuff based on the connections we have with it. Random stuff is way harder to remember.
See above: the part about the hammer.
asdadsas: I donât have a cell phone either. But not having to worry that one is being tracked oneself doesnât diminish the harm that comes from tracking being possible. I want it to be possible for authority to be questioned, and for secrets to be dug out and exposed, even if I am not going to be the one doing the questioning and the digging and the exposing. I am protected from intrusions not only by not having a cell phone (of course, my internet traffic that comes from computers not phones is just as bad except for the location information), but also by not participating in the kinds of thing that intelligence agencies and the powers that prop them up do not wish us to be doing. Still, I want those things to continue to be done by those braver than meâso not having a cell phone myself doesnât help towards that larger goal.
(Not that you said not having a cell phone solves everything, but I just wanted to get that point off my chest)
And once one of those sites stores your password in plaintext and is hacked, your password for half of everything has been compromised.
Unsalted hash is enough. Rainbow tables for the win!
I saw google-cracking a password from its hash, by googling the hash. Quite often you get results.
Yes, although Iâd consider âunsalted hashâ to be close enough to unencrypted, these days.
Thatâs a reasonable assumption.
For example, google for this one. 482c811da5d5b4bc6d497ffa98491e38
The analysts could see that some users had the same password as Ton, and their password hints were known to be âpunk metalâ, âastroluxâ and âanother day in paradiseâ. âThis quickly led us to Ton Siedsmaâs favourite band, Strung Out, and the password âstrungoutâ,â the analysts write.
So the the takeaway is:
- DO NOT USE A DICTIONARY WORD PASSWORD
- Lie on your password recovery answers.
And of course remember Mat Honanâs story.
Best (worst) hints are things like âusername then 22â. Slightly better (worse) than âoldest sisterâ. Seen both.
Locations: A phone without GPS or CPU can still be triangulated. So shut it off (rely on voicemail) except in locations youâre ok about. The shutoff should somehow remove battery power from the phone. Each phone carries its own unique ID. While powered it could be spilling anything.
Passwords: nothing new here. Randoms for each site and use some kind of passworded âwalletâ.
True, but Iâm not interesting enough to present much of a target. If I was a prominent journalist I hope I would be more careful.
What I donât get was how/why Belgian IMinds needed the file of leaked passwords to get Tonâs Twitter/Google/Amazon passwords when âThe analysts could see that some users had the same password as Tonâ - i.e. they already had Tonâs password? Does that mean Tonâs encrypted password was contained within the phoneâs metadata, matched to Adobe passwords and guessed using the password hints? If you were going to match the encrypted phone password to an encrypted Adobe password, wouldnât they both need to use the same encryption? Just want to understand how this workedâŚ
