▲ 88 ▼ Massive data dump containing millions of passwords sparks security alert: Is your data safe? (www.techspot.com) submitted 2 years ago by throws_lemy@lemmy.nz to c/technology@beehaw.org 39 comments fedilink hide all child comments
[–] agressivelyPassive@feddit.de 11 points 2 years ago (4 children) All cool and dandy, until you have to type that random 50 letter string on your TV. permalink fedilink source parent hideshow 8 child comments replies: [–] falsemirror@beehaw.org 12 points 2 years ago (3 children) Many PW managers let you generate passphrases, which are all around better than random strings. Length is the most important factor so finance-caffeine-utopia-redress-unseen Is way stronger and easier to remember (and type) than Fl7$j4FWw)&5O permalink fedilink source parent hideshow 6 child comments replies: [–] Myaa@beehaw.org 3 points 2 years ago Huh, TIL. I had no idea that was an option but that's super useful for things I need to type in on a device with no keyboard, or even things I can't access my password manager for. Thanks for the protip there! permalink fedilink source parent [–] Murkhat@feddit.de 2 points 2 years ago (2 children) Is it really safer? I mean when trying to bruteforce a password, one would have to make a guess whether it's a passphrase or not. But if you decided to check for pass phrases, wouldn't the one you posted be cracked in 5 times the amount of words in that dictionary? I'm not sure how large the vocabularies of the generators are, but I would guess a random 17 char password might be safer than a 5 phrases password? permalink fedilink source parent hideshow 4 child comments replies: [–] Scary_le_Poo@beehaw.org 5 points 2 years ago (1 child) but I would guess a random 17 char password might be safer than a 5 phrases password And you would be very wrong about that. A 5 phrase password has entropy. "finance-caffeine-utopia-redress-unseen" is 28 characters. If you add in a different symbol between the words and add a number somewhere, this password becomes incredibly difficult to brute force. I'll let xkcd explain it better. permalink fedilink source parent hideshow 2 child comments replies: [–] Murkhat@feddit.de 1 point 2 years ago Youre right,different separators, numbers and even capital letters change my theory alot permalink fedilink source parent [–] Areldyb@beehaw.org 1 point 2 years ago It'd be dictionary length to the fifth power, not times five. permalink fedilink source parent [–] esaru@beehaw.org 2 points 2 years ago* And pass phrases are faster to type and with less typos even though they need more characters than passwords to be the same secure. permalink fedilink source parent [–] bdonvr@thelemmy.club 8 points 2 years ago* (1 child) You don't need to make it that long. And also most TVs or whatever you're streaming with has a way to type from your phone nowadays. Apple TV, Chromecast, Android TV, heck I think even Xbox. It's kinda nice on Apple TV your phone will suggest autofill passwords for the TV, even from theirs party password managers like Bitwarden. permalink fedilink source parent hideshow 2 child comments replies: [–] abbadon420@lemm.ee 4 points 2 years ago (2 children) Android tv's arent that old. 10 years max. 5 years since it's affordable for most people. Is it unreasonable to own a 5 year old non-smart tv? I think not. I think it's weird that so many people assume everyone owns a smart tv. permalink fedilink source parent hideshow 4 child comments replies: [–] Evkob@lemmy.ca 6 points 2 years ago In what scenario would you need to type in a password on a non-smart TV though? Parental lock? permalink fedilink source parent [–] bdonvr@thelemmy.club 4 points 2 years ago* (last edited 2 years ago) You're not wrong but in what context would you be putting in passwords on a non-smart device Also it's not just smart TVs. You can hook up streaming sticks and boxes and game consoles to anything with an HDMI port permalink fedilink source parent [–] recreationalplacebos@midwest.social 5 points 2 years ago I had to do that recently, ended up being easier to just temporarily change the password to something short on a pc, then change it back after. permalink fedilink source parent [+] parpol@programming.dev 3 points 2 years ago (1 child) [deleted] permalink fedilink source parent hideshow 2 child comments replies: [–] jarfil@beehaw.org 4 points 2 years ago* (last edited 2 years ago) For symmetric keys, since they cannot be weakened using quantum computing, their strength can be assessed by their bit-equivalent amount of entropy: 40 bit or less - easily breakable 64 bit - not so easy, but doable 128 bit or more - basically unbreakable Those are equivalent to, respectively: 0-9 - 12, 19, 38 characters a-z - 9, 14, 28 characters a-z0-9 - 8, 12, 25 characters A-Za-z0-9 - 7, 11, 22 characters A-Za-z0-9+special - 7, 10, 21 characters Moral of the story: drop the special characters, and even the numbers... and even the uppercase. A 30+ character long all-lowercase pass phrase, is already unbreakable. Check @falsemirror@beehaw.org: finance-caffeine-utopia-redress -unseen ...is already over 128 bits. PS: Correct horse battery staple permalink fedilink source parent
[–] falsemirror@beehaw.org 12 points 2 years ago (3 children) Many PW managers let you generate passphrases, which are all around better than random strings. Length is the most important factor so finance-caffeine-utopia-redress-unseen Is way stronger and easier to remember (and type) than Fl7$j4FWw)&5O permalink fedilink source parent hideshow 6 child comments replies: [–] Myaa@beehaw.org 3 points 2 years ago Huh, TIL. I had no idea that was an option but that's super useful for things I need to type in on a device with no keyboard, or even things I can't access my password manager for. Thanks for the protip there! permalink fedilink source parent [–] Murkhat@feddit.de 2 points 2 years ago (2 children) Is it really safer? I mean when trying to bruteforce a password, one would have to make a guess whether it's a passphrase or not. But if you decided to check for pass phrases, wouldn't the one you posted be cracked in 5 times the amount of words in that dictionary? I'm not sure how large the vocabularies of the generators are, but I would guess a random 17 char password might be safer than a 5 phrases password? permalink fedilink source parent hideshow 4 child comments replies: [–] Scary_le_Poo@beehaw.org 5 points 2 years ago (1 child) but I would guess a random 17 char password might be safer than a 5 phrases password And you would be very wrong about that. A 5 phrase password has entropy. "finance-caffeine-utopia-redress-unseen" is 28 characters. If you add in a different symbol between the words and add a number somewhere, this password becomes incredibly difficult to brute force. I'll let xkcd explain it better. permalink fedilink source parent hideshow 2 child comments replies: [–] Murkhat@feddit.de 1 point 2 years ago Youre right,different separators, numbers and even capital letters change my theory alot permalink fedilink source parent [–] Areldyb@beehaw.org 1 point 2 years ago It'd be dictionary length to the fifth power, not times five. permalink fedilink source parent [–] esaru@beehaw.org 2 points 2 years ago* And pass phrases are faster to type and with less typos even though they need more characters than passwords to be the same secure. permalink fedilink source parent
[–] Myaa@beehaw.org 3 points 2 years ago Huh, TIL. I had no idea that was an option but that's super useful for things I need to type in on a device with no keyboard, or even things I can't access my password manager for. Thanks for the protip there! permalink fedilink source parent
[–] Murkhat@feddit.de 2 points 2 years ago (2 children) Is it really safer? I mean when trying to bruteforce a password, one would have to make a guess whether it's a passphrase or not. But if you decided to check for pass phrases, wouldn't the one you posted be cracked in 5 times the amount of words in that dictionary? I'm not sure how large the vocabularies of the generators are, but I would guess a random 17 char password might be safer than a 5 phrases password? permalink fedilink source parent hideshow 4 child comments replies: [–] Scary_le_Poo@beehaw.org 5 points 2 years ago (1 child) but I would guess a random 17 char password might be safer than a 5 phrases password And you would be very wrong about that. A 5 phrase password has entropy. "finance-caffeine-utopia-redress-unseen" is 28 characters. If you add in a different symbol between the words and add a number somewhere, this password becomes incredibly difficult to brute force. I'll let xkcd explain it better. permalink fedilink source parent hideshow 2 child comments replies: [–] Murkhat@feddit.de 1 point 2 years ago Youre right,different separators, numbers and even capital letters change my theory alot permalink fedilink source parent [–] Areldyb@beehaw.org 1 point 2 years ago It'd be dictionary length to the fifth power, not times five. permalink fedilink source parent
[–] Scary_le_Poo@beehaw.org 5 points 2 years ago (1 child) but I would guess a random 17 char password might be safer than a 5 phrases password And you would be very wrong about that. A 5 phrase password has entropy. "finance-caffeine-utopia-redress-unseen" is 28 characters. If you add in a different symbol between the words and add a number somewhere, this password becomes incredibly difficult to brute force. I'll let xkcd explain it better. permalink fedilink source parent hideshow 2 child comments replies: [–] Murkhat@feddit.de 1 point 2 years ago Youre right,different separators, numbers and even capital letters change my theory alot permalink fedilink source parent
[–] Murkhat@feddit.de 1 point 2 years ago Youre right,different separators, numbers and even capital letters change my theory alot permalink fedilink source parent
[–] Areldyb@beehaw.org 1 point 2 years ago It'd be dictionary length to the fifth power, not times five. permalink fedilink source parent
[–] esaru@beehaw.org 2 points 2 years ago* And pass phrases are faster to type and with less typos even though they need more characters than passwords to be the same secure. permalink fedilink source parent
[–] bdonvr@thelemmy.club 8 points 2 years ago* (1 child) You don't need to make it that long. And also most TVs or whatever you're streaming with has a way to type from your phone nowadays. Apple TV, Chromecast, Android TV, heck I think even Xbox. It's kinda nice on Apple TV your phone will suggest autofill passwords for the TV, even from theirs party password managers like Bitwarden. permalink fedilink source parent hideshow 2 child comments replies: [–] abbadon420@lemm.ee 4 points 2 years ago (2 children) Android tv's arent that old. 10 years max. 5 years since it's affordable for most people. Is it unreasonable to own a 5 year old non-smart tv? I think not. I think it's weird that so many people assume everyone owns a smart tv. permalink fedilink source parent hideshow 4 child comments replies: [–] Evkob@lemmy.ca 6 points 2 years ago In what scenario would you need to type in a password on a non-smart TV though? Parental lock? permalink fedilink source parent [–] bdonvr@thelemmy.club 4 points 2 years ago* (last edited 2 years ago) You're not wrong but in what context would you be putting in passwords on a non-smart device Also it's not just smart TVs. You can hook up streaming sticks and boxes and game consoles to anything with an HDMI port permalink fedilink source parent
[–] abbadon420@lemm.ee 4 points 2 years ago (2 children) Android tv's arent that old. 10 years max. 5 years since it's affordable for most people. Is it unreasonable to own a 5 year old non-smart tv? I think not. I think it's weird that so many people assume everyone owns a smart tv. permalink fedilink source parent hideshow 4 child comments replies: [–] Evkob@lemmy.ca 6 points 2 years ago In what scenario would you need to type in a password on a non-smart TV though? Parental lock? permalink fedilink source parent [–] bdonvr@thelemmy.club 4 points 2 years ago* (last edited 2 years ago) You're not wrong but in what context would you be putting in passwords on a non-smart device Also it's not just smart TVs. You can hook up streaming sticks and boxes and game consoles to anything with an HDMI port permalink fedilink source parent
[–] Evkob@lemmy.ca 6 points 2 years ago In what scenario would you need to type in a password on a non-smart TV though? Parental lock? permalink fedilink source parent
[–] bdonvr@thelemmy.club 4 points 2 years ago* (last edited 2 years ago) You're not wrong but in what context would you be putting in passwords on a non-smart device Also it's not just smart TVs. You can hook up streaming sticks and boxes and game consoles to anything with an HDMI port permalink fedilink source parent
[–] recreationalplacebos@midwest.social 5 points 2 years ago I had to do that recently, ended up being easier to just temporarily change the password to something short on a pc, then change it back after. permalink fedilink source parent
[+] parpol@programming.dev 3 points 2 years ago (1 child) [deleted] permalink fedilink source parent hideshow 2 child comments replies: [–] jarfil@beehaw.org 4 points 2 years ago* (last edited 2 years ago) For symmetric keys, since they cannot be weakened using quantum computing, their strength can be assessed by their bit-equivalent amount of entropy: 40 bit or less - easily breakable 64 bit - not so easy, but doable 128 bit or more - basically unbreakable Those are equivalent to, respectively: 0-9 - 12, 19, 38 characters a-z - 9, 14, 28 characters a-z0-9 - 8, 12, 25 characters A-Za-z0-9 - 7, 11, 22 characters A-Za-z0-9+special - 7, 10, 21 characters Moral of the story: drop the special characters, and even the numbers... and even the uppercase. A 30+ character long all-lowercase pass phrase, is already unbreakable. Check @falsemirror@beehaw.org: finance-caffeine-utopia-redress -unseen ...is already over 128 bits. PS: Correct horse battery staple permalink fedilink source parent
[–] jarfil@beehaw.org 4 points 2 years ago* (last edited 2 years ago) For symmetric keys, since they cannot be weakened using quantum computing, their strength can be assessed by their bit-equivalent amount of entropy: 40 bit or less - easily breakable 64 bit - not so easy, but doable 128 bit or more - basically unbreakable Those are equivalent to, respectively: 0-9 - 12, 19, 38 characters a-z - 9, 14, 28 characters a-z0-9 - 8, 12, 25 characters A-Za-z0-9 - 7, 11, 22 characters A-Za-z0-9+special - 7, 10, 21 characters Moral of the story: drop the special characters, and even the numbers... and even the uppercase. A 30+ character long all-lowercase pass phrase, is already unbreakable. Check @falsemirror@beehaw.org: finance-caffeine-utopia-redress -unseen ...is already over 128 bits. PS: Correct horse battery staple permalink fedilink source parent