Schneier on Security

Carl 'SAI' Mitchell • January 13, 2012 2:21 PM

Definitely interesting. One thing to mention is that gmail now supports 2-factor authentication via text message. It’s easy to enable and certainly a good idea.

Password policies (both enforced and personal) are rather interesting. Security is often sacrificed for convenience, and in many cases convenience is sacrificed for a false sense of security.

Some common limits, like a maximum password length, are damaging to both usability and security. Longer passwords are more secure, passphrases are easier to remember and more secure (if generated well, such as with diceware) and programming in a length limit introduces another possible source of error. Since the best practice is to hash all passwords any length will produce a fixed-size hash output. If you’re not hashing (and preferably salting) your passwords you have no right to be making an authentication system.

In the end, I developed a compromise system. My most secure passwords are protected by keepass password safe. My master password is a 6-word diceware passphrase. This keeps really important stuff, such as bank account passwords. I also store other passwords here as a backup in case I forget. All “security question” answers are random gibberish at least as complex as the password. My mother’s maiden name is “kk&`V^522G/5O7t&5!#RBhrm\w.4lX”. Yes, she is polish, how did you guess?

Next down I have a few 5-word diceware passphrases. 1 for my e-mail that is used nowhere else. The next in the form ThisIsFiveWordsLong+SITEURL. I copy+paste the URL when entering the password. I use it for sites/services where no financial information is given, I care about the account, and I have reason to believe the password is properly hashed and salted. Sites without that reason that I care about get keepass passwords.

Game logins use the same system as above, but with a different diceware phrase. Some fullscreen games get buggy when alt-tabbing out to keepass to copy & paste the password, so I have to be able to type it.

Then there are the 1-off sites, and the sites I use regularly but don’t care about at all. For example, I use a site for midi soundfont downloads that requires an account. The account is purely for tracking, there’s no forum or any real reason for login credentials. So I use physical or mathematical constants. Generally the golden ratio:
Phi=1.618033
Upper case, lower case, numbers, punctuation, 12 characters! It’s a perfect password for things that don’t need a password. If any of the hundreds of sites I’ve made an account for and forgotten about is compromised I lose access to all of them, but I’ve already forgotten their existence anyway. I also don’t use my real name or standard alias on such sites.

I’ve sacrificed security for convenience in the case of the 1-off sites, and convenience for security in the case of banking passwords (I don’t actually know any of them. I’ve never even seen most of them, just copy+paste from keepass into the login page.)