Hacker News new | ask | show | jobs
by thom 2535 days ago
Even if everybody on LiveJournal has since changed their passwords (there and everywhere they repeated it, which we know they won’t have), this now adds to the dictionary of passwords which _other_ humans may have chosen elsewhere and will certainly increase the hit rate of password spraying attacks etc.

While everyone recommends turning on 2FA everywhere, I’m increasingly convinced we’d all be safer if the password was the second, optional factor.
2 comments
jakear 2535 days ago
> I’m increasingly convinced we’d all be safer if the password was the second, optional factor.

Yes! Why can I not always login via an emailed token, secured by a TOTP? It would set a cookie, so no different in UX once you’re in, and that’s the normal “forgot password” flow, so no different in terms of security. But it would remove the need for me to constantly be opening up various password generation toolkits and resetting passwords and etc.

link
ryanlol 2535 days ago
>will certainly increase the hit rate of password spraying attacks etc

I do not see how this works in the context of other humans.

link
thom 2535 days ago
Because people don’t choose random passwords on the whole. So for every person who is revealed to have used zxcvbnm1234567890 as a password, there is a chance others have too. Obviously not for every password, but every large leak of actual passwords adds some that will match elsewhere.
link
ryanlol 2535 days ago
I don’t see how this leads to an increased hit rate, now you’ll just be making more incorrect attempts.

Only way I see this kind of working is if you’re cracking the passwords offline.

link
thom 2534 days ago
Yes, that’s one use case. Let’s say you have a database of actually properly hashed passwords. What passwords are you going to prioritise to try first? Every plaintext leak adds to the list of passwords you’d be sensible to try before brute forcing. Plus even for online attacks like password spraying, you’ve got to get an idea of common passwords from _somewhere_ and this leak inevitably adds to that. The only point I’m making is that humans are similar and therefore there’s always a chance they pick similar passwords. Therefore even if all LJ users have since changed their passwords, there are still many risks.
link