incorrect horse battery staple
September 2, 2019 3:51 AM   Subscribe

The forum for webcomic XKCD has suffered a data breach that leaked the usernames, emails, IP addresses and passwords for 562k subscribers. The top password was, predictably, "password". Number two? "correct horse battery staple"
posted by adrianhon (63 comments total) 37 users marked this as a favorite
 
xloxq.noihh.yiava.qwzjk.sbzkd or gtfo.
posted by flabdablet at 4:45 AM on September 2, 2019 [2 favorites]


passwords stored in MD5 phpBB3 format

So much fail.
posted by flabdablet at 4:53 AM on September 2, 2019 [6 favorites]


phpBB is a tragic liability for many online communities. It was trivial to set up on unprivileged hosting back in the tail end of the 20th century, and had a number of "mods" that would give you custom functionality that you might find essential to your community. It hasn't aged well.

For starters, the "mods" originally were not modules so much as modifications. Rather than dump a plugin file in an appropriate directory and go off to the races, you'd find documents with headers saying things like "DIFFICULTY: medium TIME: 3 hours". Why? Well, because they were plain-English narrations of edits you'd make by hand in the source code, with a text editor. They didn't even provide diffs.

And if you'd already applied one "mod", you might need to fix the code to make it even compatible with another, and you can be sure the instructions for later "mods" would be decreasingly relevant as you kept modifying the sources. And good luck upgrading to a new upstream version, ever!

But this also meant that you had a serious amount of inertia for your online community. You couldn't just up sticks and move to new software without chucking out all of your accounts and posts and all the little comforts and essentials and frivolities that you made use of. So it takes something dire like this event to finally push the chicks out of the nest.

Of course, disclosure was handled responsibly, according to Troy Hunt. They're good people running that show, and I expect they'll do some real searching and try to work out how to provide a more maintainable community platform in the future.
posted by rum-soaked space hobo at 5:05 AM on September 2, 2019 [23 favorites]


Given the intersection of xfcd fans and the people responsible for our new algorithmic future, this is depressing — even if the bad password use was somehow ironic. Such predictable uniformity.
posted by scruss at 5:14 AM on September 2, 2019 [7 favorites]


One of the great paradoxes of security is that any specifically stated example of a "strong password" is, automatically, a very weak password. It was stated in a public space where other people may have seen it; it has to be considered compromised. Regardless of how secure the process which generated "correct horse battery staple" was, that specific password is one of the most famous and therefore weak passwords.

In general it is a bad idea to ever provide specific examples of strong passwords. Because someone will just copy and paste what you suggested.
posted by qntm at 5:48 AM on September 2, 2019 [11 favorites]


So were those really the most frequent passwords or was that just a Twatter joke?
posted by Gilgamesh's Chauffeur at 5:53 AM on September 2, 2019 [4 favorites]


It is reasonable to expect that people who have a limited memory for passphrases would not reserve precious resources on an unimportant account. Indeed, I have been known to use horrible passwords on phpBB sites in the past simply because I did not trust the rest of the infrastructure. While I wouldn't have been so transparent as this, it's reasonable for someone to think "Eh, this is just a throwaway account so i can make one comment, and then I'll just stop using it." In that situation, it's not terribly strange to choose something that memorable.

But this also takes us right back into the silly debates of misunderstanding that surrounded the original "correct horse battery staple" cartoon. Randall was, quite clearly, advocating a mnemonic passphrase system as having a better entropy-to-memorability ratio than 8-character syllable transformations on individual words. Various people vigorously attacked the comic, thinking it was advocating that everyone use that exact passphrase. It's difficult to imagine, but many blog posts spilled out about this.

At the time it was too subtle a point to many people. These were folks who had grown up swapping between "password123" and "password456" each month when their login systems required them to change it. So a comic ends with "You have already memorised this password!" and I guess they thought this was the new lazy default they were meant to flip to. It was almost impossible to break past the layers of mistaken assumptions, as anyone who has been in an "airplane taking off from a conveyor belt" conversation can appreciate.
posted by rum-soaked space hobo at 6:05 AM on September 2, 2019 [23 favorites]


So were those really the most frequent passwords or was that just a Twatter joke?

I think: joke
posted by thelonius at 6:10 AM on September 2, 2019




incorrect airplane belt takeoff
posted by flabdablet at 6:13 AM on September 2, 2019 [11 favorites]


Ok, I'll confess: I fully understood that the comic wasn't proposing C.H.B.S. as the universal password, but merely using it as an example — and I still have contemplated using it as a password, just as a private joke with myself, just because I thought it would be amusing. I haven't done it. But I've thought about it.

SMART HUMANS ARE NOT REALLY ALL THAT SMART, is what we're dealing with here.
posted by nebulawindphone at 6:22 AM on September 2, 2019 [22 favorites]


Apparently it actually was in the DB?

Who knows? That could be simply a person who thought the first Tweet was serious. Or maybe a bunch of the self-satisfied denizens of that board thought they were being very clever by using the passcatchphrase; that certainly seems possible, too.
posted by thelonius at 6:23 AM on September 2, 2019


Like, I bet there's someone out there who's convinced themself that they're using password as their password ironically. That's the sort of shit that we as a species are into.
posted by nebulawindphone at 6:23 AM on September 2, 2019 [33 favorites]


That could be simply a person who thought the first Tweet was serious.

Ah, I missed that that it has a screenshot from the have I been owned site. They must have actually checked. Never mind!
posted by thelonius at 6:27 AM on September 2, 2019 [1 favorite]


It is reasonable to expect that people who have a limited memory for passphrases would not reserve precious resources on an unimportant account

And in 2019, it is unreasonable for any human being to be relying on their own memory for per-account passphrases.

For the last fifteen years, all that any person has really needed to remember is one strong password and maybe a few login passwords.
posted by flabdablet at 6:38 AM on September 2, 2019 [10 favorites]


As long as you use a different password elsewhere, does it matter if you use a “weak” one where it wouldn’t actually matter? Since getting an XKCD forum account hacked would presumably be fairly unlikely and irrelevant, as long as you have a better password elsewhere (not guaranteed, I know), why worry?
posted by Slinga at 6:42 AM on September 2, 2019 [18 favorites]


And if you don't use a password manager, consider this for places you seldom go to - such as a web store you just order from once or year or so. Use something long and random and immediately forget it.

Next time you need that same store, use the password reset procedure.
posted by DreamerFi at 6:58 AM on September 2, 2019 [15 favorites]


In general it is a bad idea to ever provide specific examples of strong passwords. Because someone will just copy and paste what you suggested.

If we're at the point where even providing a concrete example of what a hypothetical strong password might be is beyond the pale, then we really need to ditch the whole system. It's increasingly obvious that human brains are not equipped to conceive, remember, and reproduce strings of gibberish that not only have to be changed every 3-9 months but also can't have been uttered or written by any human at any point and can't even be recorded and kept in a physical location for fear that they would be compromised.

It seems like the only ideas that anyone seems to have about maintaining the current password system is either to continually add complexity (i.e. the thing that is currently keeping most people from using the system as intended) or to centralize into 1-3 master passwords (which would need to adhere even more strongly to the complexity, constant level of change, never being written down, etc. constraints that also keep people from using the system as intended, but with even greater consequences if something happens). If that's truly the only way forward with passwords, hopefully someone is working on something else, because I don't see either as a solution, and we'll just have further decades of constant data breaches and then people running in to yell at the victims for coming up with coping mechanisms to manage the 2-3 dozen passwords most people need to be managing at any given time.
posted by Copronymus at 7:12 AM on September 2, 2019 [18 favorites]


Can we be certain there will never be a data breach of a password manager?

My method is to come up with a unique password for every thing, which I write down on an index card (along with other relevant info for the site) and keep in a box (more than one at this point).

Admitted, this fails if the house burns down. And I'm not a laptop road warrior who needs to get into various accounts from anywhere at any time.

But the first question bothers me a lot, and I doubt I could be persuaded that any password manager will be 100% reliable.
posted by rochrobbb at 7:12 AM on September 2, 2019 [4 favorites]


Maybe someone hit Randall with a wrench? Somebody should probably check.
posted by inflatablekiwi at 7:14 AM on September 2, 2019 [2 favorites]


I also have a bunch of bb-type logins with the same insecure password since I fundamentally do not care if anyone steals those credentials and it minimizes the number of times I have to get a "real" credential out of storage. Metafilter, strangely, has one of the most secure passphrases in my memory.

I avoid having all my passwords in a single manager (a single point of catastrophic failure) since many banks and other financial institutions use, at best, weak 2FA via sms. My personal email credentials would be a virtually apocalyptic loss already given the huge amount of password recovery that uses them. I'm pretty nervous about the mugger who's smart enough to check my phone login before running away. Google Chrome makes pretty clear that passwords saved in your account are unprotected if your account is breached or you leave physical access open somewhere (like a stolen phone / pin), so it's become useful primarily as a replacement for those pointless accounts. I just bought some yubikeys; hoping that finally makes my password life simpler.
posted by a robot made out of meat at 7:28 AM on September 2, 2019


Can we be certain there will never be a data breach of a password manager?

Not in the way that other things get breached. My Keepass information is stored on my machine*, not The Cloud.

If you were really so inclined, you could break into my home, my network, or my phone and get a copy of it. If you could then figure out the long gibberish password, you'd see all of my passwords. But there's no way to mass-automate that, and no way to access the data without the password that's only stored in my head.

* And my other machine, and my network backup device, and on a thumb drive in my safe deposit box, and on my phone, and...
posted by Hatashran at 7:31 AM on September 2, 2019 [7 favorites]


I guess I’m going to carry on using passwords that are pairing names from fandoms I no longer participate in? Anyone who took the time to figure them out would have to crawl down some very deep Internet holes, and tbh if they do they might deserve my passwords.
posted by nonasuch at 7:35 AM on September 2, 2019 [4 favorites]


I was today years old when I found out there even was an XKCD forum on the site. I’ve been reading that comic for years and had no idea. There’s no link to it on the site, is there?
posted by Huffy Puffy at 7:38 AM on September 2, 2019 [12 favorites]


There’s no link to it on the site, is there?

It’s linked off the About page. It’s currently offline.
posted by inflatablekiwi at 7:49 AM on September 2, 2019


1-3 master passwords (which would need to adhere even more strongly to the complexity, constant level of change, never being written down, etc. constraints that also keep people from using the system as intended, but with even greater consequences if something happens).

Just complexity is enough. Also, writing down your master password and putting that copy somewhere physically secure, where only those named in your will can get access to it, is polite to those people.

An easy way to achieve sufficient complexity is simple concatenation of two or three of the passwords that are already in your head right now. And because you'll be using the same long master password every time you open your password manager, it will commit itself to muscle memory fairly quickly.

Can we be certain there will never be a data breach of a password manager?

There have been, which is why it's important to pick one that's built properly. KeePass is as good as they get. So is Password Safe. Notably, both of these hold your passwords in a strongly encrypted file that you decide where to store, rather than in some central server that you need to trust is properly managed.

If you want to sync that encrypted file as a whole across multiple devices you can do that completely safely via something like Dropbox or iCloud or OneDrive or even email, but you do need to keep track of where the authoritative version is; merging individual credentials from one copy of a password database file into another is inconvenient by design. My authoritative version lives in my Dropbox account, and I keep a copy in USB storage attached to my car keys that's always at least up to date enough to have my current Dropbox credentials in it.

Attacks against password management software are feasible, but they require a level of access to your computing equipment which, if an adversary has it, are a lot quicker and easier to exploit by more direct means. On balance, password management software works so much better than human memory that relying on the former instead of the latter should be a no-brainer.

Password management software can't stop people being people though. Despite its obvious advantages and the objectively verifiable step-up in security it's capable of providing, most people will avoid using it because it's a New Thing and therefore Too Much Trouble, and will come up with endless plausible-sounding rationalizations to defend that decision.

I certainly did, for years. I also know that since I did give myself the kick up the arse required in order to get serious about putting every credential I ever use for anything into a KeePass database, I can always log in quickly and easily even to services I haven't touched for five years, I can do that without locking myself into a particular web browser or compute platform, and I never worry at all about my long, unique, machine-generated passwords being cracked after a service database breach.

One thing I really ought to get around to doing, though, is setting up a dummy email account that I only ever use for pointing password recovery mechanisms at. Because as things stand at present, an ability to read my emails in transit is a far more likely potential single point of security failure for all my password-protected accounts than any breach of my KeePass databases might be.
posted by flabdablet at 7:55 AM on September 2, 2019 [14 favorites]


I recently started using a PW manager. It has made life so much easier. Now, as I use sites using my old very shitty passwords I create a new one. I finally got off my ass when my credit union started offering online banking that didn't suck and I got a credit card. Sigh, if only I were young too.
posted by kathrynm at 7:59 AM on September 2, 2019 [3 favorites]


I’m going to be humiliated if/when Metafilter is hacked and my musty 2007 joke of a password is made public knowledge
posted by roger ackroyd at 8:02 AM on September 2, 2019 [10 favorites]


I have no idea what my MeFi password is, and that's the way I like it.
posted by flabdablet at 8:05 AM on September 2, 2019 [11 favorites]


So I went and looked it up, and it's one of these.

The real beauty of password management software is that there is no UI penalty for using ridiculously long passwords everywhere. It's just as easy for me to get KeePass to auto-type acndi.wtiku.epzol.xqzhi.jabdr into a web form as hunter2, which means there is simply no motivation to use a shitty password for anything anywhere ever.
posted by flabdablet at 8:11 AM on September 2, 2019 [1 favorite]


Because dislexia, my passwords contain spelling errors.
posted by thegirlwiththehat at 8:21 AM on September 2, 2019 [2 favorites]


spelling errors may not add very much entropy, however.
posted by rum-soaked space hobo at 8:30 AM on September 2, 2019


i finally decided to spend spoons on implementing a password manager a couple of months ago, when i bought a new laptop, and my god it is wonderful. integrating with faceID and touchID, syncing across all of my devices / browsers. gah. if anyone else has been on the fence for a while and just not mustering up the energy, let me be one more little bit of wind to push you in that direction. it really is wonderful.
posted by lazaruslong at 8:33 AM on September 2, 2019 [2 favorites]


Someone actually did create a CorrectHorseBatteryStaple password generator that is quite nice and I use it all the time. 80% of my passwords don't really need to be memorable/type-able as they live in LastPass and do their thing there, but I still have to do a lot of work on systems that are not neatly web-enabled or app-enabled and I have to type, and it is much easier to look up and type Paint>Establish-Kitten5 than 0234jdsflkasdfe9e.
posted by Lyn Never at 8:43 AM on September 2, 2019 [2 favorites]


I use a password manager religiously, *except* when I'm creating a throwaway account on a low-stakes site. There's no utility in creating a strong password for an xkcd account- why should I care if someone hacks it?
posted by simra at 8:43 AM on September 2, 2019 [2 favorites]


I recently got a spam / blackmail / extortion attempt email that would have been pretty amusing overall, if it didn't correctly assert "We know you've been using [alias] with [password]." It was a username/password I'd used all over the place for low-risk forum type accounts, not for anything important. I guess a phpBB hack is the most likely source of the data used to create that.

I'm always surprised, in these discussions, that more people aren't using the password managers built in to web browsers. I don't know how they'd score on a security audit, but those seem like the most obvious, lowest-friction option for this job to me.
posted by Western Infidels at 8:56 AM on September 2, 2019 [3 favorites]


For me, I wouldn't know how to use the one in my browser in a thorough, complete, deliberate way.

And its behavior leads me not to trust it much. Sometimes it offers to remember a password. Sometimes it doesn't. Sometimes it correctly fills in a password it's remembered. Sometimes it doesn't. Sometimes it remembers shit without having asked permission first. Sometimes it doesn't seem to have remembered shit I swear I told it to remember.

Their goal when they designed it was clearly "Second-guess the user as much as possible, and try to do useful things without their input." Which is neat for a feature that's occasionally convenient, but I wouldn't want to rely on it to store passwords I had deliberately created to be unmemorizable and hadn't written down elsewhere.
posted by nebulawindphone at 9:01 AM on September 2, 2019 [3 favorites]


Friendly reminder for us developer types: when we build systems that require sign-in, we shouldn't roll our own. It won't be very secure and users don't like coming up with new ids and passwords.

Instead, we should integrate with the systems where our users already have accounts, like Facebook, Google, Twitter, etc. It's easy to integrate with multiple identity providers if one uses libraries from Firebase or Auth0.
posted by Triplanetary at 9:02 AM on September 2, 2019 [1 favorite]


Um yeah I'm gonna have to push back on that a bit - I absolutely do NOT want to be pushed towards linking my Facebook, Google, or Twitter accounts in order to sign up somewhere. For one, I deleted FB years ago because Fuck Zuck. Also, I'd love to be able to get rid of Google and Twitter accounts but for varying professional reasons I cannot. I sure as hell don't want to continue passively allowing Google or Twitter to accrete accounts and importance in my online life.

There are many users for whom that convenience is welcome. There are also many for whom that option is highly distasteful. I'm happy to come up with a new ID and password, especially now that my password manager will do it for me and remember it for me.
posted by lazaruslong at 9:06 AM on September 2, 2019 [40 favorites]


Everyone using Facebook/Google/Twitter for sign-in is some serious “too big to fail” shizz.

Except nothing is too big to fail.
posted by Matt Oneiros at 9:23 AM on September 2, 2019 [6 favorites]


Someone actually did create a CorrectHorseBatteryStaple password generator that is quite nice and I use it all the time.

My eero router automatically generates passwords like this for guest access. The only hard part is explaining to your guests why your wifi password is AmmoniaChickenVillages153.
posted by dephlogisticated at 9:35 AM on September 2, 2019 [3 favorites]


Yup, there are different degrees of secure, and using 00000000 for a hardware device that only you can access*, or bond007 for an ephemeral login not linked to your real identity, or donald for your self-insert fanfic that no-one else wants to see, or ji32k7au4a83 on a machine you're pretty sure was pwned to begin with, isn't the worst idea in the world. Hold your horses before you correct them; I'm sure they have a battery of stronger passwords for staples like email and banking. I would hope that no-one on the XKCD forum would think that that specific example of a strong password really was, although I wouldn't be surprised if the general public were to take it more literally.

* Protected by armed guards, naturally
posted by Wrinkled Stumpskin at 9:41 AM on September 2, 2019 [6 favorites]


My wife and I talked about password security last night, and the only thing we could agree on is “it’s not the greatest idea to use 69 or 420 in a password.”
posted by infinitewindow at 10:06 AM on September 2, 2019 [5 favorites]


My password manager suggested an amazing password for my Amazon account, and it makes me so sad I can't share it. Someday I'll change it and let the world know how amusing my password was.
posted by The corpse in the library at 10:06 AM on September 2, 2019 [5 favorites]


Instead, we should integrate with the systems where our users already have accounts, like Facebook, Google, Twitter, etc.

AS WELL. Not instead. Please. And if you could avoid making it mandatory to use an email address for a user ID that would be swell too.
posted by flabdablet at 10:10 AM on September 2, 2019 [10 favorites]


And if you could just make your login page accept username TAB password ENTER without fartarsing about with intermediate pages like Google has apparently convinced every other site it's OK to do, that would be swell as well.

I'm old enough to remember when deliberately not telling people whether it was their username or their password that they'd got wrong was considered best practice, but apparently designers who have thought about this for fewer years don't believe that's so any more.

Also, including the name of your site in the login page's title instead of just titling it something generic like Sign In is much friendlier to those of use who prefer password managers that are not inextricably entangled with our web browsers.
posted by flabdablet at 10:19 AM on September 2, 2019 [5 favorites]


Ah, I missed that that it has a screenshot from the have I been owned site. They must have actually checked. Never mind!

I'm not sure this means it was actually used on this site vs. some site that was compromised.
posted by atoxyl at 10:24 AM on September 2, 2019


I’m going to push back on the idea that there’s any such thing as a “low-stakes” account where it’s ok to not use a strong, unique password. The problem is that those low-stakes accounts tend not to remain low-stakes...

As an example: when I plug my personal email address into Have I been Pwned, I see hacks or leaks from Roll20, MyFitnessPal, bitly, and tumblr. At the time I signed up for these, I regarded all these sites as throw-away accounts. (And I admit to using weak and shared passwords for some of them!)

But... I turned out to keep using MyFitnessPal, and it contains detailed information about my diet and habits. I subscribed to Roll20 to run a game, so they could have my credit card info. And I turned out to build really meaningful relationships on tumblr, which was frankly a huge surprise. Did I remember to change my passwords when I discovered these were useful websites? Of course not!

If I used a shared password on these sites (which I did at the time for at least two), hacking one compromises the others. Even if I don’t care about the bitly account, turns out I care about Roll20 now! And there are absolutely bots out there that will start using leaked credentials to try to log in everywhere.

They’re all real passwords... or they have the potential to be. There’s nowhere it’s ok to use that password you’ve had since third grade. It sucks, but this is the world now.
posted by a device for making your enemy change his mind at 10:31 AM on September 2, 2019 [16 favorites]


It was the roll20 hack which finally got me to use a password manager, and yeah, can confirm it is so much better.
My password manager even generates correct-horse-battery-staple style passwords if you so choose.

I also get a lot of I know your password style spam emails which I used to use to know when to retire my low security password. Now I suspect they'd be funnier.
posted by Just this guy, y'know at 10:40 AM on September 2, 2019


Hold your horses before you correct them; I'm sure they have a battery of stronger passwords for staples like email and banking.

Nice one!
posted by ambrosen at 10:48 AM on September 2, 2019 [6 favorites]


There’s nowhere it’s ok to use that password you’ve had since third grade

Eh. I have "real" unique passwords for my bank, paypal, and my email addresses. Everywhere else I just use whatever, because there is no cost to me if they get hacked. Who cares about my metafilter password? Even if that password also gets you into my deviantart account and my apartmenttherapy account. Nobody wants those, because there's no money and I'm not famous, so can't DO anything with them. And I use paypal to pay for everything, so nowhere else gets my credit card details.

If I used myfitnesspal I would definitely use a real password for that because personal info, but I don't.
posted by stillnocturnal at 11:07 AM on September 2, 2019 [3 favorites]


I too have a progressive-complexity practice. I use a dictionary word for crapsites and regwalls that I want to get past. If I'm starting to use more features than I started with (SoundCloud) I'll change my password to something weirder.

Also, phpBB, vBulletin, and the other PHP webboard apps are a scourge of the web. Fuckin' Tapatalk should be wiped off the face.
posted by rhizome at 11:26 AM on September 2, 2019


This reminds me that I changed my work password right before I left on a 10 day vacation. Let's see if I remember what it is when I return to work tomorrow!
posted by vespabelle at 11:29 AM on September 2, 2019 [4 favorites]


Nobody wants those, because there's no money and I'm not famous, so can't DO anything with them.

They can't currently do anything with them that you know of or can think of. And "famous" doesn't mean "recognizable celebrity" today, it just means "has someone motivated to attack me specifically", which is a lot lower bar. And is also something that is only currently true, that you know of.
posted by Homeboy Trouble at 12:09 PM on September 2, 2019 [4 favorites]


Ugh. There are a lot of old, empty, unused accounts on my password list. Too bad there is no way to completely erase them--if those site are hacked I'll just have to hope that the info is useless. Is it worth it to go back and change passwords on websites for accounts that I closed out 10 years ago?
posted by TreeRooster at 2:07 PM on September 2, 2019 [1 favorite]


const char * getRandomPassword()
{
return "correct-horse-battery-staple"; // chosen by fair Monroe.
// guaranteed to be Randall.
}

posted by I'm always feeling, Blue at 2:43 PM on September 2, 2019 [5 favorites]


What business do most sites have storing passwords anyway? If I’m not cookied, send a one time login link to my email address. Then it’s hopefully just one email password to remember and if that gets compromised you’re in no worse shape than you otherwise would be because nearly any site will send a password reset link to your email on request anyway.
posted by mikesch at 11:27 PM on September 2, 2019 [2 favorites]


Regarding passphrases, I should remind people that "natural" phrases (in any language) have a much lower entropy than four arbitrary words that do not combine in common parlance.

It's actually rather interesting to look at how Shannon calculated the entropy of English. He actually ran experiments on members of the public to guess subsequent words and take a statistical sampling.

So if your passphrase is something that would become memorised in a predictive text keyboard, it's almost certainly a bad one.
posted by rum-soaked space hobo at 1:57 AM on September 3, 2019 [3 favorites]


My metafilter password is the simple password I use for all low-stake accounts (well, for all the accounts that don't require complicated passwords anyway). Never occurred to me that anyone would bother to hack such a system.

So, if you ever see a comment posted from my account that is especially stupid and/or contains spelling and grammar errors, please assume there's been a Mefi data breach.
posted by she's not there at 10:00 AM on September 3, 2019 [7 favorites]


SMART HUMANS ARE NOT REALLY ALL THAT SMART, is what we're dealing with here.

I guess we need to patch that comic, so that it randomly assigns passwords per pageload. And generates associated comical imagery. A small ask, really.
posted by pwnguin at 7:07 PM on September 4, 2019 [2 favorites]


They can't currently do anything with them that you know of or can think of. And "famous" doesn't mean "recognizable celebrity" today, it just means "has someone motivated to attack me specifically", which is a lot lower bar. And is also something that is only currently true, that you know of.

Sure. A sufficiently motivated asshole who hates me personally could get my password, and then use it to... make me look like an asshole or something on mefi until I notice and reset the password. Or maybe find out what kind of shampoo I buy. Worst case scenario, they link all my accounts together and find out my real name + various shopping habits and that I like batman and have a cat. It's an acceptable risk to me as long as there's no money involved, frankly (and no, none of that information is used in important security questions, which I make up and note answers to).

Although after a long hard think, I guess an actual stalker who paid for my email and password from somewhere (I assume that's a thing?) could then maybe get my actual irl shpping address from one of the commercial sites, if they tried them all. Hmmmm. That one could actually be a concern so I guess I should wall that off too, good point.
posted by stillnocturnal at 6:34 AM on September 5, 2019


Instead, we should integrate with the systems where our users already have accounts, like Facebook, Google, Twitter, etc. It's easy to integrate with multiple identity providers if one uses libraries from Firebase or Auth0.

If a site offers me a log in only through a Facebook, Google, or Twitter account, I will never log into that site. I have a password manager, and use random usernames in most contexts so that my accounts can't be linked. Explicitly linking them to my social media profiles is the last thing I want to do.

Google is a special case because, while I have a google account from long ago, I refuse to use it for anything, including Google services. This was after they forcibly converted youtube accounts into generic google accounts, and I did not want my email account to also be my youtube account to also be my mapping history, etc.
posted by vibratory manner of working at 11:37 AM on September 6, 2019 [2 favorites]


If a site offers me a log in only through a Facebook, Google, or Twitter account, I will never log into that site.

I used to feel the same way for the same reason. But there are a few sites I've really wanted to use that do behave this way, and for those I've created dedicated Google accounts purely for logging into them with. It's a pain in the arse because they need to be used in a private browsing window to stop the logins getting all crossed up, and Google's username-page-then-password-page login sequence is just bad, but judicious use of KeePass's entry cloning facility makes it not too much of a nuisance to set up and those sites' logins do remain disconnected from my original Google account.
posted by flabdablet at 12:22 PM on September 7, 2019


« Older Why the Periodic Table of Elements Is More...   |   You can automate a lot of things. Sewing isn't one... Newer »


This thread has been archived and is closed to new comments