I don't want to alarm anyone but so does this site. If your not using unique passwords for every site you use then you really should consider doing it. Tools such as 1Password make it ridiculously easy, there really is no excuse.
:) Yeah, not the end of the world... but many, many people use the same password (or one with slight variation) on many sites. Sure, they "shouldn't", but, still...
Another way is to hash a "salt" password with the domain (or something site specific). So if my salt was "assword" and I put the last 4 characters from the domain name interspersed at the end of my password it would look like this: asswaotrodr. Giving you a unique and complicated password for every site.
"Salting" it in that way doesn't increase your security by much? If they looked at your password, once they obtained it, how long would it take them to figure out what you were doing, and thereby be able to derive all your other passwords?
True, if someone were able to get your username and password for a site they may be able to figure out your hashing scheme. But what if someone compromises an entire database? They would use a bot to go out and see what they can access with the given usernames and passwords as is.
The suggested password strategy helps to protect against the later case.
Comments
I don't want to alarm anyone but so does this site. If your not using unique passwords for every site you use then you really should consider doing it. Tools such as 1Password make it ridiculously easy, there really is no excuse.
Yeah. There's a Firesheep handler for news.yc too:
https://github.com/codebutler/firesheep/wiki/Handlers
This website should really be migrated to https.
Heaven forbid someone in a coffee shop posts something on your HN account…
:) Yeah, not the end of the world... but many, many people use the same password (or one with slight variation) on many sites. Sure, they "shouldn't", but, still...
or editing your yc application.
It's not just that. Some countries inspect web traffic. Some of them disapprove of conversations on some topics.
Another way is to hash a "salt" password with the domain (or something site specific). So if my salt was "assword" and I put the last 4 characters from the domain name interspersed at the end of my password it would look like this: asswaotrodr. Giving you a unique and complicated password for every site.
"Salting" it in that way doesn't increase your security by much? If they looked at your password, once they obtained it, how long would it take them to figure out what you were doing, and thereby be able to derive all your other passwords?
True, if someone were able to get your username and password for a site they may be able to figure out your hashing scheme. But what if someone compromises an entire database? They would use a bot to go out and see what they can access with the given usernames and passwords as is.
The suggested password strategy helps to protect against the later case.