Slashdot Mirror
The Best Way To Protect Real Passwords: Create Fake Ones
jfruh writes: Many security-savvy users have a password manager that stores their randomly-generated passwords — but if that manager is cracked, the gig is up. Some security researchers are suggesting a technique to stop this: a password manager that offers up fake passwords when an attacker tries and fails to crack it, which makes the process of figuring out if you've broken in much more difficult.
No, this will solve the problem once and for all.
We need a password managers manager!
We need a password managers manager!
... It's password managers all the way down.
My passwords are on a post-it note stuck to my monitor.
Let's see them crack THAT!
Any insufficiently advanced magic is indistinguishable from technology.
I've always heard that SSH keys are better than passwords. So I use them even with websites that don't use SSH.
Here's what I do:
1) I generate a new keypair using ssh-keygen.
2) I put the public key in my GitHub repo, because the public key is meant to be shared.
3) I use the private key as the password when I sign up for a new account on a web site. I copy and paste it into the password input since it's too big for me to type in.
4) When I have to log in to the web site I copy and paste the private key into the password input since it's too big for me to type in.
5) I live my life knowing that I'm using the most secure password possible: an unbreakable SSH key.
Yeah, ask TV5 how that works...
Oh, the fools! If only they'd built it with 2 layers of password spoofing! When will they learn!?!?
"When information is power, privacy is freedom" - Jah-Wren Ryel
Me too. But I've instructed my secretary to generate a fake set of post-it notes if someone comes into the office pretending to be me.
I have fake passwords on a post-it note stuck to my monitor.
My REAL passwords are on a post-it note stuck to the bottom of my keyboard.
You fools with your single layer of misdirection, thinking it will keep you safe!