Talk:1200: Authorization - Revision history

92.23.2.228 at 18:52, 14 July 2025

2025-07-14T18:52:34Z

194.39.218.16: my take on what passwords are worth

2025-07-14T09:45:23Z

my take on what passwords are worth

XkcdIsGood at 16:47, 20 March 2022

2022-03-20T16:47:07Z

162.158.63.46: added comment

2018-08-07T13:44:13Z

added comment

Arifsaha at 17:06, 6 May 2013

2013-05-06T17:06:32Z

213.84.74.36 at 13:13, 19 April 2013

2013-04-19T13:13:39Z

Hkmaly at 22:48, 17 April 2013

2013-04-17T22:48:09Z

67.51.59.66 at 17:11, 17 April 2013

2013-04-17T17:11:45Z

76.106.251.87 at 15:10, 17 April 2013

2013-04-17T15:10:25Z

76.106.251.87 at 15:09, 17 April 2013

2013-04-17T15:09:45Z

← Older revision		Revision as of 18:52, 14 July 2025
Line 19:		Line 19:
	Depending on the attack vector, admin passwords are of little use, useless or outright dangerous nowadays. Remote attacks from the public internet have become rare so probably not relevant (NAT, firewalls & no public services by default). If your device is stolen, you need to protect your data, not your admin account, and this is only possible with full disk encryption (FDE) and a good passphrase. Stolen devices are rarely returned to spy on you so keyloggers are probably not so relevant (unless you are a journalist in a country that doesn't like you).		Depending on the attack vector, admin passwords are of little use, useless or outright dangerous nowadays. Remote attacks from the public internet have become rare so probably not relevant (NAT, firewalls & no public services by default). If your device is stolen, you need to protect your data, not your admin account, and this is only possible with full disk encryption (FDE) and a good passphrase. Stolen devices are rarely returned to spy on you so keyloggers are probably not so relevant (unless you are a journalist in a country that doesn't like you).
	Probably more relevant are crossing borders into surveillance states (like the US ;p): if you are asked to unlock your device(s), neither FDE, nor 2FA, nor admin passwords help, only an empty harddisk (and an encrypted online backup you can restore after having arrived where you want to go).		Probably more relevant are crossing borders into surveillance states (like the US ;p): if you are asked to unlock your device(s), neither FDE, nor 2FA, nor admin passwords help, only an empty harddisk (and an encrypted online backup you can restore after having arrived where you want to go).
		+	{{unsigned ip\|194.39.218.16\|09:45, 14 July 2025}}

← Older revision		Revision as of 09:45, 14 July 2025
Line 15:		Line 15:
	Not agree with Randall on this one. Laptop stealing is very physical, there are way to keep people from physically able to use our active login session, such as make sure the laptop is physically secured when possible, make sure the screen locked out when we are away (we can automate that using bluetooth detection), etc. Root password protect another kind of attack, generally more clandestine one, such as trojan and rootkit installations, which can be more dangerous as we may not be aware it is there. [[User:Arifsaha\|Arifsaha]] ([[User talk:Arifsaha\|talk]]) 17:06, 6 May 2013 (UTC)		Not agree with Randall on this one. Laptop stealing is very physical, there are way to keep people from physically able to use our active login session, such as make sure the laptop is physically secured when possible, make sure the screen locked out when we are away (we can automate that using bluetooth detection), etc. Root password protect another kind of attack, generally more clandestine one, such as trojan and rootkit installations, which can be more dangerous as we may not be aware it is there. [[User:Arifsaha\|Arifsaha]] ([[User talk:Arifsaha\|talk]]) 17:06, 6 May 2013 (UTC)

		+	Not going to agree. I use lastpass for passwords, have every (important) site protected with 2fac, and firefox wipe all my userdata everytime I close it, so even if a keylogger is installed, or they have physical access to my device, they can't get to my personal information. So that covers Facebook, Gmail, Paypal, and the Bank. Everything else is encrypted

−	~~Not going to agree. I~~ use ~~lastpass for passwords~~, have ~~every~~ (~~important~~) ~~site protected~~ with ~~2fac,~~ and ~~firefox wipe all my userdata everytime I close it,~~ so ~~even~~ if ~~a keylogger is installed, or they have physical access~~ to my device, ~~they can't get to my personal information. So that covers Facebook~~, ~~Gmail~~, ~~Paypal~~, and ~~the Bank~~. ~~Everything else is encrypted~~	+	Depending on the attack vector, admin passwords are of little use, useless or outright dangerous nowadays. Remote attacks from the public internet have become rare so probably not relevant (NAT, firewalls & no public services by default). If your device is stolen, you need to protect your data, not your admin account, and this is only possible with full disk encryption (FDE) and a good passphrase. Stolen devices are rarely returned to spy on you so keyloggers are probably not so relevant (unless you are a journalist in a country that doesn't like you).
		+	Probably more relevant are crossing borders into surveillance states (like the US ;p): if you are asked to unlock your device(s), neither FDE, nor 2FA, nor admin passwords help, only an empty harddisk (and an encrypted online backup you can restore after having arrived where you want to go).

← Older revision		Revision as of 16:47, 20 March 2022
Line 1:		Line 1:
		+	I find it funny at first because I thought Randall hates his brother, so he set it to switch to his brothers to let other people hack randall's BROTHER's account instead of his. [[User:XkcdIsGood\|XkcdIsGood]] ([[User talk:XkcdIsGood\|talk]]) 16:47, 20 March 2022 (UTC)
		+
	This is the reason that I set sudo to not prompt for a password. I just make sure my computer locks itself aggressively. [[Special:Contributions/130.18.105.246\|130.18.105.246]] 06:59, 17 April 2013 (UTC)		This is the reason that I set sudo to not prompt for a password. I just make sure my computer locks itself aggressively. [[Special:Contributions/130.18.105.246\|130.18.105.246]] 06:59, 17 April 2013 (UTC)

← Older revision		Revision as of 13:44, 7 August 2018
Line 12:		Line 12:

	Not agree with Randall on this one. Laptop stealing is very physical, there are way to keep people from physically able to use our active login session, such as make sure the laptop is physically secured when possible, make sure the screen locked out when we are away (we can automate that using bluetooth detection), etc. Root password protect another kind of attack, generally more clandestine one, such as trojan and rootkit installations, which can be more dangerous as we may not be aware it is there. [[User:Arifsaha\|Arifsaha]] ([[User talk:Arifsaha\|talk]]) 17:06, 6 May 2013 (UTC)		Not agree with Randall on this one. Laptop stealing is very physical, there are way to keep people from physically able to use our active login session, such as make sure the laptop is physically secured when possible, make sure the screen locked out when we are away (we can automate that using bluetooth detection), etc. Root password protect another kind of attack, generally more clandestine one, such as trojan and rootkit installations, which can be more dangerous as we may not be aware it is there. [[User:Arifsaha\|Arifsaha]] ([[User talk:Arifsaha\|talk]]) 17:06, 6 May 2013 (UTC)
		+
		+
		+	Not going to agree. I use lastpass for passwords, have every (important) site protected with 2fac, and firefox wipe all my userdata everytime I close it, so even if a keylogger is installed, or they have physical access to my device, they can't get to my personal information. So that covers Facebook, Gmail, Paypal, and the Bank. Everything else is encrypted

← Older revision		Revision as of 17:06, 6 May 2013
Line 10:		Line 10:

	Actually, for many years popular operating systems such as MS Windows did not have separate security for system administration, which made it very popular for the propagation of viruses and other malware. And once it was introduced, it wasn't enforced for many years. Only relatively recently this is happening, and still viruses, trojan horses and botnets thrive, because it is slightly inconvenient for the user to act safe(r). [[Special:Contributions/213.84.74.36\|213.84.74.36]] 13:13, 19 April 2013 (UTC)		Actually, for many years popular operating systems such as MS Windows did not have separate security for system administration, which made it very popular for the propagation of viruses and other malware. And once it was introduced, it wasn't enforced for many years. Only relatively recently this is happening, and still viruses, trojan horses and botnets thrive, because it is slightly inconvenient for the user to act safe(r). [[Special:Contributions/213.84.74.36\|213.84.74.36]] 13:13, 19 April 2013 (UTC)
		+
		+	Not agree with Randall on this one. Laptop stealing is very physical, there are way to keep people from physically able to use our active login session, such as make sure the laptop is physically secured when possible, make sure the screen locked out when we are away (we can automate that using bluetooth detection), etc. Root password protect another kind of attack, generally more clandestine one, such as trojan and rootkit installations, which can be more dangerous as we may not be aware it is there. [[User:Arifsaha\|Arifsaha]] ([[User talk:Arifsaha\|talk]]) 17:06, 6 May 2013 (UTC)

← Older revision		Revision as of 13:13, 19 April 2013
Line 8:		Line 8:
	::Except usernames tend to be reasonably easy to figure. E-mails certainly are what with folks tending to broadcast their e-mail addresses to everyone. So passwords, although also often not overly difficult to crack (http://xkcd.com/936/), remain the part not generally known. Not worrying about a keylogger picking up a password, even "out of context" would be a mistake. [[Special:Contributions/67.51.59.66\|67.51.59.66]] 17:11, 17 April 2013 (UTC)		::Except usernames tend to be reasonably easy to figure. E-mails certainly are what with folks tending to broadcast their e-mail addresses to everyone. So passwords, although also often not overly difficult to crack (http://xkcd.com/936/), remain the part not generally known. Not worrying about a keylogger picking up a password, even "out of context" would be a mistake. [[Special:Contributions/67.51.59.66\|67.51.59.66]] 17:11, 17 April 2013 (UTC)
	:::Also, modern keyloggers (despite still being called keyloggers) also capture screen and mouse movement. They are perfectly able to record a password entered by clicking on keyboard on screen and many other ideas tried to complicate keylogging. -- [[User:Hkmaly\|Hkmaly]] ([[User talk:Hkmaly\|talk]]) 22:48, 17 April 2013 (UTC)		:::Also, modern keyloggers (despite still being called keyloggers) also capture screen and mouse movement. They are perfectly able to record a password entered by clicking on keyboard on screen and many other ideas tried to complicate keylogging. -- [[User:Hkmaly\|Hkmaly]] ([[User talk:Hkmaly\|talk]]) 22:48, 17 April 2013 (UTC)
		+
		+	Actually, for many years popular operating systems such as MS Windows did not have separate security for system administration, which made it very popular for the propagation of viruses and other malware. And once it was introduced, it wasn't enforced for many years. Only relatively recently this is happening, and still viruses, trojan horses and botnets thrive, because it is slightly inconvenient for the user to act safe(r). [[Special:Contributions/213.84.74.36\|213.84.74.36]] 13:13, 19 April 2013 (UTC)

← Older revision		Revision as of 22:48, 17 April 2013
Line 7:		Line 7:
	:I wonder how useful a keylogger would be if you never typed a username or e-mail to go with the password. Every important account I have has that remembered, and I just type the password. It sounds like it would be zero context. [[Special:Contributions/76.106.251.87\|76.106.251.87]] 15:09, 17 April 2013 (UTC)		:I wonder how useful a keylogger would be if you never typed a username or e-mail to go with the password. Every important account I have has that remembered, and I just type the password. It sounds like it would be zero context. [[Special:Contributions/76.106.251.87\|76.106.251.87]] 15:09, 17 April 2013 (UTC)
	::Except usernames tend to be reasonably easy to figure. E-mails certainly are what with folks tending to broadcast their e-mail addresses to everyone. So passwords, although also often not overly difficult to crack (http://xkcd.com/936/), remain the part not generally known. Not worrying about a keylogger picking up a password, even "out of context" would be a mistake. [[Special:Contributions/67.51.59.66\|67.51.59.66]] 17:11, 17 April 2013 (UTC)		::Except usernames tend to be reasonably easy to figure. E-mails certainly are what with folks tending to broadcast their e-mail addresses to everyone. So passwords, although also often not overly difficult to crack (http://xkcd.com/936/), remain the part not generally known. Not worrying about a keylogger picking up a password, even "out of context" would be a mistake. [[Special:Contributions/67.51.59.66\|67.51.59.66]] 17:11, 17 April 2013 (UTC)
		+	:::Also, modern keyloggers (despite still being called keyloggers) also capture screen and mouse movement. They are perfectly able to record a password entered by clicking on keyboard on screen and many other ideas tried to complicate keylogging. -- [[User:Hkmaly\|Hkmaly]] ([[User talk:Hkmaly\|talk]]) 22:48, 17 April 2013 (UTC)

← Older revision		Revision as of 17:11, 17 April 2013
Line 6:		Line 6:
	::My bank account website logs me out if I'm inactive for 10 minutes. It doesn't even leave the page up, it switches to a login screen. [[Special:Contributions/24.77.229.71\|24.77.229.71]] 14:35, 17 April 2013 (UTC)		::My bank account website logs me out if I'm inactive for 10 minutes. It doesn't even leave the page up, it switches to a login screen. [[Special:Contributions/24.77.229.71\|24.77.229.71]] 14:35, 17 April 2013 (UTC)
	:I wonder how useful a keylogger would be if you never typed a username or e-mail to go with the password. Every important account I have has that remembered, and I just type the password. It sounds like it would be zero context. [[Special:Contributions/76.106.251.87\|76.106.251.87]] 15:09, 17 April 2013 (UTC)		:I wonder how useful a keylogger would be if you never typed a username or e-mail to go with the password. Every important account I have has that remembered, and I just type the password. It sounds like it would be zero context. [[Special:Contributions/76.106.251.87\|76.106.251.87]] 15:09, 17 April 2013 (UTC)
		+	::Except usernames tend to be reasonably easy to figure. E-mails certainly are what with folks tending to broadcast their e-mail addresses to everyone. So passwords, although also often not overly difficult to crack (http://xkcd.com/936/), remain the part not generally known. Not worrying about a keylogger picking up a password, even "out of context" would be a mistake. [[Special:Contributions/67.51.59.66\|67.51.59.66]] 17:11, 17 April 2013 (UTC)

@@ Line 5: / Line 5: @@
 :Even if you can log into your bank account, you could not transfer money without authorizing transactions. [[User:BKA|BKA]] ([[User talk:BKA|talk]]) 11:23, 17 April 2013 (UTC)
 ::My bank account website logs me out if I'm inactive for 10 minutes. It doesn't even leave the page up, it switches to a login screen. [[Special:Contributions/24.77.229.71|24.77.229.71]] 14:35, 17 April 2013 (UTC)
-:I wonder how useful a keylogger would be if you never typed a username or e-mail to go with the password.  Everything important account I have has that remembered, and I just type the password.  It sounds like it would be zero context. [[Special:Contributions/76.106.251.87|76.106.251.87]] 15:09, 17 April 2013 (UTC)
+:I wonder how useful a keylogger would be if you never typed a username or e-mail to go with the password.  Every important account I have has that remembered, and I just type the password.  It sounds like it would be zero context. [[Special:Contributions/76.106.251.87|76.106.251.87]] 15:09, 17 April 2013 (UTC)

← Older revision		Revision as of 15:09, 17 April 2013
Line 5:		Line 5:
	:Even if you can log into your bank account, you could not transfer money without authorizing transactions. [[User:BKA\|BKA]] ([[User talk:BKA\|talk]]) 11:23, 17 April 2013 (UTC)		:Even if you can log into your bank account, you could not transfer money without authorizing transactions. [[User:BKA\|BKA]] ([[User talk:BKA\|talk]]) 11:23, 17 April 2013 (UTC)
	::My bank account website logs me out if I'm inactive for 10 minutes. It doesn't even leave the page up, it switches to a login screen. [[Special:Contributions/24.77.229.71\|24.77.229.71]] 14:35, 17 April 2013 (UTC)		::My bank account website logs me out if I'm inactive for 10 minutes. It doesn't even leave the page up, it switches to a login screen. [[Special:Contributions/24.77.229.71\|24.77.229.71]] 14:35, 17 April 2013 (UTC)
		+	:I wonder how useful a keylogger would be if you never typed a username or e-mail to go with the password. Everything important account I have has that remembered, and I just type the password. It sounds like it would be zero context. [[Special:Contributions/76.106.251.87\|76.106.251.87]] 15:09, 17 April 2013 (UTC)