IWETHEY v. 0.3.0 | TODO
1,095 registered users | 0 active users | 0 LpH | Statistics
Login | Create New User
IWETHEY Banner

Welcome to IWETHEY!

New Not quite
1. Never get involved in a land war in Asia.
2. Never confuse "secure" with "securable"--that is, "potentially secure".

The main point is that a user-enterable password hint and response are more secure than choosing from a list of questions, with a corresponding pre-chosen list of answers.


That should be:

The main point is that a user-enterable password hint and response are more securable than choosing from a list of questions, with a corresponding pre-chosen list of answers.


The difference is that most users will still choose easily-guessable questions and answers. You and I may not, but we're exceptional people. ;)
New And my point is...
The difference is that most users will still choose easily-guessable questions and answers. You and I may not, but we're exceptional people. ;)
I really don't give a rat's ass if anyone else chooses "What color is the sky?" with a response of "blue" to that question. If you let them choose the question and provide the answer, and they do something as downright stupid as that, why should I give a flying fuck? Why should Scott give a flying fuck, either?

I know plenty of people, both friends and cow-orkers, who choose things like their child's name for their password. I'd be willing to bet that at least some people here are guilty of same. Hell, even I have been known to reuse passwords from one website to the next. Every person is responsible for their own account's security under this method. That's the point.
-YendorMike

"They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."
- Benjamin Franklin, 1759 Historical Review of Pennsylvania
New I have a standard formula I use for passwords.
  1. Expendable accounts that are nice to have but nothing to important that I can't replace if compromised.
  2. Expendable accounts that are very important to me, but not irreplacable
  3. Important stuff that would be a troublesome to replicate or recover>/li>
  4. Critical stuff that, I will not be able to recover or replace or is so important to me that losing it would be very very bad.
Of course there are combinations of those levels.

I still like my idea. I very much prefer it. Even compared to /. and the mechanism used.
--
[link|mailto:greg@gregfolkert.net|greg],
[link|http://www.iwethey.org/ed_curry|REMEMBER ED CURRY!] @ iwethey
No matter how much Microsoft supporters whine about how Linux and other operating systems have just as many bugs as their operating systems do, the bottom line is that the serious, gut-wrenching problems happen on Windows, not on Linux, not on Mac OS. -- [link|http://www.eweek.com/article2/0,1759,1622086,00.asp|source]
Here is an example: [link|http://www.greymagic.com/security/advisories/gm001-ie/|Executing arbitrary commands without Active Scripting or ActiveX when using Windows]
New I also have a standard formula
I assume that the web is open for all to review so have reused thae same password combo for years as I dont give too much of a rats if one gets compromised. I dont use ebay or other ecommerce sites. I do bank on the web so have a completely separate line for that. Knowing my generic work/web login would give no clues to my financials.
regards,
daemon
that way too many Iraqis conceived of free society as little more than a mosh pit with grenades. ANDISHEH NOURAEE
clearwater highschool marching band [link|http://www.chstornadoband.org/|http://www.chstornadoband.org/]
New Ding, Ding, Ding.
If you fingered out my expendable passwords... you are completely in the wrong secotr of the galaxy to try to relate to my "secure" passwords.

So it sounds like you are the same kind.
--
[link|mailto:greg@gregfolkert.net|greg],
[link|http://www.iwethey.org/ed_curry|REMEMBER ED CURRY!] @ iwethey
No matter how much Microsoft supporters whine about how Linux and other operating systems have just as many bugs as their operating systems do, the bottom line is that the serious, gut-wrenching problems happen on Windows, not on Linux, not on Mac OS. -- [link|http://www.eweek.com/article2/0,1759,1622086,00.asp|source]
Here is an example: [link|http://www.greymagic.com/security/advisories/gm001-ie/|Executing arbitrary commands without Active Scripting or ActiveX when using Windows]
     zIWT meta: Which is better: - (admin) - (66)
         3) -NT - (mmoffitt)
         1) - (jb4) - (3)
             Not for long, at least... -NT - (admin) - (2)
                 Is that a threat?!? -NT - (jb4) - (1)
                     You should know by now... - (admin)
         3, with verification - (Arkadiy) - (29)
             Seconded. -NT - (Yendor)
             NO - (FuManChu) - (27)
                 Er, buh? - (admin) - (3)
                     That's enough of a detriment not to warrant the risk IMO -NT - (FuManChu) - (2)
                         ? -NT - (admin) - (1)
                             ?? -NT - (drewk)
                 Yeah - (Yendor) - (11)
                     How is that insecure? - (FuManChu) - (2)
                         You're unclear on this. - (admin) - (1)
                             See below. -NT - (FuManChu)
                     You only need one field labeled "Hint" - (tuberculosis) - (7)
                         Sure... - (Yendor) - (6)
                             Bah. - (admin)
                             Not quite - (FuManChu) - (4)
                                 And my point is... - (Yendor) - (3)
                                     I have a standard formula I use for passwords. - (folkert) - (2)
                                         I also have a standard formula - (daemon) - (1)
                                             Ding, Ding, Ding. - (folkert)
                 It's only insecure if the user is allowed to proceed - (imric) - (10)
                     Bah. Risk is the issue. - (FuManChu) - (9)
                         So what's YOUR suggestion? -NT - (admin) - (4)
                             Unfortunately for you #1 ;) - (FuManChu) - (3)
                                 WTF? - (admin) - (2)
                                     Sorry. You're right. I didn't read carefully. - (FuManChu) - (1)
                                         So how does that change your answer? - (admin)
                         Same risk than we have now during login. - (imric) - (2)
                             Same outcome, different risk--the attack surface has doubled -NT - (FuManChu)
                             Not mine. - (CRConrad)
                         Can we please weight the risks - (Arkadiy)
         3) with some safeguards? - (Another Scott)
         4) WikiWay: everything wide open ... muuuaaaahahahahahaha -NT - (drewk) - (1)
             Shaddap wid' yer shaddin' ap... -NT - (admin)
         3 with a "what is your dog's name?" thingie -NT - (Silverlock)
         I'll join Ark, Scott(2), Don(Silverback), and YendorMike: 3+ - (CRConrad) - (2)
             <raises hand> on that last bit. :-) -NT - (Another Scott)
             Aye - 3) with - (imric)
         Another few options: - (admin) - (9)
             I'd rather not vote on solutions until we discuss risks - (FuManChu) - (8)
                 Re: I'd rather not vote on solutions until we discuss risks - (admin) - (7)
                     Okay, start with costs of current proposals - (FuManChu) - (3)
                         Missed the point. :-) - (admin) - (2)
                             Understood, but you're use case #1 - (FuManChu) - (1)
                                 I can do private keys... - (folkert)
                     What do you want the software to do? - (Another Scott) - (2)
                         Nope, wrong - (drewk) - (1)
                             Yes, a *good* challenge question would be needed. - (Another Scott)
         how about 4, the way we do it now - (daemon) - (3)
             Which is? - (Another Scott)
             And what would that be? - (admin) - (1)
                 the way it works now - (daemon)
         How about 5... - (jb4)
         16) Storing them encrypted with a "reset my password" featur - (folkert)
         A variation on 2) - (altmann)
         3), with a question 1st. -NT - (broomberg)
         3 with a proviso - (ChrisR) - (1)
             I like that! -NT - (Arkadiy)
         3. Puts the onus of keeping valid email address on user. -NT - (a6l6e6x)
         3 -NT - (pwhysall)
         6. - (static)
         "zIWT meta: Which is better:" Voting/Ratification (new thread) - (folkert)

Sanctioned by GRR.
87 ms