Hundred bucks says this is a run-of-the-mill password database compromise. We see this all the time.
The best advice I can offer anyone on account security is don't reuse your damn passwords ;-)
Even my throw-away passwords are all unique to the account they belong to. There are patterns to them but you'd have to know me personally very well to even see the pattern, let alone guess how I construct new passwords. Not perfection by any means but it gets the job done.
If your memory is not so hot, or if you want the extra layer of paranoia, use a password management tool and go nuts with the really hideously long passwords. Otherwise, use the passphrase-and-symbol trick (five dictionary words separated by punctuation is much stronger than ten random alphanumeric characters).
But above all: if you use the same password or a trivial variant thereof in more than one place, assume that eventually both accounts WILL be stolen. People suck at securing password databases.
Someone tried to steal my gmail account?
weird, i literally got an email from gmail about suspicious activity yesterday, i changed my password, but it said it was from china.
I've had notification about suspicious activity from China on several occasions, no matter how often I change my password.
a little while back i created this cipher program to generate ciphered text from a couple clear text sources plus some mutation values. Its not cryptographicaly secure, but then that is not its purpose. It just allows you to keep some clear-text reminders somewhere then bring them together to generate your password for whatever. I don't use it yet as i still want to add a "user seed key" that is separate so that even if someone used your clear text, they still couldnt get your passwords cause they lacked your user seed key. I also want to add the ability to restrict specific special characters from the output, just havent gotten a round-tuit yet.
Anyway, its the best i've come up with that obviates memorization.
a little while back i created this cipher program to generate ciphered text from a couple clear text sources plus some mutation values. Its not cryptographicaly secure, but then that is not its purpose. It just allows you to keep some clear-text reminders somewhere then bring them together to generate your password for whatever. I don't use it yet as i still want to add a "user seed key" that is separate so that even if someone used your clear text, they still couldnt get your passwords cause they lacked your user seed key. I also want to add the ability to restrict specific special characters from the output, just havent gotten a round-tuit yet.
Anyway, its the best i've come up with that obviates memorization.
You may be interested in password derivation, which allows you to cryptographically derive a pseudorandom password of any length from any number of tokens you find convenient to remember (or are just implied) such as the website in question, your username on that site, or any other metadata, really. I believe recent password managers support this out of the box, but it's not too difficult to implement yourself, all you need is a secure HMAC function.
personally i'm going to start using rip-off's technique, simply to remember, and unique to every website, the only diffrence is i'll probably do something like: gamedev_password, rather than creating a prefix for the site.
[quote name='Bacterius' timestamp='1357671343' post='5019137']
You may be interested in password derivation, which allows you to cryptographically derive a pseudorandom password of any length from any number of tokens you find convenient to remember (or are just implied) such as the website in question, your username on that site, or any other metadata, really. I believe recent password managers support this out of the box, but it's not too difficult to implement yourself, all you need is a secure HMAC function.
[/quote]
I may have to look into that. I based mine off some simple concepts used in encryption but via character ops instead of bit ops. It produces some very good passwords as it stands, so i didn't feel the need to increase its encryption level further, but i'm going to have to look more into HMAC :)
This topic is closed to new replies.
Advertisement
Popular Topics
Advertisement
