<story><title>GitHub mirror compromise incident report</title><url>https://wiki.gentoo.org/wiki/Github/2018-06-28</url></story><parent_chain><item><author>simias</author><text>I suppose it&amp;#x27;s only as good as the formula itself and at least it protects you from automated attacks. Still, I wouldn&amp;#x27;t advise anybody from going with formula-based passwords, just use whichever password manager you prefer and use unique strong passwords per-website.&lt;p&gt;Maybe one day the web will get its shit together and let us login everywhere with a certificate that we&amp;#x27;ll be able to securely store on a HSM and easily revoke and update if necessary but in the meantime it&amp;#x27;s the best we can do.</text></item><item><author>akerl_</author><text>Something to note here: &amp;quot;Evidence collected suggests a password scheme where disclosure on one site made it easy to guess passwords for unrelated webpages.&amp;quot;&lt;p&gt;For any folks out there who&amp;#x27;ve been using or promoting formula-based passwords, this is the potential impact: a leak on one site can be leveraged by an attacker towards other sites you use.</text></item></parent_chain><comment><author>akerl_</author><text>Most of the day-to-day issues with certificate auth aren&amp;#x27;t actually problems with &amp;quot;the web&amp;quot;, so much as they&amp;#x27;re broader user workflow or endpoint support issues. Here&amp;#x27;s a couple:&lt;p&gt;* How does a user log in from a new device?&lt;p&gt;* Especially if they&amp;#x27;ve lost &amp;#x2F; broken their original device?&lt;p&gt;* What happens if users want to log in from a shared computer (think public library)?&lt;p&gt;* Do all the OSes&amp;#x2F;browsers that users are using actually support certificate management and auth?</text></comment>
<story><title>GitHub mirror compromise incident report</title><url>https://wiki.gentoo.org/wiki/Github/2018-06-28</url></story><parent_chain><item><author>simias</author><text>I suppose it&amp;#x27;s only as good as the formula itself and at least it protects you from automated attacks. Still, I wouldn&amp;#x27;t advise anybody from going with formula-based passwords, just use whichever password manager you prefer and use unique strong passwords per-website.&lt;p&gt;Maybe one day the web will get its shit together and let us login everywhere with a certificate that we&amp;#x27;ll be able to securely store on a HSM and easily revoke and update if necessary but in the meantime it&amp;#x27;s the best we can do.</text></item><item><author>akerl_</author><text>Something to note here: &amp;quot;Evidence collected suggests a password scheme where disclosure on one site made it easy to guess passwords for unrelated webpages.&amp;quot;&lt;p&gt;For any folks out there who&amp;#x27;ve been using or promoting formula-based passwords, this is the potential impact: a leak on one site can be leveraged by an attacker towards other sites you use.</text></item></parent_chain><comment><author>berkes</author><text>I&amp;#x27;d like to add &amp;quot;truly random&amp;quot; to&lt;p&gt;&amp;gt; use unique strong passwords per-website.&lt;p&gt;... use unique, truly random passwords per-website.&lt;p&gt;&amp;quot;Strong&amp;quot; is ambigous and hard to explain how to do right. Random means, in practice: &amp;quot;don&amp;#x27;t come up with one yourself, but let a tool generate one for you&amp;quot;.</text></comment>