Nearly got scammed on here!!

[daveybass]

36 minutes ago, ambient said:

There are several websites you can use to calculate the fees the seller will incur. I’ll just pay whatever the extra is to ensure the seller gets what they wanted while protecting myself.

I think it’s around 3.5% so not a lot for peace of mind 

[leschirons]

So, not being a techie, if I change my BC password and let my phone generate a new one, will that automatically save that to the Google password thing and also appear on my desktop PC?

Or do I have to physically put it in the PC?

[Reggaebass]

45 minutes ago, leschirons said:

So, not being a techie, if I change my BC password and let my phone generate a new one, will that automatically save that to the Google password thing and also appear on my desktop PC?

Or do I have to physically put it in the PC?

I changed mine yesterday on my phone and had to log in separately on my iPad, so I don’t think it will carry across 

[PaulWarning]

55 minutes ago, leschirons said:

So, not being a techie, if I change my BC password and let my phone generate a new one, will that automatically save that to the Google password thing and also appear on my desktop PC?

Or do I have to physically put it in the PC?

 if you're using Google Chrome to generate a new password yes, if you've got sync turned on, well mine does

[NancyJohnson]

I've just had a clean out and update of passwords.  I tend to use Firefox and Thunderbird for web/email, lots of samey passwords and on checking, lots of passwords for dormant sites.  I've just used the Google random password generator to fast track changes and will work out how to synch everything later.

 

I'm a mod on a Facebook musician site and we took group membership private on that about a year ago following several nefarious attacks and p*rn-related posts.  It's only got 2,000 members (fnarr), but sometimes it was a royal PITA to keep spam down.

[tauzero]

16 hours ago, pluckedout said:

All conceivable 10 character passwords can still be brute forced by a basic desktop computer in less than a day.

 

Really? On the basis of taking a second for each try, using 10-character passwords composed of any upper-case, any lower-case, any number, and any of the non-alphanumeric characters on a computer keyboard (I used 30 for the number), it would take 12,066,345,950,656,448 hours to do all combinations. That's a bloody long day.

[Woodinblack]

11 hours ago, ambient said:

There are several websites you can use to calculate the fees the seller will incur. I’ll just pay whatever the extra is to ensure the seller gets what they wanted while protecting myself.

 

The most accurate one of which is Paypal.

[tauzero]

3 hours ago, leschirons said:

So, not being a techie, if I change my BC password and let my phone generate a new one, will that automatically save that to the Google password thing and also appear on my desktop PC?

Or do I have to physically put it in the PC?

 

If you're logged in to a Google account on both phone and PC, and using the same browser, and you've got the sync settings, er, set (in the Settings menu), it should synchronise.

[Reggaebass]

I use facial recognition where possible and quicker than long passwords 

[Woodinblack]

1 minute ago, Reggaebass said:

I use facial recognition where possible and quicker than long passwords 

 

I do too. I am pretty sure noone is going to want to steal my face!

[Mickeyboro]

2 minutes ago, Reggaebass said:

I use facial recognition where possible and quicker than long passwords 

Alexa, who is the fairest of them all?😁

[JoeEvans]

7 minutes ago, tauzero said:

 

Really? On the basis of taking a second for each try, using 10-character passwords composed of any upper-case, any lower-case, any number, and any of the non-alphanumeric characters on a computer keyboard (I used 30 for the number), it would take 12,066,345,950,656,448 hours to do all combinations. That's a bloody long day.

Yes - my understanding is that there's a big difference between the theoretical time taken for a particular computer to work through all the combinations of a certain number of characters, and the actual time taken to submit each combination one after another when attempting to get into an online service.

[Reggaebass]

1 minute ago, Mickeyboro said:

Alexa, who is the fairest of them all?😁

It says I am , but it probably tells them all that 😁

[tauzero]

1 minute ago, JoeEvans said:

Yes - my understanding is that there's a big difference between the theoretical time taken for a particular computer to work through all the combinations of a certain number of characters, and the actual time taken to submit each combination one after another when attempting to get into an online service.

 

When the interval between attempts is automatically increased each time you get it wrong, or where the username is locked out after a number of failed attempts, it becomes an even larger difference between generating the list and cracking the login.

[asingardenof]

3 minutes ago, tauzero said:

 

Really? On the basis of taking a second for each try, using 10-character passwords composed of any upper-case, any lower-case, any number, and any of the non-alphanumeric characters on a computer keyboard (I used 30 for the number), it would take 12,066,345,950,656,448 hours to do all combinations. That's a bloody long day.

Assuming 56 alphabetic characters (all upper and lowercase letters), 10 numeric, and let's say 30 special as you suggest, that's 96 possible options per character entry. Assuming 10 characters, that gives us 96P10 or 4.093x10^19 possible combinations. Attempting them @ 1s would take something in the region of 12.8 trillion years. I'm guessing that computers might be able to do it slightly faster than this though...

[jrixn1]

14 minutes ago, tauzero said:

 

On the basis of taking a second for each try,

https://en.wikipedia.org/wiki/Password_cracking
"the number of possible passwords per second which can be checked can be in the billions or trillions per second"
 

[tauzero]

1 minute ago, asingardenof said:

Assuming 56 alphabetic characters (all upper and lowercase letters), 10 numeric, and let's say 30 special as you suggest, that's 96 possible options per character entry. Assuming 10 characters, that gives us 96P10 or 4.093x10^19 possible combinations. Attempting them @ 1s would take something in the region of 12.8 trillion years. I'm guessing that computers might be able to do it slightly faster than this though...

 

There are 28 letters in the alphabet? Dammit, I've only been using 26 all my life.

 

I was giving a second a go on the basis of a computer doing it and that being the time between sending and response. It would take quite a bit longer if somebody was typing them in.

[asingardenof]

Just now, tauzero said:

 

There are 28 letters in the alphabet? Dammit, I've only been using 26 all my life.

 

I was giving a second a go on the basis of a computer doing it and that being the time between sending and response. It would take quite a bit longer if somebody was typing them in.

Dammit, I need more coffee. OK say 92 possible options means 8.3 trillion years. 

[tauzero]

3 minutes ago, jrixn1 said:

https://en.wikipedia.org/wiki/Password_cracking
"the number of possible passwords per second which can be checked can be in the billions or trillions per second"
 

 

Out of context quote.

 

"If a hash of the target password is available to the attacker, this number can be in the billions or trillions per second, since an offline attack is possible. If not, the rate depends on whether the authentication software limits how often a password can be tried, either by time delays, CAPTCHAs, or forced lockouts after some number of failed attempts. Another situation where quick guessing is possible is when the password is used to form a cryptographic key. In such cases, an attacker can quickly check to see if a guessed password successfully decodes encrypted data."

 

If you're trying to access an account from outside, by logging in, you'll never do it.

[cheddatom]

When I was a kid we got a hash of the school's network admin password and cracked it in just over 3 days with a computer running constantly at home. That would have been 1999 ish

[Woodinblack]

16 minutes ago, asingardenof said:

Assuming 56 alphabetic characters (all upper and lowercase letters), 10 numeric, and let's say 30 special as you suggest, that's 96 possible options per character entry. Assuming 10 characters, that gives us 96P10 or 4.093x10^19 possible combinations. Attempting them @ 1s would take something in the region of 12.8 trillion years. I'm guessing that computers might be able to do it slightly faster than this though...

 

There are at least 250 different options even if you are confining yourself to an 8 bit character set. If you aren't, then there are 1000s of different characters. I haven't had problems using non latin characters anywhere for a long time.

[jrixn1]

14 minutes ago, tauzero said:

If you're trying to access an account from outside, by logging in, you'll never do it.

 

I agree.  I thought people were talking about recovering passwords from data i.e. when the hashed password file has been leaked.
If you don't have that file, then like you say, you can't brute force directly on the live site as it would take billions of years - and the site locks you out after three attempts anyway.
Perhaps a less worse method would be the other way round: pick a common password and then try it in combination with known usernames.
 

[nilorius]

I don't and i won't !

[lidl e]

What was the scammer "selling"?

 

Anything good?

[MartinB]

So just to speak in general terms, and not implying anything about Basschat's security:
When you sign up to a new site/service, you don't know whether it's got sensible security precautions to guard against password guessing (e.g. lockout/timeout after a small number of failed attempts).
And you also don't know whether your password will be stored securely, i.e. not likely to be leaked and also not easily cracked if it does leak (by being properly encrypted etc.)

So as a general rule of thumb, why not do everything you can to protect yourself?
- Use a strong password; long and complex is best, but otherwise long and simple generally beats short and complex (see table below)
- Use a unique password, so in the event of compromise you'll only have a problem with one site
- Use multi-factor authentication, if available

Illustrative guide to how it long it takes to crack a leaked password:

Terms and conditions apply; your mileage may vary; source: https://www.hivesystems.io/blog/are-your-passwords-in-the-green