House of Eratosthenes

Alright, the password thing is really starting to get me steamed. Not at you fine, fair people who are suffering from the problem. At WordPress, I think…or my configuration of it. There is clearly something amiss.

I got a gut feel, from working with this issue at my various “real” jobs (software development, enterprise network security & network accreditation, and back to software development again) that in order to find out where the problem is we’re going to have to reveal passwords. That is a big no-no in my world and we are not going there. So I’ll just say, think on your password composition. If you really think the issue is there, I would encourage you to go for six letters in a mix of upper and lowercase, one Arabic numeral and one special character. Mix it up good, make it something you can remember, and that should do it.

Also, enable your browser to accept cookies if you want to be remembered on your computer.

If you think the problem is outside of those, then I want to hear from you. Are you logging into other WordPress sites and being spared from the frustration that somehow plagues you here? My account has always worked wonderfully, but I’m the admin…and with this much bitching from so many smart folks, there has to be something going on contributing to it. What do you see that’s broken?

Please keep the passwords under your hat. Except maybe for the old ones you don’t want to use anymore…and then, only if you think they matter, and they can’t be used as clues for the newer stuff. Password secrecy is a real hot-button issue in my world so please use your discretion.

Thoughts? Experiences? Sound off. We shall endeavor to fix.

I mentally group this issue into 3 categories which also fall into descending access amounts.

For sites like this, I use a generically simple password which — at worst — would expose my e-mail to the world if somebody guessed it. At that point, they could post “as jwb7605”, maybe with some nasty stuff or whatever. Hopefully, you’d delete my account, e-mail me, I could respond, and a fix could be implemented.
So for this site (and a couple others like it) I allow FireFox to remember the password.
You, as admin of this site could get my password — but ONLY if you jump through a hoop or two first. I haven’t seen any plugins to reveal user passwords on WordPress, and I’ve experienced the joys of moving an installation. The encryption key for WordPress contains some or all of the URL. The WP config file is another issue — we’ll have to trust you on that.

Sites that IMO are “slightly more sensitive” I use one of 6 easily remembered passwords that contain letters, numbers, and special characters. Those I make a note of in the “Properties” portion of the saved link, and I don’t allow FireFox to save the password. This level I reserve for “somewhat frequently accessed sites that contain information I’d rather have somebody ask me about firzt”.

On the “holy crap it could ruin my credit” category, I wrote a program that does nothing more than record a URL, a user name, a password and store it in a weakly encrypted manner on my local LAN mySQL database.
That system (executable) keeps track of my LAN users. It’s quite handy, since nobody visits those sites more than 3 or 4 times a year. By that time, nobody remembers the username or the password — or frequently, the exact URL.
Since I’ve assigned a static IP to any machine on my LAN (DHCP disabled), the program also “knows” which user is requesting what.
You could get any username/password combination on the LAN in plain English by using my machine. If I wake up dead some morning, things could be simpler for my survivors. If a thief comes in, he’ll need at least two machines (my PC and the home server) to make sense of the information. Anybody that ‘steals’ the mySQL table will have tons of fun decrypting the table columns just to figure out who did what.

I do not trust my cats, though. Still working on it …
- jwb7605 | 04/30/2010 @ 08:57
I’ll have to go all “Schultz” on you. I know nuh-think!

Seriously, I didn’t know there was a problem and I’m not experiencing any. And I do have other WordPress accounts out there for commenting on various blogs
- philmon | 04/30/2010 @ 13:53
What’s the reason for passwords when commenting on a blog post? Seems like an additional layer of chickenshit to me.
- Pixelkiller | 04/30/2010 @ 16:42
Dude…with all the Tea Party infiltrating going on, you have to ask?

Yeah it’s not like buying a Winnebago in someone else’s name, nuclear launch codes or something. But imagine what a pain in the ass it would be if a user name you were known to use on a certain board, recognized by your family & friends or maybe your co-workers, got hacked and someone uploaded a bunch of racist junk in there. I know it’s still a little lame but that doesn’t mean you can’t be put in a situation that would perhaps best be called…regrettable.
- mkfreeberg | 04/30/2010 @ 17:17
The only WordPress site I’ve ever had trouble logging into is my own, and this is due to me being a majorly-sloppy typist.
- CGHill | 04/30/2010 @ 17:50
I seem to have to get a new password every time I post here. I have wondered if it is because I have other Word Press accounts.

I have a standard password for these things, It leads to a free Email that does not have my real name anywhere or any financial information.
- Fai Mao | 05/01/2010 @ 06:03
I’m not having any problems.
- bpenni | 05/01/2010 @ 09:27
But imagine what a pain in the ass it would be if a user name you were known to use on a certain board, recognized by your family & friends or maybe your co-workers, got hacked and someone uploaded a bunch of racist junk in there.

That is precisely the problem they’re having over at moonbattery.com, except that it’s the liberal trolls on the board who are getting their names hijacked the most. One of them complained bitterly:

“Some fuckbox has hijacked my name and is typing shit to make me sound like a complete twat.”

Naturally someone pointed out, “You sounded like a twat BEFORE your name got hijacked.” In any case, instead of taking the hint and getting the hell off the site, they hang around and continue to post their crap, or simply post as “anonymous.” I have no idea why moonbattery’s moderators, noticing the severity of the problem, didn’t simply implement a password system as WordPress has. (Near as I can tell, moonbattery.com is a stand-alone site, not dependent on any underlying system to power itself.) Instead, the mods simply included a warning by the fields where you type in your name and what you want to say, “Warning! Name hijacking will be severely punished.” Yeah, I’m reaaaaaaal scared.

If the trolls would simply get lost, I doubt it would happening at all. What’s that word you like to use for these guys, Morgan? “Gadfly?”

On the other end of the spectrum from moonbattery.com, is my pet peeve: The “blogs” which require pre-registration, email verification, and the works….just so I can post a comment on some news article, on a site being run by some local newspaper, located in another part of the country and whose site I am unlikely to visit again. I suspect those sites simply want to collect email addresses, which are then sold to spammers.

WordPress has it just about right, I think.
- cylarz | 05/01/2010 @ 10:51
I’m in, no problem at all.
- Daphne | 05/01/2010 @ 15:08

Leave a Reply

You must be logged in to post a comment.

Recent

Items of Interest

Monthly Archives

What They Say

Links

PasswordsFriday, April 30th, 2010

Passwords
Friday, April 30th, 2010