Ask Lemmy

Is everyone here paranoid?

https://xkcd.com/538/

IT guy here.

Nope, my phone uses facial recognition to unlock, and my computer passwords are wither random letters and numbers or a full passphrase, both of which use multiples of the same letter and different capitalizations.

Example:

Random string, similar to passwords I have used in the past:

"r82ZwQqDW"

Looking at a keyboard where you could see all characters used it would look like this:

dqrwz28 + shift

Figuring out the password above from these letter by logic is basically impossible, so they have to brute force it, only they don't know the length of the password, which uses more time.

Passphrases are even better, using something like:

CreepySmilingHorseSnortsLead2016!

Just look at all of the reused letters!

No way someone would guess that the characters acedghilmnoprsty0126 + shift would spell the password above.

No, I lick the entire keypad/keyboard after entering my pass/pin to ensure my DNA is on all keys. This is the only true path to security.

Nope. Don't you type on your keyboard anyway. Like right now I just worte a whole bunch of different letters. I don't think I put in my password so often it stands out. Same with the phone. My fingers already go all over it. I mean icons are way over one screens worth. Its not like the movied door code thing where the only input it ever gets is the code.

I’ve never heard of that being used to steal a password—for one thing, it wouldn’t reveal the order in which you pressed the keys, so it would still leave n! possibilities (24 possibilities for a 4-digit pin, or 40,320 for an 8-letter password). And in any case, if someone were to examine the keys afterward, it’s more likely they could see which keys you wiped if you just wiped the ones you used (and if you wiped all of them, it would make it easier to steal the password of the next user).

The bigger thing to worry about is a hidden camera recording your key presses—and to counter that, I position my fingers over all the keys I’ll use and then move all my fingers with each press, so it’s harder to see which key was key was actually pressed.

Yes you are being weird. Why do you think anyone will bother getting physical access to your device?

Maybe a question for therapy.

The numbers on my lock screen randomize their locations, so even if you saw my finger movements and grease pattern, you couldn't guess the code.

No. If you've used it to input literally anything else you've already obfuscated the password (typing on keyboard, using apps on phone). Besides that, there is no telling the length, number of repeated characters, or shift combined (capital letters, symbols) involved just by looking at finger prints on a keyboard.

Two factor authentication and other layered security is low effort and more effective. If you're worried about a PIN for debit cards the greater concern is skimmers, common at gas stations and atms. The best preventative here is to become familiar with checking for those and minimizing how much money is in your debit account - keep it in savings, use a credit card instead where able.

I do clean my phone screen and keyboards occasionally just because they can get gross.

I do that at the ATM and I also double-check for scanners on the bank card input.

My phone unlock is a cluster fuck so I'm not worried about anyone who tries it. Scarier is that there's ways to bypass it, so if it gets stolen I'm kinda fucked.

I saw a video once about how people could use thermal imaging to see what (metal) keys you pressed on an ATM, so usually I'll rest my entire hand on the keypad for a second when I'm done

When using a public PIN pad, I cover the whole thing with my other hand and make fake button presses in between the real ones.

My screen has a matte foil on it.
Hard enough to see any fingerprint.

No, but I sanitize my phone regularly.

I check for card skimmers, but the things I would type into have so many people touching them in a day. I wipe my keyboard down at work to cut down on communicable sickness.

If it's an outdoor pin pad the winter, such as a gas station, I'll touch all the keys so the thermal signature doesn't show which keys I pushed.

Not because of passwords, but I wipe down my phone screen once a day, keyboard around once a week.

I use my phone or something else I am holding to press the buttons so my fingers never actually come into contact with the surface; or use tap to pay which also bypasses the PIN entry on most POS systems. I also use my feet to open doors that are push to open. Thank COVID for this quirk; It has nothing to do with worrying about security lol

I am paranoid to think of such things occasionally, which is why I can tell you that my password is long enough that it includes more than half the alphabet.

Typing a password: keepass. I'm not typing my who knows how long passwords on my keyboard.

PIN Pad: I wipe it, and cover the pin pad too in case someone with good visual memory sees it.

ATM: metal pads don't blatantly show on thermal imaging, so just cover it with my hands. Also try to shake off the card reader/metal pads, they're built to resist that so if you manage to pop something off, congratulations you exposed a card skimmer.

Phone password: 32 character passcode, no Touch ID, good luck trying to get into it. If anyone can decipher it just by looking at the screen, at that point they deserve it.

If it's an outdoor pin pad the winter, such as a gas station, I'll touch all the keys so the thermal signature doesn't show which keys I pushed.