Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop forcing arbitrary password rules

ryanwinchester.ca

Post reply on HN
Print view View original

31–40 of 196 posts

Re: Stop forcing arbitrary password rules

#31

Post by paulmd »

petercooper wrote: post #5
forgotpwtomain wrote: post #3

I agree with the point the author is making and generally am just as annoyed by arbitrary password rules; nevertheless: > chili dog monkey nutso Is definitely not 18 quintillion years at best it's approximately 250000^4 which is 2^72. A good (though still requiring some memorizing effort approach) would be something along the lines of https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi... which uses a standa…

it's approximately 250000^4 If the attacker knows you've used four dictionary words in a row. Now you need to multiply the number by the odds of that ..

And the entropy of the password 0b0 is only a single bit - if the attacker knows you've used a single-bit password. Hashed into the SHA-256 space that's only a 1:2^256 chance of someone colliding with it. Still, is that a password you'd set?

What does that have to do with the output of the password in terms of brute-force guessing? Aren't you kind of assuming that an opponent won't try a broad dictionary attack? Equal distribution of hash outputs fundamentally assumes equivalent distributions of hash inputs, and that's not true for the distributions of common passwords.

Again - everyone knows the passphrase patterns everyone uses, everyone knows the password transformations everyone follows (eg l33t) and overall those patterns are significantly weak against attack because of this public knowledge. By those algorithm, with knowledge of salts/etc those passwords are very weak.

Should you use a song, or a slight modification, or a l33t transformation? Certainly not - if the input space isn't uniformly distributed across the input space, the probability of hitting pay dirt definitely isn't uniformly distributed across the output space.

Even the class of "valid transformations of sensical English sentences" is not an equal distribution because of the above. If you can compress a language you can attack it, because by the assumption of compression the data is not at its minimum entropy. Maybe not feasibly if you're lucky - but don't bet on it just because Webster's is big.

Re: Stop forcing arbitrary password rules

#32

Post by aruggirello »

nsmalch wrote: post #8
forgotpwtomain wrote: post #3

I agree with the point the author is making and generally am just as annoyed by arbitrary password rules; nevertheless: > chili dog monkey nutso Is definitely not 18 quintillion years at best it's approximately 250000^4 which is 2^72. A good (though still requiring some memorizing effort approach) would be something along the lines of https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi... which uses a standa…

XKCD's diceware argument fails under certain conditions. Computationally very hard to crack, but when plucked from actual phrases that have been uttered; weak. So to give an example, any natural language phrase like: "I took a walk in a park" is easier to crack. I am certain there is somebody coding an infinite-monkey-type bruter to crack diceware as we speak: https://en.wikipedia.org/wiki/Infinite_monkey_theorem

Diceware proper is not 'plucked from actual phrases that have been uttered'. It's a random sequence obtained by throwing a dice a number of times (hence the name). This means you can't lookup your e-book collection for an exact phrase to use (eg. a famous quote).

Moreover, diceware can be set up with any dictionary, and nobody stops you from computing your own dictionary. If you do that, good luck to the bruter attempting to break your passphrase!

BTW there is no limit on the number of terms in your diceware passphrase, so if/when brute force makes 5-term phrases too weak, users may just add one or two more terms.

Re: Stop forcing arbitrary password rules

#34

Post by codedokode »

What we really need is to stop using passwords.

Passwords are awful UX design solution. The users have to think of and remember some meaningless phrase to get the service they really needed. If you use easy password, your account can be hacked. If you use difficult password, you won't remember it in a week.

For some people remembering a password or login might be especially difficult.

You can use software to generate and remember passwords but all of them will be lost if you reformat your drive. Some of password managers are proprietary, non cross-platform and some would upload your passwords to the so called cloud so NSA can look at them too.

In any case your passwords can be easily compromised when your PC is infected or you use somebody's else device.

What we need is to get rid of this obsolete system. We need hardware authorisation key (that could look like a real key) that can be used for both registration and logging in and would generate and securely store private keys for all used services. Such device should use strong crypto, should not allow exporting private keys, update firmware or operate without user confirmation.

I think such kind of keys will appear sooner or later, they are superior to passwords and password managers and easy to use but I am not sure that they will be open source, cross platform, and backdoor-free unless we do something in advance.

Re: Stop forcing arbitrary password rules

#35

Post by mrob »

forgotpwtomain wrote: post #3

I agree with the point the author is making and generally am just as annoyed by arbitrary password rules; nevertheless: > chili dog monkey nutso Is definitely not 18 quintillion years at best it's approximately 250000^4 which is 2^72. A good (though still requiring some memorizing effort approach) would be something along the lines of https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi... which uses a standa…

It's less than that because the words were clearly not picked randomly. "Chili dog" is an English phrase, and "monkey nutso" is a transformation of "monkey nut", also an English phrase.

Re: Stop forcing arbitrary password rules

#36

Post by aruggirello »

emsy wrote: post #15

Second worst password rule: preventing to paste in the password field. As seen at The OS X FileVault dialog, PayPal, Blizzard and many more....

Third worst password rule: preventing the browser from prompting user to save the password for your site. I found this to usually happen with home banking sites (as a workaround, I usually have to disable and re-enable javascript).

Re: Stop forcing arbitrary password rules

#37

Post by CHY872 »

codedokode wrote: post #34

What we really need is to stop using passwords. Passwords are awful UX design solution. The users have to think of and remember some meaningless phrase to get the service they really needed. If you use easy password, your account can be hacked. If you use difficult password, you won't remember it in a week. For some people remembering a password or login might be especially difficult. You can use software to generate…

No. They are not superior to passwords - they merely provide different tradeoffs. For example, the site that requires your hypothetical key-type key would require that either all of their customers have spent money on such a key (bad) or that they are willing to pay for keys for all of their customers.

This is something that has been thought about in detail - see https://vtllf.org/blog/ssh-web-sign-in/quest-to-replace-pass... for Stajano's analysis.

Re: Stop forcing arbitrary password rules

#38

Post by kristopolous »

jpdus wrote: post #27

Totally agree. At least 1 Uppercase means 99% of people just use an uppercase first character for their standard password. 1 number means they append 1,2 or a year and 1 special character means they append an exclamation mark. Entropy added = 0 (if password rules are known to the attacker). I don't get how anyone who cared the slightest about security would think otherwise and enforces these stupid rules.

I think a lot of it is driven by management. I've had to talk management out of it before. Then they still "don't get it" and think I'm OK with an "easier to hack" website, holding it against me as a character flaw - as if I'm a bad engineer who doesn't believe in diligence.

Anyway, that's probably where they come from - implemented by more obedient employees.

Re: Stop forcing arbitrary password rules

#40

Post by WhitneyLand »

lhecker wrote: post #22

I completely agree with the author, but... what he completely misses is the biggest annoyance: maximum length rules. I'd probably sacrifice my firstborn if Microsoft would finally wake up and accept passwords longer than 16 goddamn characters...

This sounds a little obsessive. How often are hackers brute forcing a random 16 character hash?
Post reply on HN