Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop forcing arbitrary password rules

ryanwinchester.ca

Post reply on HN
Print view View original

41–50 of 196 posts

Re: Stop forcing arbitrary password rules

#41

Post by xixixao »

CHY872 wrote: post #37
codedokode wrote: post #34

What we really need is to stop using passwords. Passwords are awful UX design solution. The users have to think of and remember some meaningless phrase to get the service they really needed. If you use easy password, your account can be hacked. If you use difficult password, you won't remember it in a week. For some people remembering a password or login might be especially difficult. You can use software to generate…

No. They are not superior to passwords - they merely provide different tradeoffs. For example, the site that requires your hypothetical key-type key would require that either all of their customers have spent money on such a key (bad) or that they are willing to pay for keys for all of their customers. This is something that has been thought about in detail - see https://vtllf.org/blog/ssh-web-sign-in/quest-to-replac…

More importantly, you just replaced the problems of virtual keys with the problems of physical keys: you can lose them. Recovery is much more difficult than recovery of a virtual key.

Re: Stop forcing arbitrary password rules

#42

Post by gambiting »

ErrantX wrote: post #4

Argh! The XKCD entropy comic. Back away slowly.. The "4 common words" password meme was around a lot after that comic. However, such passwords are definitely not secure because a good dictionary attack will break it in hours. You do not have as much entropy as you think with them. The same problem tangentially applies to his suggested password schema to. The problem is: as soon as you start using human word or pseudo…

No. For a dictionary attack, someone would need to know that you are using words. They would need to know if they are separated by spaces, or dots or slashes. The probability of someone knowing your personal scheme is fantastically low, unless they already know one of your other passwords and can guess it. A password like:

"Żółć zżółkła w gąszczu fantazyji!"

Is absolutely impossible to crack in any reasonable amount of time. It's a perfectly valid sentence in Polish, but the attacker would need to know to use a Polish dictionary, and also a one of these words is an old-Polish word which will not appear in any modern dictionaries. Finally, they would need to know you have an exclamation mark at the end.

It's literally impossible for someone to guess all of that, and this password is infinitely easier to remember than !@#%#$@j4jnvdbst$#^@%$@#$#

Re: Stop forcing arbitrary password rules

#43

Post by nsmalch »

aruggirello wrote: post #32
nsmalch wrote: post #8

Earlier quoted context omitted.

XKCD's diceware argument fails under certain conditions. Computationally very hard to crack, but when plucked from actual phrases that have been uttered; weak. So to give an example, any natural language phrase like: "I took a walk in a park" is easier to crack. I am certain there is somebody coding an infinite-monkey-type bruter to crack diceware as we speak: https://en.wikipedia.org/wiki/Infinite_monkey_theorem

Diceware proper is not 'plucked from actual phrases that have been uttered'. It's a random sequence obtained by throwing a dice a number of times (hence the name). This means you can't lookup your e-book collection for an exact phrase to use (eg. a famous quote). Moreover, diceware can be set up with any dictionary, and nobody stops you from computing your own dictionary. If you do that, good luck to the bruter attem…

Yeah what I meant is that sometimes the phrase appears like natural language, and was probably uttered once, if not on a stray ebook than somebody once said it. Of course then we have have the question of whether history starts the moment it is electronically recorded.

If NLG upsets you, you can always settle for a Markov chain and some atmospheric noise to seed the random values

Re: Stop forcing arbitrary password rules

#44

Post by dagss »

WhitneyLand wrote: post #40
lhecker wrote: post #22

I completely agree with the author, but... what he completely misses is the biggest annoyance: maximum length rules. I'd probably sacrifice my firstborn if Microsoft would finally wake up and accept passwords longer than 16 goddamn characters...

This sounds a little obsessive. How often are hackers brute forcing a random 16 character hash?

Point is you can use passphrases that are easier for humans to remember, but you then need to measure entropy as numbers of words and size of dictionary and 16 characters is too little. https://xkcd.com/936/

Re: Stop forcing arbitrary password rules

#45

Post by microtonal »

xixixao wrote: post #41
CHY872 wrote: post #37

Earlier quoted context omitted.

No. They are not superior to passwords - they merely provide different tradeoffs. For example, the site that requires your hypothetical key-type key would require that either all of their customers have spent money on such a key (bad) or that they are willing to pay for keys for all of their customers. This is something that has been thought about in detail - see https://vtllf.org/blog/ssh-web-sign-in/quest-to-replac…

More importantly, you just replaced the problems of virtual keys with the problems of physical keys: you can lose them. Recovery is much more difficult than recovery of a virtual key.

With keys such as a U2F key, you can use it for multiple sites (each site will have a site-specific keypair). Most sites allow you to associate multiple U2F keys as well. Since U2F keys typically cost 7 to 15 Euro, it's really not much of a problem to buy one for use and to put one as a backup in a fire-proof safe.

That said, I think it's bad to rely on one factor. If the key gets stolen, security is compromised. The combination of a password and a security token is far more secure. People should just stop memorizing passwords for every site and e.g. use a password manager.

Re: Stop forcing arbitrary password rules

#46

Post by Karlozkiller »

lhecker wrote: post #22

I completely agree with the author, but... what he completely misses is the biggest annoyance: maximum length rules. I'd probably sacrifice my firstborn if Microsoft would finally wake up and accept passwords longer than 16 goddamn characters...

No, the most annoying thing is when they don't tell you the rules in advance, and you start typing a password that fits most standard rules.

Now either you get through but don't know if you could've used a better password. Or your password will be denied and you have to make adaptions or change completely.

Re: Stop forcing arbitrary password rules

#47

Post by benashford »

lifeisstillgood wrote: post #11

I use pwsafe for iOS (yes trusting some guy built a binary ok) to keep my many passwords for each domain. It will generate (no I don't know the RNG) passwords based on policy settings (length, characters, etc) And like the author, flat out my number one bugbear is that no matter what random(ish) password I choose before signing up, some idiot will decide that my 12 letter password is too long or my password must have…

And then you lose your phone and...

Re: Stop forcing arbitrary password rules

#48

Post by pwman »

gambiting wrote: post #42
ErrantX wrote: post #4

Argh! The XKCD entropy comic. Back away slowly.. The "4 common words" password meme was around a lot after that comic. However, such passwords are definitely not secure because a good dictionary attack will break it in hours. You do not have as much entropy as you think with them. The same problem tangentially applies to his suggested password schema to. The problem is: as soon as you start using human word or pseudo…

No. For a dictionary attack, someone would need to know that you are using words. They would need to know if they are separated by spaces, or dots or slashes. The probability of someone knowing your personal scheme is fantastically low, unless they already know one of your other passwords and can guess it. A password like: "Żółć zżółkła w gąszczu fantazyji!" Is absolutely impossible to crack in any reasonable amount…

Some of your sites are storing your password in plain text, see http://plaintextoffenders.com/ for a few.

Once a single one of those is hacked your method is exposed and it goes from improbable to practical.

Re: Stop forcing arbitrary password rules

#49

Post by lhecker »

dagss wrote: post #44
WhitneyLand wrote: post #40

Earlier quoted context omitted.

This sounds a little obsessive. How often are hackers brute forcing a random 16 character hash?

Point is you can use passphrases that are easier for humans to remember, but you then need to measure entropy as numbers of words and size of dictionary and 16 characters is too little. https://xkcd.com/936/

Yep exactly that. It would be great if I could just use some whole words as the password for accounts which I need to use often or are really important and thus IMHO make password stores impractical (e.g. desktop login, Gmail, …)

Re: Stop forcing arbitrary password rules

#50

Post by codedokode »

CHY872 wrote: post #37
codedokode wrote: post #34

What we really need is to stop using passwords. Passwords are awful UX design solution. The users have to think of and remember some meaningless phrase to get the service they really needed. If you use easy password, your account can be hacked. If you use difficult password, you won't remember it in a week. For some people remembering a password or login might be especially difficult. You can use software to generate…

No. They are not superior to passwords - they merely provide different tradeoffs. For example, the site that requires your hypothetical key-type key would require that either all of their customers have spent money on such a key (bad) or that they are willing to pay for keys for all of their customers. This is something that has been thought about in detail - see https://vtllf.org/blog/ssh-web-sign-in/quest-to-replac…

If there were an open source protocol you could use software emulator and pay nothing (if you don't care about security).
Post reply on HN