Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop forcing arbitrary password rules

ryanwinchester.ca

Post reply on HN
Print view View original

51–60 of 196 posts

Re: Stop forcing arbitrary password rules

#51

Post by nsmalch »

DanBC wrote: post #28
nsmalch wrote: post #8

Earlier quoted context omitted.

XKCD's diceware argument fails under certain conditions. Computationally very hard to crack, but when plucked from actual phrases that have been uttered; weak. So to give an example, any natural language phrase like: "I took a walk in a park" is easier to crack. I am certain there is somebody coding an infinite-monkey-type bruter to crack diceware as we speak: https://en.wikipedia.org/wiki/Infinite_monkey_theorem

I'm not sure I understand how an infinite monkey attack would work against diceware. Let's assume a word list of 7776 words. All words are lower case alpha. The attacker has pur wordlist. And the attacker knows there are seven words in the passphrase. That's still 7776^7. Even if we prune the wordlist ("I'm not using 'zerg' in my phrase", "I rolled 11111, that's not random so I'll roll again") it's still not an attac…

As a rule of thumb, I would go after natural language phrases first, because it is impossible to tell if the phrase was machine-generated. It's nearly impossible to arrange dots randomly on a page with a pencil because there is always some structure or engrained rigidity in human guesswork. There is also the possibility that the dots were done by 'inception', and certain biases were programmed in via subliminal messaging. Don't trust humans to do a machine's tasks.

Re: Stop forcing arbitrary password rules

#53

Post by dannib »

Karlozkiller wrote: post #46
lhecker wrote: post #22

I completely agree with the author, but... what he completely misses is the biggest annoyance: maximum length rules. I'd probably sacrifice my firstborn if Microsoft would finally wake up and accept passwords longer than 16 goddamn characters...

No, the most annoying thing is when they don't tell you the rules in advance, and you start typing a password that fits most standard rules. Now either you get through but don't know if you could've used a better password. Or your password will be denied and you have to make adaptions or change completely.

No, the most annoying is when you paste your password manager's auto generated long password and it silently get cut after 16 characters but successfully let you create your account. But now the login form doesn't have the same max-length property and your password will fail.

Hopefully the reset password form is synced with the login form.

Re: Stop forcing arbitrary password rules

#54

Post by nsmalch »

codedokode wrote: post #34

What we really need is to stop using passwords. Passwords are awful UX design solution. The users have to think of and remember some meaningless phrase to get the service they really needed. If you use easy password, your account can be hacked. If you use difficult password, you won't remember it in a week. For some people remembering a password or login might be especially difficult. You can use software to generate…

I like the happy medium of one ultra quantum unbreakable master passphrase which is used to unlock easier to guess passwords. SO somebody owned your Imgur account full of memes. So what? Always assume an account is breakable.

http://www.theguardian.com/technology/2015/sep/11/gchq-passw...

Re: Stop forcing arbitrary password rules

#55

Post by codedokode »

xixixao wrote: post #41
CHY872 wrote: post #37

Earlier quoted context omitted.

No. They are not superior to passwords - they merely provide different tradeoffs. For example, the site that requires your hypothetical key-type key would require that either all of their customers have spent money on such a key (bad) or that they are willing to pay for keys for all of their customers. This is something that has been thought about in detail - see https://vtllf.org/blog/ssh-web-sign-in/quest-to-replac…

More importantly, you just replaced the problems of virtual keys with the problems of physical keys: you can lose them. Recovery is much more difficult than recovery of a virtual key.

To steal a physical key you need to find a person and make him give you the key (and tell a PIN code if it is protected). It is hard to do on a large scale and you probably get beaten or go to jail soon.

And passwords can be stolen remotely using trojan software. You won't even know whether your password was compromized.

I agree the recovery can be a problem but there probably are ways to solve it.

Re: Stop forcing arbitrary password rules

#56

Post by drdaeman »

codedokode wrote: post #34

What we really need is to stop using passwords. Passwords are awful UX design solution. The users have to think of and remember some meaningless phrase to get the service they really needed. If you use easy password, your account can be hacked. If you use difficult password, you won't remember it in a week. For some people remembering a password or login might be especially difficult. You can use software to generate…

We have those keys, technically supported in every browser, and you can decide on the level of security that you want - and store keys on highly secure tamper-resistant hardware tokens or manage everything purely in software of your choice.

It's called TLS client certificates and no one supports those.

Browser vendors make UIs that are absolutely awful (it's like they do this on some damned purpose!), there is no synchronization for low-security software tokens (yup, it's not a big deal to sync some private keys in a same way we sync other credentials like passwords), standardizing organizations don't work on multiple signatures (say, gradually ditching X.509 in favor of OpenPGP - TLS doesn't really care how blobs are encoded). So, the sites don't consume them, although technically everything's there - a element, JS APIs, TLS, anything.

Re: Stop forcing arbitrary password rules

#57

Post by drdaeman »

codedokode wrote: post #50
CHY872 wrote: post #37

Earlier quoted context omitted.

No. They are not superior to passwords - they merely provide different tradeoffs. For example, the site that requires your hypothetical key-type key would require that either all of their customers have spent money on such a key (bad) or that they are willing to pay for keys for all of their customers. This is something that has been thought about in detail - see https://vtllf.org/blog/ssh-web-sign-in/quest-to-replac…

If there were an open source protocol you could use software emulator and pay nothing (if you don't care about security).

There is, it's called TLS, the same one that's used in HTTPS ;)

But, sadly, it's not usable. See my reply to grandparent comment.

Re: Stop forcing arbitrary password rules

#58

Post by qb45 »

dannib wrote: post #53
Karlozkiller wrote: post #46

Earlier quoted context omitted.

No, the most annoying thing is when they don't tell you the rules in advance, and you start typing a password that fits most standard rules. Now either you get through but don't know if you could've used a better password. Or your password will be denied and you have to make adaptions or change completely.

No, the most annoying is when you paste your password manager's auto generated long password and it silently get cut after 16 characters but successfully let you create your account. But now the login form doesn't have the same max-length property and your password will fail. Hopefully the reset password form is synced with the login form.

Sounds so insane I guess it must have really happened.

I had similar issue with paypal once. Their bank account number field expected to get N digits without spaces, so it was hard limited to N characters. Of course they didn't bother telling about that. When I pasted my number with some K space separators tossed between digits, the last K digits have been silently truncated. Boom, account locked.

Re: Stop forcing arbitrary password rules

#59

Post by whyoh »

codedokode wrote: post #34

What we really need is to stop using passwords. Passwords are awful UX design solution. The users have to think of and remember some meaningless phrase to get the service they really needed. If you use easy password, your account can be hacked. If you use difficult password, you won't remember it in a week. For some people remembering a password or login might be especially difficult. You can use software to generate…

No doubt a lot of people suck at password management, but with proper management it's easier for a thief to steal a hardware key. Or a phone. Which is why I hate that some new services require a phone number for authentication.

Re: Stop forcing arbitrary password rules

#60

Post by lhecker »

dannib wrote: post #53
Karlozkiller wrote: post #46

Earlier quoted context omitted.

No, the most annoying thing is when they don't tell you the rules in advance, and you start typing a password that fits most standard rules. Now either you get through but don't know if you could've used a better password. Or your password will be denied and you have to make adaptions or change completely.

No, the most annoying is when you paste your password manager's auto generated long password and it silently get cut after 16 characters but successfully let you create your account. But now the login form doesn't have the same max-length property and your password will fail. Hopefully the reset password form is synced with the login form.

Yikes... That's even worse.

Well at least Microsoft stopped doing that and are now displaying a message that the password is too long instead of doing it silently.

Post reply on HN