Stop forcing arbitrary password rules • Hacker News Board

Re: Stop forcing arbitrary password rules

#111

Post by draven » Sat, Oct 24, 2015, 1:16 PM UTC

coreyp_1 wrote: post #67

I despise expiring passwords. My university makes me change my password every 6 months, and they keep a list of the last 2 year's worth of passwords so that you can't reuse them. That, and they disallow some characters such as "#" and " " (space). It's annoying.

They also did that at one of my previous workplace. We couldn't reuse any of the passwords we used in the past (no limit apparently), but in the form to change our password, they checked if the current and new passwords were different w/ some Js.

With the help of firebug we could keep the same password as long as we wanted.

Re: Stop forcing arbitrary password rules

#112

Post by DanBC » Sat, Oct 24, 2015, 1:22 PM UTC

JoeAltmaier wrote: post #110

DanBC wrote: post #98

Earlier quoted context omitted.

Humans use dice to generate randomness. They throw 5 dice, to get a five digit number. They look up that number on a list to get a word. They repeat this process until they have a 7 word phrase. So, there are weaknesses if humans roll the 5 dice and get 1, 1, 1, 1, 1 and then say "That's not random, I'll roll again"[1] or they roll a number, look it up and say "I'll never remember 'zerg', I'll roll again".

Rolling again, is no weakness at all. The next roll is also random and exactly as unguessable as the first. If the game was done 'without replacement' then the field would be reduced, but it isn't, and the field is unimaginably huge anyway. There is no effect whatsoever by 'rolling again' until you are happy with the result. My buddy Tom always generates UUIDs by hitting the button several times. It gives him pleasur…

With diceware there's a list of 7776 words.

When someone rolls 1,1,1,1,1 and rejects that word they've cut down the word list to 7775 words. That's tiny, but it is a change.

Re: Stop forcing arbitrary password rules

#113

Post by citruspi » Sat, Oct 24, 2015, 1:23 PM UTC

JoeAltmaier wrote: post #108

citruspi wrote: post #107

Earlier quoted context omitted.

> A virtual key can truly be lost forever. Sure, but it's super easy to make backups of virtual keys. It's a digital file - just copy it. Worried one backup isn't enough? Make a million. Space is cheap.

Ok, but that makes is harder, not easier, to manage virtual keys. And the more copies, the weaker the key (the easier to find). A million is a terrible, terrible idea. No, I despise passwords. The whole scheme is backwards. I don't want to authenticate myself to the server; I want to authenticate the server to me. Why doesn't it provide the password, and my computer verify it? Why is a fallible human being in this ga…

> A million is a terrible, terrible idea.

Well, yeah. That was a hyperbole. I didn't actually mean that you should go out and make a million copies of your key.

It simply meant to show that it's easier to prevent the loss of a virtual key than it is to prevent the loss of the physical key.

> The whole scheme is backwards. I don't want to authenticate myself to the server; I want to authenticate the server to me.

That's... interesting. My first thought when I read that is that the server is the one with your data and multiple users - so it needs to authenticate you to make sure that you only access your data and don't gain access to other users' data.

A server authenticating itself with you would tell you that you're actually talking to XYZ and not an imposter, but once that authentication took place you'd have access to everything on that server. Including other users' data.

How do you imagine this working?

Re: Stop forcing arbitrary password rules

#114

Post by sago » Sat, Oct 24, 2015, 1:26 PM UTC

plorg wrote: post #16

I was in Chicago with my family recently and purchased a one-day pass for the CTA. When I returned home I found you could create an online account connected to the card, ostensibly to be able to fill it up automatically, but also to track your ridership. I thought it would be interesting to see what kind of data a rider could get from the card. I spent quite a bit of time trying to create an account only to receive a…

Suggests to me that form-input is being used unescaped at some point in their software. I wonder what the password "foo'; drop table users;" would do.

Re: Stop forcing arbitrary password rules

#115

Post by JoeAltmaier » Sat, Oct 24, 2015, 1:28 PM UTC

citruspi wrote: post #113

JoeAltmaier wrote: post #108

Earlier quoted context omitted.

Ok, but that makes is harder, not easier, to manage virtual keys. And the more copies, the weaker the key (the easier to find). A million is a terrible, terrible idea. No, I despise passwords. The whole scheme is backwards. I don't want to authenticate myself to the server; I want to authenticate the server to me. Why doesn't it provide the password, and my computer verify it? Why is a fallible human being in this ga…

> A million is a terrible, terrible idea. Well, yeah. That was a hyperbole. I didn't actually mean that you should go out and make a million copies of your key. It simply meant to show that it's easier to prevent the loss of a virtual key than it is to prevent the loss of the physical key. > The whole scheme is backwards. I don't want to authenticate myself to the server; I want to authenticate the server to me. That…

Any authentication is one-to-one. The server authenticates to me, by first knowing who I am (my 'username' not a password), then using a scheme we agreed upon (our shared pair of private/public keys would be fine) to verify electronically that my machine belongs to me i.e. has the right keys.

So we are both authenticated to one another. Except now, we're using sophisticated passwords and Digital Computer Logic to work them out. Instead of my fallible wetware.

Re: Stop forcing arbitrary password rules

#116

Post by Natanael_L » Sat, Oct 24, 2015, 1:28 PM UTC

Asbostos wrote: post #100

Natanael_L wrote: post #72

Earlier quoted context omitted.

U2F! The new Yubikeys supports it, and there's other hardware you can get too that supports the protocol.

Hey that looks fantastic. It only seems to be supported by about half a dozen sites though. I wonder if there are some big costs to a site adopting it.

The protocol is open, the libraries for implementing it are too. You just have to look into how it works and differ from what you have, and integrate it correctly into your auth system.

Re: Stop forcing arbitrary password rules

#117

Post by [deleted] » Sat, Oct 24, 2015, 1:30 PM UTC

DanBC wrote: post #112

JoeAltmaier wrote: post #110

Earlier quoted context omitted.

Rolling again, is no weakness at all. The next roll is also random and exactly as unguessable as the first. If the game was done 'without replacement' then the field would be reduced, but it isn't, and the field is unimaginably huge anyway. There is no effect whatsoever by 'rolling again' until you are happy with the result. My buddy Tom always generates UUIDs by hitting the button several times. It gives him pleasur…

With diceware there's a list of 7776 words. When someone rolls 1,1,1,1,1 and rejects that word they've cut down the word list to 7775 words. That's tiny, but it is a change.

[deleted]

Re: Stop forcing arbitrary password rules

#118

Post by JoeAltmaier » Sat, Oct 24, 2015, 1:32 PM UTC

DanBC wrote: post #112

JoeAltmaier wrote: post #110

Earlier quoted context omitted.

Rolling again, is no weakness at all. The next roll is also random and exactly as unguessable as the first. If the game was done 'without replacement' then the field would be reduced, but it isn't, and the field is unimaginably huge anyway. There is no effect whatsoever by 'rolling again' until you are happy with the result. My buddy Tom always generates UUIDs by hitting the button several times. It gives him pleasur…

With diceware there's a list of 7776 words. When someone rolls 1,1,1,1,1 and rejects that word they've cut down the word list to 7775 words. That's tiny, but it is a change.

Right, for word choice it is significant. I was thinking, rejecting the whole password pattern.

Re: Stop forcing arbitrary password rules

#119

Post by dendory » Sat, Oct 24, 2015, 1:35 PM UTC

Password rules are needed, otherwise passwords would be even worse than they are now, with people going back to using '1' or '1234'. They just need to be better designed:

Must have at least 16 chars, OR Must have at least 8 chars with 1 number, 1 letter, 1 symbol, AND Must not have more than 3 repeating characters

Re: Stop forcing arbitrary password rules

#120

Post by amalcon » Sat, Oct 24, 2015, 1:36 PM UTC

WhitneyLand wrote: post #40

lhecker wrote: post #22

I completely agree with the author, but... what he completely misses is the biggest annoyance: maximum length rules. I'd probably sacrifice my firstborn if Microsoft would finally wake up and accept passwords longer than 16 goddamn characters...

This sounds a little obsessive. How often are hackers brute forcing a random 16 character hash?

One other issue is that this indicates a site doing something they should not be. The best practice for password storage is to use a secure password hash like bcrypt, and not store the actual password at all.

If one actually does this, the length of the password becomes almost irrelevant to the server. You might want to reject 10MB passwords or something, to prevent someone from taking up all your RAM during login, but the difference between 16 characters and 1024 (or 72, the max for bcrypt) is irrelevant.