Stop forcing arbitrary password rules • Hacker News Board

Re: Stop forcing arbitrary password rules

#121

Post by mikeash » Sat, Oct 24, 2015, 1:38 PM UTC

qb45 wrote: post #76

dannib wrote: post #53

Earlier quoted context omitted.

No, the most annoying is when you paste your password manager's auto generated long password and it silently get cut after 16 characters but successfully let you create your account. But now the login form doesn't have the same max-length property and your password will fail. Hopefully the reset password form is synced with the login form.

Now this reminded me of one Unix server operated by an educational institution that shall remain unnamed, where passwords were (maybe still are?) truncated to 8 characters. Fortunately, this wasn't a problem because as long as the first 8 characters matched you could type literally anything and the password would get accepted. Funnily, the admins apparently really cared about security very much, so they required user…

There is a bank which shall remain nameless (Schwab) which not only silently truncates passwords to 8 characters, but also performs a case insensitive match.

They say they're working on fixing it but it's taking an awfully long time.

Re: Stop forcing arbitrary password rules

#122

Post by Natanael_L » Sat, Oct 24, 2015, 1:38 PM UTC

gambiting wrote: post #42

ErrantX wrote: post #4

Argh! The XKCD entropy comic. Back away slowly.. The "4 common words" password meme was around a lot after that comic. However, such passwords are definitely not secure because a good dictionary attack will break it in hours. You do not have as much entropy as you think with them. The same problem tangentially applies to his suggested password schema to. The problem is: as soon as you start using human word or pseudo…

No. For a dictionary attack, someone would need to know that you are using words. They would need to know if they are separated by spaces, or dots or slashes. The probability of someone knowing your personal scheme is fantastically low, unless they already know one of your other passwords and can guess it. A password like: "Żółć zżółkła w gąszczu fantazyji!" Is absolutely impossible to crack in any reasonable amount…

It has literally been done already. Obscure African poems have been guessed.

Re: Stop forcing arbitrary password rules

#123

Post by JoeAltmaier » Sat, Oct 24, 2015, 1:39 PM UTC

dendory wrote: post #119

Password rules are needed, otherwise passwords would be even worse than they are now, with people going back to using '1' or '1234'. They just need to be better designed: Must have at least 16 chars, OR Must have at least 8 chars with 1 number, 1 letter, 1 symbol, AND Must not have more than 3 repeating characters

I think the rest of this thread, and the OP, have been systematically refuting that claim.

Re: Stop forcing arbitrary password rules

#124

Post by chris_wot » Sat, Oct 24, 2015, 1:41 PM UTC

DanBC wrote: post #89

chris_wot wrote: post #77

I've been wondering about password complexity for a while now. If a password is cryptographically hashed, so long as it isn't a dictionary word or date, why on earth do people add in complexity rules that prevent arbitrary character sequences? What I'm getting at here is that if you had a 8 character password (for the sake of the example), and you can type in lowercase letters, uppercase letters, numbers and punctuat…

People still think rainbow tables are a thing. So they add complexity to make rainbow tables too huge.

I thought salting effectively nullified rainbow table based attacks?

Re: Stop forcing arbitrary password rules

#125

Post by ckaygusu » Sat, Oct 24, 2015, 2:03 PM UTC

One startup I was working for were enforcing different rules depending on where you were setting the password e.g. 4 characters when you follow the forgotten password procedure, 8 characters when registering, 12 characters when changing password normally.

Another thing, a visa broker in Turkey had a so ridiculous password rule and gibberish error message, I had to read the source code and parse the regex by hand. Only then I was able to type in a valid password.

Re: Stop forcing arbitrary password rules

#126

Post by ddlatham » Sat, Oct 24, 2015, 2:04 PM UTC

100 times yes. The mere presence of a single character from a different class does not increase entropy. It means that most common passwords move from 8 lowercase letters to 6 lowercase letters plus 1 number plus 1 symbol, which is even easier to search.

If you have a sophisticated entropy estimation tool, or library, great. Another simple thing is using a min length, plus restrict from a dictionary of the million most leaked passwords to outlaw those (can hold it in a bloom filter if size is a concern).

Re: Stop forcing arbitrary password rules

#127

Post by pavel_lishin » Sat, Oct 24, 2015, 2:06 PM UTC

JoeAltmaier wrote: post #101

xixixao wrote: post #41

Earlier quoted context omitted.

More importantly, you just replaced the problems of virtual keys with the problems of physical keys: you can lose them. Recovery is much more difficult than recovery of a virtual key.

Really? You don't lose (forget) virtual keys? It's a far worse problem. A physical key can always be found if you look hard enough. A virtual key can truly be lost forever.

"Aha! I found it! It was in my pants' pocket! Which was in the dryer! And before that, in the washer! And before that, in that puddle!"

Re: Stop forcing arbitrary password rules

#128

Post by jordanpg » Sat, Oct 24, 2015, 2:07 PM UTC

lhecker wrote: post #22

I completely agree with the author, but... what he completely misses is the biggest annoyance: maximum length rules. I'd probably sacrifice my firstborn if Microsoft would finally wake up and accept passwords longer than 16 goddamn characters...

Whenever I see this maximum password length nonsense, I realize that whoever is in charge of security at this company apparently doesn't know or care about password managers. And that speaks volumes to me.

Re: Stop forcing arbitrary password rules

#129

Post by dcosson » Sat, Oct 24, 2015, 2:09 PM UTC

dannib wrote: post #53

Karlozkiller wrote: post #46

Earlier quoted context omitted.

No, the most annoying thing is when they don't tell you the rules in advance, and you start typing a password that fits most standard rules. Now either you get through but don't know if you could've used a better password. Or your password will be denied and you have to make adaptions or change completely.

No, the most annoying is when you paste your password manager's auto generated long password and it silently get cut after 16 characters but successfully let you create your account. But now the login form doesn't have the same max-length property and your password will fail. Hopefully the reset password form is synced with the login form.

No, the most annoying is when you're on ios and the app doesn't integrate with password extensions and has decided to disable pasting in the password field.

Re: Stop forcing arbitrary password rules

#130

Post by usrusr » Sat, Oct 24, 2015, 2:14 PM UTC

ErrantX wrote: post #74

desdiv wrote: post #10

Earlier quoted context omitted.

Can you explain why the XKCD scheme is weak to dictionary attacks? Using the 2048 common words example from the comic, there would be 2048^4 = 1.8e13 four word combinations. I don't see any possible attack that's faster than brute-force here.

Of course, it's not the worst schema. But it gets a lot more credit than it is worth. Using dictionary words reduces the entropy of your password significantly. And for a cracker it can be trivial to attack passwords of that form. Given the sort of compute power you can obtain cheaply nowadays, attacking 4-word schemas (especially given people tend to use common words) is not hard. It's to some degree security throug…

> It's to some degree security through obscurity: no, a > cracker will not know your schema in advance but he will > attempt to attack multiple schema types.

If you put it like that, then passwords are security through obscurity too, since they are only secure because the attacker does not know the password? It's really all about having your own, personal schema. Even a slight variation of a popular one will put you safely out of the path of that multi-schema dragnet if the resulting password isn't part of any of the schema spaces. Just make sure it really is your very own variant and not something many others would also come up with. Add a part of that old line noise password you still remember from university at a fixed position of the word list or something like that. Even a recycled ATM PIN might help, your word list just got 9999 words longer. Add those digits to the individual words? 9999 new dictionary schemas to process. To play on the old Clarke: any sufficiently high number of possible password schema variations is indistinguishable form requiring a true brute force attack.

> Always use a password manager!

Yay, a single, juicy target, synchronized to any number of devices of various levels of tamper resistance, maybe even with some user-friendly automation that will happily hand out login pairs to anything that has temporarily taken control of your browser. With local exploits empowered by such a big sign saying "this is where the good stuff is kept", do you know a good writeup of practical password manager risk mitigation strategies? Like adding a brain-stored suffix to the more important ones and so on, so that an attack script would also need to do key logging or mild individual brute forcing. I'm sure there must be an established body of expert opinion on this somewhere.