Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop restricting my password - Help these sites get better security.

weakpasswords.org

Post reply on HN
Print view View original

51–60 of 61 posts

Re: Stop restricting my password - Help these sites get better security.

#51

Post by a-priori »

dkokelley wrote: post #28

One example of extreme login security that I've seen is with treasurydirect.gov. Password: min 8 char, 1 letter, 1 number, 1 special. Mailed key card: 7 x 5 alpha numeric grid with a random 3 char series ((A2, G5, F5) for example), 1 out of 3 sets of 10 digit numbers on your key card, 3 security questions on unrecognised computers (out of around 10 - you must remember which 3 questions you set and answer them appropr…

Ever had a bank account in Switzerland? Swiss Post uses two-factor authentication with challenge-response for online logins.

First you enter a password, and you get a challenge code back. You insert your card into a device they send you, then enter the pin and the code. The device displays a response code that you enter into the website.

Re: Stop restricting my password - Help these sites get better security.

#52

Post by josefresco »

Hey business owner. I see that you're using a faulty window lock on your back window and I'm concerned about my data. I took the liberty of posting on a town bulletin board details of this faulty lock along with other local businesses that have the same lock in hopes that the townspeople will pressure you into improving your window lock system.

Re: Stop restricting my password - Help these sites get better security.

#53

Post by maukdaddy »

sriramk wrote: post #7

American Express is the worst offender. They don't accept my usually long passwords/passphrases so I had to conjure up a shorter password just for their system.

I cringe every time I log into the AMEX site. I cannot believe a financial institution as large and with the resources they have allows that kind of lax security. Even worse when you consider the business accounts that manage hundreds or thousands of corporate amex cards.

Re: Stop restricting my password - Help these sites get better security.

#54

Post by tptacek »

derwiki wrote: post #25
dinkumator wrote: post #2

There's really no point in restricting length or non-alphanumeric characters. They should be storing a salted hash, not the actual passwords, so the content of the password shouldn't matter. It's really just laziness and incomptence on the part of the programmers.

The argument I once heard for restricting length of a password (and possibly special characters) is that it would be harder to craft a buffer overflow (or SQL injection attack) with those limitations. I don't agree that this is a good solution, but it's not always good programmers/managers who are making these decisions. It at least sounds plausible.

That's a really bad argument. If password length is threatening to you, you have no business accepting passwords.

(Length also has almost nothing to do with SQL Injection, and you're plugging a raw password into an SQL query you're doing something very wrong anyways).

Re: Stop restricting my password - Help these sites get better security.

#55

Post by samgrover »

CWuestefeld wrote: post #49
geocar wrote: post #47

Earlier quoted context omitted.

The word here is "encrypt" or "cipher" not "hash": > But if they use a two way cipher and the server is compromised one would presume the mechanism for un-encrypting [decrypting] the passwords would also be compromised meaning it is almost as bad? It might be. It is conceivable that a site may use public key cryptography and store encrypted passwords, but have password recovery done on an independent system which has…

I'd give an admonishment to anyone who uses a password question from the standard set (mother's maiden name, etc.), even if it is hashed, because the data is so easily discoverable. Nevertheless, the idea of a password question is so useful that I still support it on my sites. But our implementation is open-ended: you define your own question as well as its answer. I think this is better for anyone who is security co…

I prefer defining my own qesution and answer.

However, a mechanism for sites that use the standard questions is to manufacture a set of fictitious names and use those everywhere. e.g. Father's name - "Keyser Soze". First car make and model, "Millennium Falcon", etc.

There is the overhead of remembering these but that is not too hard with some thought and repeated use.

Re: Stop restricting my password - Help these sites get better security.

#57

Post by dinkumator »

shrughes wrote: post #30
dinkumator wrote: post #2

There's really no point in restricting length or non-alphanumeric characters. They should be storing a salted hash, not the actual passwords, so the content of the password shouldn't matter. It's really just laziness and incomptence on the part of the programmers.

They should be storing a salted hash, not the actual passwords, so the content of the password shouldn't matter. No, they should be using bcrypt. You didn't think you'd get away with this by posting after tptacek's bedtime, did you?

md5, sha, blowfish, bcrypt... name your pick. i didn't mention a specific algorithm. either way, you're still not saving the password to a database.

Re: Stop restricting my password - Help these sites get better security.

#58

Post by swombat »

Quarrelsome wrote: post #46
swombat wrote: post #41

Earlier quoted context omitted.

I'd get the list by doing a password reminder and seeing if they email me my password. That will tell you whether they send the password in clear, not whether they encrypt it. The only information you'll have is: IF (they send you the password in clear) THEN (they don't use a one-way hash) There is no other information to be derived from this method of checking.

But if they use a two way hash and the server is compromised one would presume the mechanism for un-hashing the passwords would also be compromised meaning it is almost as bad? (? as my knowledge on security is somewhat limited)

My point was, you know nothing about how they store their passwords if they send you a reset link.

Re: Stop restricting my password - Help these sites get better security.

#59

Post by dkokelley »

a-priori wrote: post #51
dkokelley wrote: post #28

One example of extreme login security that I've seen is with treasurydirect.gov. Password: min 8 char, 1 letter, 1 number, 1 special. Mailed key card: 7 x 5 alpha numeric grid with a random 3 char series ((A2, G5, F5) for example), 1 out of 3 sets of 10 digit numbers on your key card, 3 security questions on unrecognised computers (out of around 10 - you must remember which 3 questions you set and answer them appropr…

Ever had a bank account in Switzerland? Swiss Post uses two-factor authentication with challenge-response for online logins. First you enter a password, and you get a challenge code back. You insert your card into a device they send you, then enter the pin and the code. The device displays a response code that you enter into the website.

That's pretty good. My bank has something like that for their online data storage, except instead of a device that will give me the code (I could get that for $25 they say), they send me a sms with the code after I enter my password.

Re: Stop restricting my password - Help these sites get better security.

#60

Post by jfarmer »

branden wrote: post #27
jfarmer wrote: post #26

Earlier quoted context omitted.

Hmm? The hash will be a fixed length, which is the only thing you'd be storing.

In order to get that hash you'd have to process the password in its entirety. But really, if they're that concerned about the buffer I see no reason to cap it at 8 or 10 rather than 1000.

Eh. That seems unlikely, assuming you're not writing your own routines. At most you'd get an out of memory error. I can calculate the SHA1 digest of a 1Bn character string without running into that problem.

So let's cap the length at 100k characters and call it a day.

Post reply on HN