Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NIST’s new password rules – what you need to know

nakedsecurity.sophos.com

Post reply on HN
Print view View original

21–30 of 237 posts

Re: NIST’s new password rules – what you need to know

#21

Post by rconti »

sp332 wrote: post #11
sib wrote: post #9

Earlier quoted context omitted.

Nothing better than rules based on bad data and security theater.

If your password is compromised, it will only work until the next reset. That's better than having one that works for years.

That's true, but I'm having hard time thinking of a use case where a sustained, hidden compromise is 'worse' than a one-time compromise.

I mean, I guess they could login to your bank every week and transfer out $50 instead of just transferring out all your money on day 1, but... ?

Re: NIST’s new password rules – what you need to know

#22

Post by ryanlol »

josephg wrote: post #20
zwily wrote: post #15

Earlier quoted context omitted.

Those are rough when a customer service rep asks you for one of those over the phone... :)

I do this. I told the CS rep that my password hint was "just random characters mashed on the keyboard" and she accepted this and moved on. I'm not sure what to think of the security implications.

That's what you get when the reps can see the answers. The only working solution is to have the reps "log in" to the users account by entering the security question answer.

If the reps can see the answer, it's far too easy for the attacker to turn the verification process into a game of twenty questions.

Re: NIST’s new password rules – what you need to know

#24

Post by stouset »

josephg wrote: post #20
zwily wrote: post #15

Earlier quoted context omitted.

Those are rough when a customer service rep asks you for one of those over the phone... :)

I do this. I told the CS rep that my password hint was "just random characters mashed on the keyboard" and she accepted this and moved on. I'm not sure what to think of the security implications.

Replying to sibling.

Worse, if reps can see the answer, then this is equivalent to not hashing the passwords at all since you have a password-equivalent stored in plaintext.

Re: NIST’s new password rules – what you need to know

#25

Post by fryguy »

dbg31415 wrote: post #2

8 characters seems very short. I like asking people to pick 4 words and a number. Satisfies the length issues. But... I love emojis and other things being possibilities. Cool.

They shouldn't pick 4 words, it should be randomly chosen for them.

Re: NIST’s new password rules – what you need to know

#26

Post by niftich »

alkonaut wrote: post #23

If SMS isn't a recommended 2FA, do they recommend some other means of 2FA?

Many [1]. Some examples, my comments in parentheses:

- Out-of-Band Authenticators (mobile app over secure channel)

- Single Factor OTP Device (like an OATH push-button, enter 6-digit code TOTP device)

- Single Factor Cryptographic Devices (insert into computer)

(among others)

[1] https://pages.nist.gov/800-63-3/sp800-63b.html#sec5

Re: NIST’s new password rules – what you need to know

#27

Post by Molomby »

derefr wrote: post #10
mylesm wrote: post #7

Looks like some good suggestions: - Glad they're recommending a stop to the pointless "password must be no longer than (16, 20, ...) characters". Aren't you storing a constant-length hash anyway? - Why do some logins restrict which ASCII characters can be used? When I see that I can use any symbol from '%!#&' or whatever list they provide, I can only imagine it's a really naive SQL-injection defense. Is there any val…

> Is there any valid reason for this? If they know that at some point they'll have to ask you to enter your password over a restricted input-method (e.g. on a DTMF keypad.)

Real world example of this "limited input" problem: http://apple.stackexchange.com/questions/202143/i-included-e...

Pre-Touch Bar, of course...

Re: NIST’s new password rules – what you need to know

#28

Post by colanderman »

derefr wrote: post #10
mylesm wrote: post #7

Looks like some good suggestions: - Glad they're recommending a stop to the pointless "password must be no longer than (16, 20, ...) characters". Aren't you storing a constant-length hash anyway? - Why do some logins restrict which ASCII characters can be used? When I see that I can use any symbol from '%!#&' or whatever list they provide, I can only imagine it's a really naive SQL-injection defense. Is there any val…

> Is there any valid reason for this? If they know that at some point they'll have to ask you to enter your password over a restricted input-method (e.g. on a DTMF keypad.)

Yep. FastMail restricts spaces in passwords due to mail clients that do not allow them.

Re: NIST’s new password rules – what you need to know

#29

Post by tveita »

In addition to the standard salting and hashing, they recommend using an additional key stored separately from the data.

> A keyed hash function (e.g., HMAC), with the key stored separately from the hashed authenticators (e.g., in a hardware security module) SHOULD be used to further resist dictionary attacks against the stored hashed authenticators.

I guess using a pepper is a better-than-nothing measure, if you don't have a hardware security module.

Re: NIST’s new password rules – what you need to know

#30

Post by GordonS »

ryanlol wrote: post #22
josephg wrote: post #20

Earlier quoted context omitted.

I do this. I told the CS rep that my password hint was "just random characters mashed on the keyboard" and she accepted this and moved on. I'm not sure what to think of the security implications.

That's what you get when the reps can see the answers. The only working solution is to have the reps "log in" to the users account by entering the security question answer. If the reps can see the answer, it's far too easy for the attacker to turn the verification process into a game of twenty questions.

I've had this before with my bank, when I've had to authorise a large card payment (for a car). I was asked various security questions about monthly recurring payments from my account (in the UK, so standing orders and direct debits), but I've so many I can't keep up, and I change savings accounts and health, car, home, pet insurer every year to get a good deal.

The rep on the phone kept prompting me when I was unsure. She'd mention an amount, then when I was unsure they'd say something like, "maybe it's for your mortgage...? Maybe the company begins with the letter 'N'?"

It was all a bit silly, security theater at its finest.

Post reply on HN