The don'ts list is pretty much a christmas present from NIST. I hate all of those things. Worst is the stupid security questions.
NIST’s new password rules – what you need to know
41–50 of 237 posts
Re: NIST’s new password rules – what you need to know
#42Earlier quoted context omitted.
They shouldn't pick 4 words, it should be randomly chosen for them.
At which point, they hit reset password (either on that page, or on successive logins) until they get four words that stick trivially... because they're a normal sentence.
Slow them down?
Re: NIST’s new password rules – what you need to know
#43Aren't passphrases kind of a bad choice for passwords? If all you are ever really guessing is the symbols that make up someones password, and you know that for example they have 4 words that make the passphrase, then you effectively only have to iterate 4 symbols with a known list of possibilities for each symbol (i.e. the dictionary).
If you compare the permutation space of a short passwords (length 7) with random characters (say ~80 potential symbols), with a long(er) password made up of 4 english words (say ~3000 potential symbols, the most commonly used english words).
character_symbols = 80
word_symbols = 3000
number_of_character_password_symbols = 7
number_of_word_password_symbols = 4
permutation_space_characters = character_symbols**number_of_character_password_symbols
permutation_space_words = word_symbols**number_of_word_password_symbols
print('%.2E' % permutation_space_characters, '%.2E' % permutation_space_words)
('2.10E+13', '8.10E+13')
I do love the recommendation to remove time-based password expiry though.
Re: NIST’s new password rules – what you need to know
#44Glad to see the knowledge based questions are being phased out, many are sadly answerable with a cursory search query or leaked in previous breaches.
I didn't see anything in there about security images/indicators, which have also been shown to be ineffective: "was this bank the image of the man snowboarding, or the woman skiing...?"
Re: NIST’s new password rules – what you need to know
#45Earlier quoted context omitted.
If your password is compromised, it will only work until the next reset. That's better than having one that works for years.
That's true, but I'm having hard time thinking of a use case where a sustained, hidden compromise is 'worse' than a one-time compromise. I mean, I guess they could login to your bank every week and transfer out $50 instead of just transferring out all your money on day 1, but... ?
There are quite a few scenarios where a sustained, hidden compromise is an (or several) order of magnitude worse than a one time obvious compromise.
The first to come to mind is a corporate espionage scenario. Do you want to know what your competitor is up to today, or do you want access to their briefings/CAD/code for the next 12 months? Long duration compromises also allow you to slip data out slowly, so a NAS doesn't show 200GB being transferred off in a matter of hours, but a slow drip of 100MB a day.
At a personal/home use level, long term access to a bank account allows an attacker to build up a spending profile, which depending on your habits, could be used for blackmail.
Re: NIST’s new password rules – what you need to know
#46If SMS isn't a recommended 2FA, do they recommend some other means of 2FA?
Many [1]. Some examples, my comments in parentheses: - Out-of-Band Authenticators (mobile app over secure channel) - Single Factor OTP Device (like an OATH push-button, enter 6-digit code TOTP device) - Single Factor Cryptographic Devices (insert into computer) (among others) [1] https://pages.nist.gov/800-63-3/sp800-63b.html#sec5
Which is a real shame. SMS might not be perfect, but it's a real help when I don't have a better means handy. Its better than no 2FA, and it's saved my butt a few times when I get a text message saying "Here is your login code" and I'm out walking in the park.
I get a new phone every year, and Google Authenticator sucks for that, but it's by far the second most common 2FA provider. I just got a new phone today, and had to go disable 2FA on all my accounts then re-enable it to generate a new code. SMS is always a good fallback in my experience.
Re: NIST’s new password rules – what you need to know
#47Looks like some good suggestions: - Glad they're recommending a stop to the pointless "password must be no longer than (16, 20, ...) characters". Aren't you storing a constant-length hash anyway? - Why do some logins restrict which ASCII characters can be used? When I see that I can use any symbol from '%!#&' or whatever list they provide, I can only imagine it's a really naive SQL-injection defense. Is there any val…
I just use the security questions as another password, like my favorite color is JyQ|l[Duc-I6KrU-0k and I went to elementary school at ?YfBW+Yurh@m$lml":.
Some systems allow entering your own security question and answer, in which case my security question is always "What's the other password?".
Re: NIST’s new password rules – what you need to know
#48Earlier quoted context omitted.
I do this. I told the CS rep that my password hint was "just random characters mashed on the keyboard" and she accepted this and moved on. I'm not sure what to think of the security implications.
Replying to sibling. Worse, if reps can see the answer, then this is equivalent to not hashing the passwords at all since you have a password-equivalent stored in plaintext.
FYI, if you click on the minutes ago link above the post you can get a reply box even on new posts.
When I worked for t-mobile it was last 4 of the social unless the customer requests otherwise.
Few requested otherwise, and usually it was because they were annoyed about people being able to see part of their SSN.
Re: NIST’s new password rules – what you need to know
#49Earlier quoted context omitted.
Many [1]. Some examples, my comments in parentheses: - Out-of-Band Authenticators (mobile app over secure channel) - Single Factor OTP Device (like an OATH push-button, enter 6-digit code TOTP device) - Single Factor Cryptographic Devices (insert into computer) (among others) [1] https://pages.nist.gov/800-63-3/sp800-63b.html#sec5
Which is a real shame. SMS might not be perfect, but it's a real help when I don't have a better means handy. Its better than no 2FA, and it's saved my butt a few times when I get a text message saying "Here is your login code" and I'm out walking in the park. I get a new phone every year, and Google Authenticator sucks for that, but it's by far the second most common 2FA provider. I just got a new phone today, and h…
> SMS might not be perfect, but it's a real help when I don't have a better means handy. Its better than no 2FA
If used exclusively as a second factor, yes, it's better than nothing. However, many systems also allow you to use a phone as a password recovery system, which makes it much worse than no 2FA. Many people have had every account they own broken into, starting with a social-engineering call to their cell service to get their number moved to a new SIM/phone, followed by a reset of their email, followed by a reset of everything else.
Re: NIST’s new password rules – what you need to know
#50Aren't passphrases kind of a bad choice for passwords? If all you are ever really guessing is the symbols that make up someones password, and you know that for example they have 4 words that make the passphrase, then you effectively only have to iterate 4 symbols with a known list of possibilities for each symbol (i.e. the dictionary). If you compare the permutation space of a short passwords (length 7) with random c…
How do you know how many words are in the passphrase?