Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NIST’s new password rules – what you need to know

nakedsecurity.sophos.com

Post reply on HN
Print view View original

51–60 of 237 posts

Re: NIST’s new password rules – what you need to know

#51

Post by mark-r »

freehunter wrote: post #35
sp332 wrote: post #11

Earlier quoted context omitted.

If your password is compromised, it will only work until the next reset. That's better than having one that works for years.

Unless you can only change on a pre-defined interval, the attacker can always change your password for you to avoid being locked out. I don't know many users who would complain their their password seemingly never expired.

These are often combined with a requirement to not reuse some number of recent passwords, so the attacker can't change the password right back again. When you can't log in then your password will be reset and they've lost access.

Re: NIST’s new password rules – what you need to know

#52

Post by kevhito »

mrmagooey wrote: post #43

Aren't passphrases kind of a bad choice for passwords? If all you are ever really guessing is the symbols that make up someones password, and you know that for example they have 4 words that make the passphrase, then you effectively only have to iterate 4 symbols with a known list of possibilities for each symbol (i.e. the dictionary). If you compare the permutation space of a short passwords (length 7) with random c…

Everything in the article is spot on, I only wish they went further and recommended passphrases more strongly. It's correct horse battery staple and all that.

As for your calculation, you are about right. Except memorizing a completely random 8 character password drawn from an 80 symbol alphabet is /extremely/ unpleasant for most people, especially when you may have a few different passwords you use on a daily or weekly basis. And for passphrases, 6 words drawn from a 4096-word dictionary is typical. I use that setting (or even 8 words for more important things) and have easily memorized about a dozen passwords, even ones I use only once every few weeks.

40966 = 4.7e21, about the same as an 11-character random password.

Re: NIST’s new password rules – what you need to know

#53

Post by foxylad »

freehunter wrote: post #46
niftich wrote: post #26

Earlier quoted context omitted.

Many [1]. Some examples, my comments in parentheses: - Out-of-Band Authenticators (mobile app over secure channel) - Single Factor OTP Device (like an OATH push-button, enter 6-digit code TOTP device) - Single Factor Cryptographic Devices (insert into computer) (among others) [1] https://pages.nist.gov/800-63-3/sp800-63b.html#sec5

Which is a real shame. SMS might not be perfect, but it's a real help when I don't have a better means handy. Its better than no 2FA, and it's saved my butt a few times when I get a text message saying "Here is your login code" and I'm out walking in the park. I get a new phone every year, and Google Authenticator sucks for that, but it's by far the second most common 2FA provider. I just got a new phone today, and h…

I got a U2F key, which neatly solves the problem as long as you have a USB port. The integration into the browser makes it painless and fast to use.

Adding bluetooth to work with mobile devices would make it a complete solution.

Edit: corrected U2FA to U2F.

Re: NIST’s new password rules – what you need to know

#54

Post by mrmagooey »

mark-r wrote: post #50
mrmagooey wrote: post #43

Aren't passphrases kind of a bad choice for passwords? If all you are ever really guessing is the symbols that make up someones password, and you know that for example they have 4 words that make the passphrase, then you effectively only have to iterate 4 symbols with a known list of possibilities for each symbol (i.e. the dictionary). If you compare the permutation space of a short passwords (length 7) with random c…

How do you know how many words are in the passphrase?

You don't I guess, I'm just using 4 as an example (it's also the number of words used in xkcd's password strength comic).

Re: NIST’s new password rules – what you need to know

#55

Post by kderbe »

mrmagooey wrote: post #43

Aren't passphrases kind of a bad choice for passwords? If all you are ever really guessing is the symbols that make up someones password, and you know that for example they have 4 words that make the passphrase, then you effectively only have to iterate 4 symbols with a known list of possibilities for each symbol (i.e. the dictionary). If you compare the permutation space of a short passwords (length 7) with random c…

Yes, 80 ^ 7 has the same order of magnitude as 3000 ^ 4. But passphrases are recommended because many folks can memorize a passphrase more easily than a password of equivalent complexity. Or because a typical user's idea of an okay password ("Johnny88") has less entropy than a passphrase.

Passphrases are unnecessary for users with a password manager, except maybe for the manager's master password.

Re: NIST’s new password rules – what you need to know

#56

Post by foxylad »

bahmboo wrote: post #37

Password strength is meaningless when the password can be reset via an email provider that allows weak passwords.

True. Google does a good job here - they support U2F (and other password hardening techniques), and additionally report any access from a new device. You do have to opt in to these measures, but at least they are available.

Re: NIST’s new password rules – what you need to know

#57

Post by kibwen »

colanderman wrote: post #28
derefr wrote: post #10

Earlier quoted context omitted.

> Is there any valid reason for this? If they know that at some point they'll have to ask you to enter your password over a restricted input-method (e.g. on a DTMF keypad.)

Yep. FastMail restricts spaces in passwords due to mail clients that do not allow them.

Which clients specifically?

Re: NIST’s new password rules – what you need to know

#59

Post by 1_2__3 »

mylesm wrote: post #7

Looks like some good suggestions: - Glad they're recommending a stop to the pointless "password must be no longer than (16, 20, ...) characters". Aren't you storing a constant-length hash anyway? - Why do some logins restrict which ASCII characters can be used? When I see that I can use any symbol from '%!#&' or whatever list they provide, I can only imagine it's a really naive SQL-injection defense. Is there any val…

My suggestion: use a nonsense answer and use it for all of them. I don't reuse passwords but for exactly the reasons you state the answer to all my security challenges is something like "Because a kipper doesn't red the blue."

Alternately have a few nonsense phrases for stock challenge questions (first car, first pet, favorite , etc.) It's better than using the real (googleable) answer.

Finally, as Dale Carnegie would have loved: the more absurd it is the easier it is to remember. So while you won't remember if your favorite movie is the matrix or titanic, but you WOULD remember "I clocked blithely cookie everywhere." as the answer when you see that question.

Re: NIST’s new password rules – what you need to know

#60

Post by syntheticnature »

DenisM wrote: post #42
syntheticnature wrote: post #31

Earlier quoted context omitted.

At which point, they hit reset password (either on that page, or on successive logins) until they get four words that stick trivially... because they're a normal sentence.

Slow them down?

To bend a cliche, users interpret things in their way as damage and route around it.
Post reply on HN