NIST’s new password rules – what you need to know • Hacker News Board

Re: NIST’s new password rules – what you need to know

#141

Post by jejeuhds » Wed, Nov 23, 2016, 7:40 AM UTC

hvidgaard wrote: post #132

tracker1 wrote: post #113

Earlier quoted context omitted.

It's been longer than 10 years, and known for quite some time by most.. The xkcd article is over 5yo itself, and a lot of people pushed for more open passwords for ages... I do one controversial think and that's trim password imput (mainly because of trailing whitespace selection in some apps/oses). Other than that, if you can input it, you can use it... though now doing some unicode normalization for unity combos is…

That comic is unfortunately not telling the truth. The password phrase IS 44 bits of entropy, assuming you input random ascii. But any reasonably knowledgeable person trying to crack passwords, will use a dictionary to create a passphrases, rendering this less useful than the first password. Even if you do substitute o/0/ø, i/l/1, a/4, ect randomly. You still need a rather long sentence, and preferably spice it up wi…

No, you are wrong. The number of bits of entropy in "horsestaple..." is estimated by assuming the words where chosen at random from the 2^11=2048 most common words. 4*11=44 bits in total. In practice it is even better since a hacker would also try different kinds of passwords! So no, you do not need substitute characters.

Re: NIST’s new password rules – what you need to know

#142

Post by tzs » Wed, Nov 23, 2016, 7:45 AM UTC

adrr wrote: post #4

lucaspiller wrote: post #3

Recommending not expiring based on time is probably my favourite. I've worked at two places where that's been a requirement and my password has always been a passphrase combined with a sequencial number.

PCI compliance requires quarterly rotation of passwords and keys.

Where does it require quarterly rotation? I'm not seeing any specific time limit in the PCI DSS, but I could have overlooked it.

Re: NIST’s new password rules – what you need to know

#143

Post by ketzu » Wed, Nov 23, 2016, 7:47 AM UTC

hvidgaard wrote: post #132

tracker1 wrote: post #113

Earlier quoted context omitted.

It's been longer than 10 years, and known for quite some time by most.. The xkcd article is over 5yo itself, and a lot of people pushed for more open passwords for ages... I do one controversial think and that's trim password imput (mainly because of trailing whitespace selection in some apps/oses). Other than that, if you can input it, you can use it... though now doing some unicode normalization for unity combos is…

That comic is unfortunately not telling the truth. The password phrase IS 44 bits of entropy, assuming you input random ascii. But any reasonably knowledgeable person trying to crack passwords, will use a dictionary to create a passphrases, rendering this less useful than the first password. Even if you do substitute o/0/ø, i/l/1, a/4, ect randomly. You still need a rather long sentence, and preferably spice it up wi…

I think you failed to think that through. Random alphanumeric input of that length would be 25log(36)=525=125 bits. It is 11 bits per word because it is chosen from a ~2000 words dictionary.

Edit: should have reloaded, said by enough people already :D

Re: NIST’s new password rules – what you need to know

#144

Post by ipsin » Wed, Nov 23, 2016, 7:48 AM UTC

I would love to see an explicit recommendation of "no disabling paste" in the NIST standard... so that I can contact companies that do so and drive me nuts. The article implies that disabling paste would run afoul of the NIST standards, but is there actual language I could point to?

Re: NIST’s new password rules – what you need to know

#145

Post by monkeywork » Wed, Nov 23, 2016, 7:51 AM UTC

adrr wrote: post #4

lucaspiller wrote: post #3

Recommending not expiring based on time is probably my favourite. I've worked at two places where that's been a requirement and my password has always been a passphrase combined with a sequencial number.

PCI compliance requires quarterly rotation of passwords and keys.

I thought PCI compliance required you to follow A standard (they didn't dictate which one) as long as it was a recognized industry standard and you were consistent with it. NIST would qualify...

Re: NIST’s new password rules – what you need to know

#146

Post by hvidgaard » Wed, Nov 23, 2016, 7:59 AM UTC

whiteandnerdy wrote: post #138

hvidgaard wrote: post #132

Earlier quoted context omitted.

That comic is unfortunately not telling the truth. The password phrase IS 44 bits of entropy, assuming you input random ascii. But any reasonably knowledgeable person trying to crack passwords, will use a dictionary to create a passphrases, rendering this less useful than the first password. Even if you do substitute o/0/ø, i/l/1, a/4, ect randomly. You still need a rather long sentence, and preferably spice it up wi…

I think XKCD is correct here. If you choose four random words from a list of 2048 common words, and your attacker knows that's what you're doing, then your entropy is 4 * log_2(2048) = 44 bits. If the attacker didn't know your strategy and tried to brute force letter by letter it would be much higher - around 4 8 log_2(26)=150 bits assuming around eight letters per word - but like you said, we should assume the attac…

Can we really assume 2048 different words? 100 words make up 50% of all words written according to this https://en.wikipedia.org/wiki/Most_common_words_in_English ?

I was a bit hasty of the entropy of the passphrase, my mistake. I still stand by that even if we choose from 2048 common words, generating a good passphrase (one that isn't a common sentence) is harder than we think.

Re: NIST’s new password rules – what you need to know

#147

Post by monkeywork » Wed, Nov 23, 2016, 8:00 AM UTC

platz wrote: post #118

tracker1 wrote: post #115

Earlier quoted context omitted.

Then you've already failed my not having a plan to disable accounts

I haven't failed anything. I am not an IT pro. Also it's not just for the account of the terminated person, but for any passwords the terminated person has 'learned' whilst employed.

again if your corp doesn't have a policy for off-boarding employees and removing their access then you've failed. If your corp doesn't have a policy of not having shared accounts then you've failed... if you are forced to have shared accounts then you need to have in your off-boarding policy that anyone who had access (which was a purely need to know basis) once off-boarded would trigger that password change.

The point being that what you are seeing as benefits of password expiration are better achieved with proper polices that management and HR operate under... while password expiration may in some ways help you achieve your goal in a lazy manner it also opens you to ALL your employee's using weaker passwords and giving you way more attack points than the off chance that someone decides to not follow the policies you established above.

Also none of those policies require an "IT pro" ... implementing them might, but understanding the goal of the policy and putting them into place is something any good management team should be able to accomplish.

Re: NIST’s new password rules – what you need to know

#148

Post by hvidgaard » Wed, Nov 23, 2016, 8:04 AM UTC

jejeuhds wrote: post #141

hvidgaard wrote: post #132

Earlier quoted context omitted.

That comic is unfortunately not telling the truth. The password phrase IS 44 bits of entropy, assuming you input random ascii. But any reasonably knowledgeable person trying to crack passwords, will use a dictionary to create a passphrases, rendering this less useful than the first password. Even if you do substitute o/0/ø, i/l/1, a/4, ect randomly. You still need a rather long sentence, and preferably spice it up wi…

No, you are wrong. The number of bits of entropy in "horsestaple..." is estimated by assuming the words where chosen at random from the 2^11=2048 most common words. 4*11=44 bits in total. In practice it is even better since a hacker would also try different kinds of passwords! So no, you do not need substitute characters.

Yes, I was wrong about the entropy when writing that. But I still don't think that passphrases are as godsend as the comic make it seem. Can we really assume 2048 common words? The 100 most commonly used, make up 50% of written words.

A common sentence like "I drove to the mall yesterday" is not a good passphrase, but I'm certain that people who use "rocket" as a password would do something similar.

Re: NIST’s new password rules – what you need to know

#149

Post by oneeyedpigeon » Wed, Nov 23, 2016, 8:13 AM UTC

riskable wrote: post #70

The importance of this NIST standard cannot be understated. It has a requirement that passwords be hashed with a random salt ! Microsoft Active Directory does not use salts ! I am trying to imagine the consequences to all the businesses and agencies that must adhere to these standards suddenly coming to the realization that they must replace their Active Directory installations and what that will mean for administeri…

Do those contracts really require adherence to NIST standards, including whatever future changes are made to them? I would have thought they'd be restricted to the guidelines as they are at the time the contract is signed.

Re: NIST’s new password rules – what you need to know

#150

Post by nitrogen » Wed, Nov 23, 2016, 8:15 AM UTC

phire wrote: post #122

nitrogen wrote: post #18

Earlier quoted context omitted.

If your password is compromised, you've already lost. Since password rotation policies incentivize weak passwords, they are more likely to result in a compromised password. Thus, password rotation with weak passwords is not better than a single strong password that is never rotated.

Now that I think about it "Don't worry about detecting attackers, they will get kicked out when we next rotate passwords" is not an attitude you want anyone to develop.

Plus, chances are pretty good that if they compromised one password undetected, they can compromise the next one in the same way (spear phishing, malware, etc.).