161–170 of 237 posts
We want to know what compliance levels apply for the above rule in an enterprise product. Anyone knows where I can find compliance levels for Products targeted for Enterprise customers ?
Aren't passphrases kind of a bad choice for passwords? If all you are ever really guessing is the symbols that make up someones password, and you know that for example they have 4 words that make the passphrase, then you effectively only have to iterate 4 symbols with a known list of possibilities for each symbol (i.e. the dictionary). If you compare the permutation space of a short passwords (length 7) with random c…
What we should really talk about is the password entropy like what you've done. If you take the xkcdpass package from Ubuntu, it uses a word list of 41230 words by default [1]. That's 41230^4 and about 61-bit of password entropy. If you want to use a smaller word list, add words to the passphrase until you reach a desirable password entropy. Using your example of 80^7 for random characters, that's only 44-bit passwor…
Isn't it far easier to up the entropy of a passphrase, though? Unless your password is using the entire Unicode character set, adding a word to a passphrase is going to give you better entropy than adding a character to a password, and it will probably be easier to remember since you can - reasonably safely - give it contextual meaning.
> Applications must allow all printable ASCII characters, including spaces, and should accept all UNICODE characters, too, including emoji! Man, I predict a world of hurt here. Maybe it'll be okay if the standards also very prominently tell you you've got to unicode normalize before hashing, and tell you what normalization form to use (NFC I think?). Too many platforms/environments still don't have handy access to un…
Earlier quoted context omitted.
" I know Google is planning on dinging sites that don't use HTTPS, is it possible they could ding sites for poor password policies?" How they gonna do that? Do you expect Google to audit every site in their search ranks?
The same way to index websites: with web-spiders. They would need to write new code for this though. Also for HTTPS they also had to write new code.
Earlier quoted context omitted.
If you allow unlimited length, that a DoS attack. Ask the devs at Django
For which they set a 4K limit on password length. I think even the commenter you replied to would find that satisfactory, being much more than 64 characters.
Of course, one day, a 64-character password will be brute-forceable in milliseconds, but we hopefully won't still be having this discussion by then!
How the f@@@ on the year 2016 we have a 64 character max length password requirement!!
If you allow unlimited length, that a DoS attack. Ask the devs at Django
> Knowledge-based authentication (KBA) is out. All the rules are great, but this one might be my favorite. Every time I faced a list of KBAs I felt like I was trapped in UCB's comedy sketch: https://www.youtube.com/watch?v=tMEjpXJZgIA (If a common security device is bad enough for a comedy troupe to have a bit on it, maybe it could use some work.) The worst KBAs I've seen are for United's frequent flyer program. Almo…
Yes, my mother's maiden name is Een3oquu+P_a9oez0queiPhaeChaijoh, why do you ask? Ironically, you usually can enter a string as answer to those questions that is more secure than the allowed password.
If you happen to have a favorite vegetable, but it's, say, the daikon, you're out of luck.
> Knowledge-based authentication (KBA) is out. All the rules are great, but this one might be my favorite. Every time I faced a list of KBAs I felt like I was trapped in UCB's comedy sketch: https://www.youtube.com/watch?v=tMEjpXJZgIA (If a common security device is bad enough for a comedy troupe to have a bit on it, maybe it could use some work.) The worst KBAs I've seen are for United's frequent flyer program. Almo…
Yes, my mother's maiden name is Een3oquu+P_a9oez0queiPhaeChaijoh, why do you ask? Ironically, you usually can enter a string as answer to those questions that is more secure than the allowed password.
Earlier quoted context omitted.
I think XKCD is correct here. If you choose four random words from a list of 2048 common words, and your attacker knows that's what you're doing, then your entropy is 4 * log_2(2048) = 44 bits. If the attacker didn't know your strategy and tried to brute force letter by letter it would be much higher - around 4 8 log_2(26)=150 bits assuming around eight letters per word - but like you said, we should assume the attac…
Can we really assume 2048 different words? 100 words make up 50% of all words written according to this https://en.wikipedia.org/wiki/Most_common_words_in_English ? I was a bit hasty of the entropy of the passphrase, my mistake. I still stand by that even if we choose from 2048 common words, generating a good passphrase (one that isn't a common sentence) is harder than we think.
Here's Merriam-Websters 3000 _core_ words [1]. Here's a list of 355k words [2].
Earlier quoted context omitted.
The intention is that the random words are selected from a list of 2000 unique, common words. Choosing a sentence is a different strategy, which is less secure. $ wget -O ⅓Mwords http://norvig.com/ngrams/count_1w.txt $ for i in `seq 10`; awk '/^[a-z]{3,}/ { print $1 }' ⅓Mwords | head -n 2000 | shuf -n 5 | tr '\n' ' ' && echo videos possible disease maintenance chair teen documents than without son research interface…
A random 5 words is hardly simple or easy to remember. The entire selling point of passphrases is exactly that. It's a hard problem that is IMO best solved with hardware secure keeping of secrets and a rate limited pincode.
But you can't suggest that remembering 5 random words is harder than 20 random characters?
The goal is "simple" if possible, but "simpler" is still a lot better than "practically impossible".