Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NIST’s new password rules – what you need to know

nakedsecurity.sophos.com

Post reply on HN
Print view View original

181–190 of 237 posts

Re: NIST’s new password rules – what you need to know

#181

Post by hollander »

mylesm wrote: post #7

Looks like some good suggestions: - Glad they're recommending a stop to the pointless "password must be no longer than (16, 20, ...) characters". Aren't you storing a constant-length hash anyway? - Why do some logins restrict which ASCII characters can be used? When I see that I can use any symbol from '%!#&' or whatever list they provide, I can only imagine it's a really naive SQL-injection defense. Is there any val…

They should have required proper guiding when creating a new password. I normally use passwords that are like 80 characters long, generated in a password manager. If I paste one of these in a password field, then submit, I get the warning that it's too long. Why didn't it say so when I pasted it? Why put a limit on it below 256 characters? Does that really matter nowadays? It's not a 5MB selfie I'm uploading.

The limitions of the password should be built in the HTML of the form like a regex or something easier.

Re: NIST’s new password rules – what you need to know

#182

Post by hvidgaard »

croon wrote: post #169
hvidgaard wrote: post #146

Earlier quoted context omitted.

Can we really assume 2048 different words? 100 words make up 50% of all words written according to this https://en.wikipedia.org/wiki/Most_common_words_in_English ? I was a bit hasty of the entropy of the passphrase, my mistake. I still stand by that even if we choose from 2048 common words, generating a good passphrase (one that isn't a common sentence) is harder than we think.

I'd go so far as to say that 2048 words aren't that many. Here's Merriam-Websters 3000 _core_ words [1]. Here's a list of 355k words [2]. [1] http://learnersdictionary.com/3000-words [2] https://github.com/dwyl/english-words

There is not 3000 _core_ words. You don't teach elementary school children 3000 words. That list is significanly smaller. In Denmark it's 120 words, then you'll be well on your way to reading and writing most basic stuff.

That someone has selected 2048 words used to generate passphrases, doesn't make it easy to remember.

Re: NIST’s new password rules – what you need to know

#183

Post by hvidgaard »

croon wrote: post #170
hvidgaard wrote: post #158

Earlier quoted context omitted.

A random 5 words is hardly simple or easy to remember. The entire selling point of passphrases is exactly that. It's a hard problem that is IMO best solved with hardware secure keeping of secrets and a rate limited pincode.

You're not supposed to remember all your passwords. You will need to remember at least one master password and maybe a couple more. But you can't suggest that remembering 5 random words is harder than 20 random characters? The goal is "simple" if possible, but "simpler" is still a lot better than "practically impossible".

I'm not suggesting that 20 random characters is easier to remember, but for average Joe, it might as well be the same. Not only do they have to remember the words, the sequence, and how to spell them. Unfortunately we cannot expect this from users in general - the worst offenders write down a password like "rocket", so there is no hope that they'll try to remember a sequence of random words.

We shouldn't have remember passwords at all IMO. It's creating entropy by remembering things, but the human brain is inheritly bad at remembering exact things. Things like a yubikey is a better idea, plug it in, enter your pincode, and use a key pair to authentication. All the user have to do is keep track of the physical thing and the pincode.

Re: NIST’s new password rules – what you need to know

#184

Post by danielpatrick »

ryanar wrote: post #87

I love this. I despise the fact that my bank restricts passwords lengths to max 16 chars, hash lengths are constant, it is ridiculous. It is a BANK, if anything they should be more secure. Instead they force me to make passwords that easily fit a password mask by restricting special characters and forcing at least one number, uppercase letter, etc. They are actually weakening the security in a vain attempt to get peo…

> there have been times my phone was dead and I didnt have a backup plan.

This. Just recently this happened to me when I needed to get into my Gmail and I was shit out of luck. Didn't have my phone on me. The best Gmail would do was some sort of account reset that would take 2+ days (for good reason). I was entirely locked out, no solution short of returning home to get my phone.

Anyone recommend a solid backup plan?

Re: NIST’s new password rules – what you need to know

#185

Post by cdubzzz »

monkeywork wrote: post #147
platz wrote: post #118

Earlier quoted context omitted.

I haven't failed anything. I am not an IT pro. Also it's not just for the account of the terminated person, but for any passwords the terminated person has 'learned' whilst employed.

again if your corp doesn't have a policy for off-boarding employees and removing their access then you've failed. If your corp doesn't have a policy of not having shared accounts then you've failed... if you are forced to have shared accounts then you need to have in your off-boarding policy that anyone who had access (which was a purely need to know basis) once off-boarded would trigger that password change. The poi…

I agree with you in principal, but is also important to remember that policy != practice. For a policy against shared accounts, for example, there is no reasonable way to guarantee that Employee A has not given his password to Fired Employee B.

Re: NIST’s new password rules – what you need to know

#186

Post by pluma »

TorKlingberg wrote: post #168
Freak_NL wrote: post #154

Earlier quoted context omitted.

Yes, my mother's maiden name is Een3oquu+P_a9oez0queiPhaeChaijoh, why do you ask? Ironically, you usually can enter a string as answer to those questions that is more secure than the allowed password.

And then you call phone support and they ask you for it.

"I just entered a string of random characters."

"That is correct. Thank you."

Re: NIST’s new password rules – what you need to know

#187

Post by discreditable »

lucaspiller wrote: post #3

Recommending not expiring based on time is probably my favourite. I've worked at two places where that's been a requirement and my password has always been a passphrase combined with a sequencial number.

I like the rule but enforce a yearly password change in my Windows environment. I'm just a little paranoid about cached credentials living on machines for long periods of time.

Re: NIST’s new password rules – what you need to know

#188

Post by [deleted] »

oneeyedpigeon wrote: post #149
riskable wrote: post #70

The importance of this NIST standard cannot be understated. It has a requirement that passwords be hashed with a random salt ! Microsoft Active Directory does not use salts ! I am trying to imagine the consequences to all the businesses and agencies that must adhere to these standards suddenly coming to the realization that they must replace their Active Directory installations and what that will mean for administeri…

Do those contracts really require adherence to NIST standards, including whatever future changes are made to them? I would have thought they'd be restricted to the guidelines as they are at the time the contract is signed.

[deleted]

Re: NIST’s new password rules – what you need to know

#189

Post by pluma »

ipsin wrote: post #144

I would love to see an explicit recommendation of "no disabling paste" in the NIST standard... so that I can contact companies that do so and drive me nuts. The article implies that disabling paste would run afoul of the NIST standards, but is there actual language I could point to?

I would sure hope so. I managed to convince a company to allow paste in their login form by tweeting them this article: https://www.troyhunt.com/the-cobra-effect-that-is-disabling/

But I doubt most companies would be this reasonable if they have this level of stupid in their password handling.

Re: NIST’s new password rules – what you need to know

#190

Post by woliveirajr »

chris_wot wrote: post #177
sib wrote: post #9

Earlier quoted context omitted.

Nothing better than rules based on bad data and security theater.

My passwords are always surprised or overly enthusiastic. MyPassword123! Soon becomes MyPassword123!! And then as I progress in the company my enthusiasm gets even more hyper MyPassword!!!!!

It's fun to know that almost every requirement usually gets solved by capitalizing the first letter, by prefixing or postfixing the number 1, but using the "!"... and that's what the majority does.
Post reply on HN