Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NIST’s new password rules – what you need to know

nakedsecurity.sophos.com

Post reply on HN
Print view View original

191–200 of 237 posts

Re: NIST’s new password rules – what you need to know

#191

Post by rsanders »

hvidgaard wrote: post #182
croon wrote: post #169

Earlier quoted context omitted.

I'd go so far as to say that 2048 words aren't that many. Here's Merriam-Websters 3000 _core_ words [1]. Here's a list of 355k words [2]. [1] http://learnersdictionary.com/3000-words [2] https://github.com/dwyl/english-words

There is not 3000 _core_ words. You don't teach elementary school children 3000 words. That list is significanly smaller. In Denmark it's 120 words, then you'll be well on your way to reading and writing most basic stuff. That someone has selected 2048 words used to generate passphrases, doesn't make it easy to remember.

I've been doing this for years and it is indeed easier to remember. You won't be keeping all your passwords in your head in any format if you're using a unique password per site or service as you should. But you occasionally have to buffer them mentally between your password manager and the input box (especially on mobile), and the same number of bits of entropy are infinitely easier to copy correctly in this format vs something like "?G[G6n|4".

Re: NIST’s new password rules – what you need to know

#192

Post by failrate »

oneeyedpigeon wrote: post #149
riskable wrote: post #70

The importance of this NIST standard cannot be understated. It has a requirement that passwords be hashed with a random salt ! Microsoft Active Directory does not use salts ! I am trying to imagine the consequences to all the businesses and agencies that must adhere to these standards suddenly coming to the realization that they must replace their Active Directory installations and what that will mean for administeri…

Do those contracts really require adherence to NIST standards, including whatever future changes are made to them? I would have thought they'd be restricted to the guidelines as they are at the time the contract is signed.

You typically have to renew every few years for DoD.

Re: NIST’s new password rules – what you need to know

#193

Post by [deleted] »

oneeyedpigeon wrote: post #149
riskable wrote: post #70

The importance of this NIST standard cannot be understated. It has a requirement that passwords be hashed with a random salt ! Microsoft Active Directory does not use salts ! I am trying to imagine the consequences to all the businesses and agencies that must adhere to these standards suddenly coming to the realization that they must replace their Active Directory installations and what that will mean for administeri…

Do those contracts really require adherence to NIST standards, including whatever future changes are made to them? I would have thought they'd be restricted to the guidelines as they are at the time the contract is signed.

[deleted]

Re: NIST’s new password rules – what you need to know

#194

Post by aangjie »

hvidgaard wrote: post #182
croon wrote: post #169

Earlier quoted context omitted.

I'd go so far as to say that 2048 words aren't that many. Here's Merriam-Websters 3000 _core_ words [1]. Here's a list of 355k words [2]. [1] http://learnersdictionary.com/3000-words [2] https://github.com/dwyl/english-words

There is not 3000 _core_ words. You don't teach elementary school children 3000 words. That list is significanly smaller. In Denmark it's 120 words, then you'll be well on your way to reading and writing most basic stuff. That someone has selected 2048 words used to generate passphrases, doesn't make it easy to remember.

Err.. I would suspect most(non-english?) people on the internet to know 2000 words. (By virtue of being atleast bi-lingual, they would, so the challenge boils down to can they type it? unicode support should help, but I've found most cases people simply type those sounds in English.) As for the English as a primary language people, I've no clue about the number of words, but if we can expect them to type 1024 words, we'd still get 20 bits..

Re: NIST’s new password rules – what you need to know

#195

Post by iamatworknow »

mjevans wrote: post #171
hvidgaard wrote: post #146

Earlier quoted context omitted.

Can we really assume 2048 different words? 100 words make up 50% of all words written according to this https://en.wikipedia.org/wiki/Most_common_words_in_English ? I was a bit hasty of the entropy of the passphrase, my mistake. I still stand by that even if we choose from 2048 common words, generating a good passphrase (one that isn't a common sentence) is harder than we think.

You can if it's a computer picking the password from presumably common words. If the human is picking anything than there WILL be a bias in selection. Effort should be made at minimizing that, but even with education this is a difficult task for any worker. It got to the point where I actually took a classic literary work and made a 'password words' dictionary from it just so that I could have the computer generate p…

I've been pretty happy using diceware[0] for my word-based passwords. Just be sure to use actual dice and not a software based random number generator if you want it to be truly random.

[0]http://world.std.com/~reinhold/diceware.html

Re: NIST’s new password rules – what you need to know

#197

Post by a-priori »

TorKlingberg wrote: post #168
Freak_NL wrote: post #154

Earlier quoted context omitted.

Yes, my mother's maiden name is Een3oquu+P_a9oez0queiPhaeChaijoh, why do you ask? Ironically, you usually can enter a string as answer to those questions that is more secure than the allowed password.

And then you call phone support and they ask you for it.

I actually had this happen once. The conversation went something like this:

Them: "I need to ask you a few security questions. What's your mother's, uh... mother's maiden name?"

Me: "Oh yes, I put a bunch of random letters and numbers there, let me pull that up for you... A Q 1 #..."

T: "... That's okay thanks. Next question: what street did you grow up on?"

M: "Same deal there?"

T: "Yeah, we're done."

I got the feeling the support agent had never seen someone do this before and thought I was crazy.

Re: NIST’s new password rules – what you need to know

#198

Post by iamatworknow »

lucaspiller wrote: post #3

Recommending not expiring based on time is probably my favourite. I've worked at two places where that's been a requirement and my password has always been a passphrase combined with a sequencial number.

I'm guilty of this as well. Just a week or two ago I went up to 23. Adding one for the first period when I had no number on the password, (90 * 24)/365.25 = 5.91 years

I started the first week of December, 2010.

Re: NIST’s new password rules – what you need to know

#199

Post by slavik81 »

hvidgaard wrote: post #182
croon wrote: post #169

Earlier quoted context omitted.

I'd go so far as to say that 2048 words aren't that many. Here's Merriam-Websters 3000 _core_ words [1]. Here's a list of 355k words [2]. [1] http://learnersdictionary.com/3000-words [2] https://github.com/dwyl/english-words

There is not 3000 _core_ words. You don't teach elementary school children 3000 words. That list is significanly smaller. In Denmark it's 120 words, then you'll be well on your way to reading and writing most basic stuff. That someone has selected 2048 words used to generate passphrases, doesn't make it easy to remember.

"Average native test-takers of age 4 already know 5,000 words."

http://www.economist.com/blogs/johnson/2013/05/vocabulary-si...

Re: NIST’s new password rules – what you need to know

#200

Post by kevhito »

hvidgaard wrote: post #146
whiteandnerdy wrote: post #138

Earlier quoted context omitted.

I think XKCD is correct here. If you choose four random words from a list of 2048 common words, and your attacker knows that's what you're doing, then your entropy is 4 * log_2(2048) = 44 bits. If the attacker didn't know your strategy and tried to brute force letter by letter it would be much higher - around 4 8 log_2(26)=150 bits assuming around eight letters per word - but like you said, we should assume the attac…

Can we really assume 2048 different words? 100 words make up 50% of all words written according to this https://en.wikipedia.org/wiki/Most_common_words_in_English ? I was a bit hasty of the entropy of the passphrase, my mistake. I still stand by that even if we choose from 2048 common words, generating a good passphrase (one that isn't a common sentence) is harder than we think.

Yes, 2048 is tiny. I've been using a 4096-word dictionary I found online for years, along with my family and two kids since they were about 6 years old. There is absolutely no trouble with a 4096 word dictionary. Yes, they (and me too) sometimes bump into words we don't recognize, but it's not that common.

Here, I just generated you a few passwords:

* hefty march attempt force bowel scuff

* between sepia book sweat lemma saint

* safe warn magical cask hefty wish

* alum glib puck adieu dour lazy

* telephone pine cavort good knee swank

* numeral plan jewel conch slate tube

* pastry piano sure proxy unit brew

* trig rise taint current sans gallop

Here is the same random numbers but encoded into ascii instead of words:

* 81Pk3t?Rq6S}

* ]CPcYrT^?iE3

* +qV`J9ZU&.,C

* `>sp=~V);3g>

* E&_ff7a|Z4B[

* ?OX~[J>0K'S*

These each have the exact same amount of entropy as the word-based ones.

Post reply on HN