Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NIST’s new password rules – what you need to know

nakedsecurity.sophos.com

Post reply on HN
Print view View original

231–237 of 237 posts

Re: NIST’s new password rules – what you need to know

#231

Post by tripzilch »

hvidgaard wrote: post #158
Symbiote wrote: post #156

Earlier quoted context omitted.

The intention is that the random words are selected from a list of 2000 unique, common words. Choosing a sentence is a different strategy, which is less secure. $ wget -O ⅓Mwords http://norvig.com/ngrams/count_1w.txt $ for i in `seq 10`; awk '/^[a-z]{3,}/ { print $1 }' ⅓Mwords | head -n 2000 | shuf -n 5 | tr '\n' ' ' && echo videos possible disease maintenance chair teen documents than without son research interface…

A random 5 words is hardly simple or easy to remember. The entire selling point of passphrases is exactly that. It's a hard problem that is IMO best solved with hardware secure keeping of secrets and a rate limited pincode.

> A random 5 words is hardly simple or easy to remember

You use well-known the mnemonic trick demonstrated in the last panel of the comic.

Re: NIST’s new password rules – what you need to know

#232

Post by dspillett »

jrochkind1 wrote: post #83
riskable wrote: post #70

The importance of this NIST standard cannot be understated. It has a requirement that passwords be hashed with a random salt ! Microsoft Active Directory does not use salts ! I am trying to imagine the consequences to all the businesses and agencies that must adhere to these standards suddenly coming to the realization that they must replace their Active Directory installations and what that will mean for administeri…

Presumably Microsoft would add a salt before losing all that business. Perhaps only if you turn on special NIST-mode, in the way of microsoft and backwards compatibility. It might break some functionality, but probably not as much as moving to an entirely different product if you have things written against MS APIs.

> Perhaps only if you turn on special NIST-mode

That is pretty much how they worked the Posix compliance requirement for government/forces use for NT/2000: the API was available through an optional (and IIRC not quite complete) module that very few ever turned on even where it was a contractual requirement that it be present.

The option you suggest could be present but no doubt not be in use by many people because extension-X, third-party-app-Y, or internal-automation-subsystem-Z, or some feature of AD itself, would break.

Re: NIST’s new password rules – what you need to know

#233

Post by jdc0589 »

riskable wrote: post #70

The importance of this NIST standard cannot be understated. It has a requirement that passwords be hashed with a random salt ! Microsoft Active Directory does not use salts ! I am trying to imagine the consequences to all the businesses and agencies that must adhere to these standards suddenly coming to the realization that they must replace their Active Directory installations and what that will mean for administeri…

additionally, there are rumors (maybe more than that now) that the next round of HIPAA/HITECH /etc... regulations are going to adopt a lot of NIST standards and frameworks. So, this could potentially trickle down to the Healthcare industry.

Re: NIST’s new password rules – what you need to know

#234

Post by foxylad »

nickik wrote: post #78
foxylad wrote: post #53

Earlier quoted context omitted.

I got a U2F key, which neatly solves the problem as long as you have a USB port. The integration into the browser makes it painless and fast to use. Adding bluetooth to work with mobile devices would make it a complete solution. Edit: corrected U2FA to U2F.

How does a U2F key help you? Most places don't support U2F. Bluetooth and NFC are standardized, and the first products are out. I really hope U2F and UAF are gone 'make it' in the market.

I think it's crucial for Gmail, because the popularity of email-based verification means that if you lose your email account you lose everything. Including the presidency, in John Podesta's case!

I also use it for Bitbucket and Githib, but I take your point and also hope it becomes a widespread standard.

Re: NIST’s new password rules – what you need to know

#235

Post by hvidgaard »

slavik81 wrote: post #199
hvidgaard wrote: post #182

Earlier quoted context omitted.

There is not 3000 _core_ words. You don't teach elementary school children 3000 words. That list is significanly smaller. In Denmark it's 120 words, then you'll be well on your way to reading and writing most basic stuff. That someone has selected 2048 words used to generate passphrases, doesn't make it easy to remember.

"Average native test-takers of age 4 already know 5,000 words." http://www.economist.com/blogs/johnson/2013/05/vocabulary-si...

Know and ability to spell are two completely different things.

Re: NIST’s new password rules – what you need to know

#236

Post by hvidgaard »

leshow wrote: post #205
hvidgaard wrote: post #148

Earlier quoted context omitted.

Yes, I was wrong about the entropy when writing that. But I still don't think that passphrases are as godsend as the comic make it seem. Can we really assume 2048 common words? The 100 most commonly used, make up 50% of written words. A common sentence like "I drove to the mall yesterday" is not a good passphrase, but I'm certain that people who use "rocket" as a password would do something similar.

the idea is you use a mnemonic generator to pick the words. The fact that "100 most commonly used, make up 50% of written words" (a dubious statistic, source?) is irrelevant. Here's a mnemonic generator I wrote in Rust https://github.com/leshow/rust_mnemonic for example

> The fact that "100 most commonly used, make up 50% of written words" (a dubious statistic, source?) is irrelevant.

See https://en.wikipedia.org/wiki/Most_common_words_in_English for a claim. It is what teachers use as a guideline. It's the first 100 words they teach children to write.

> the idea is you use a mnemonic generator to pick the words.

I know you are supposed to use a generator to pick the words, that is how BIP39 for bitcoin works. But average Joe is not going to do that. He will select "I went to highschool in 1992". Authentication is a hard problem, and unless you force a reasonable scheme, it will be weak.

Re: NIST’s new password rules – what you need to know

#237

Post by ph14nix »

mschuster91 wrote: post #33

> and should accept all UNICODE characters, too, including emoji Hell no. This WILL lead to disaster, especially if people store their passwords in managers that may or may not mess up Unicode. UTF-8, for example, allows to encode the character "ä" as \xc3\xa4 OR \x61\xcc\x88. They look visually identical, yet fail any string comparison. Not to mention the support calls "I'm in $random_foreign_country and don't have…

> UTF-8, for example, allows to encode the character "ä" as \xc3\xa4 OR \x61\xcc\x88. They look visually identical, yet fail any string comparison.

Well-designed high-level programming language (see Perl6) compares strings depending on how they look, not on their binary representation [0].

For example let's play with Perl6 REPL:

  > my $a = Blob.new(0xc3, 0xa4)
  Blob:0x
  > my $b = Blob.new(0x61, 0xcc, 0x88)
  Blob:0x
  > $a eqv $b
  False
  > $a.decode() eqv $b.decode()
  True
  > $a.decode() eq $b.decode()
  True
As another example, Python3 would fail:

  >>> a = b'\xc3\xa4'
  >>> b = b'\x61\xcc\x88'
  >>> a == b
  False
  >>> a.decode() == b.decode()
  False
Perl6 is definitely going to dominate the world one day.

[0] https://perl6advent.wordpress.com/2015/12/07/day-7-unicode-p...

Post reply on HN