Password Rules Are Bullshit • Hacker News Board

Re: Password Rules Are Bullshit

#121

Post by iamatworknow » Fri, Mar 10, 2017, 3:14 PM UTC

nerdponx wrote: post #59

coldpie wrote: post #49

Earlier quoted context omitted.

I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords. What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on th…

I was wondering this as I read it as well. Yes, we know it would be fairly easy to compromise an individual account by guessing common passwords. But that assumes you have one particular account in mind. If you're just looking for bank accounts to access, you first need a list of usernames to try (ideally usernames of non-tech-savvy people) and then you need to run your entire password guessing routine for each one.…

>Serious question: when is the last time anyone has had an account compromised because of a weak password?

What is your definition of "weak"? I sometimes help my landlord fix their computer when they accumulate too much malware. One time I brought their tower home to do this and didn't get their Windows account password. Instead of calling them I decided to try a few things first, including their kids' names. Lo and behold, the second attempt was correct.

Brute forcing a weak password probably isn't what you have to worry about when it comes to targeted attacks against weak passwords, but social engineering is.

Re: Password Rules Are Bullshit

#122

Post by hellcow » Fri, Mar 10, 2017, 3:17 PM UTC

koolba wrote: post #31

nerdponx wrote: post #3

Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…

> Why? Because my password in the "create" page was silently truncated on the front end, but the same truncation does not occur in all places, so I would type a longer password on the login page then what was registered in the system and it would fail. Here's an even worse one than truncating the end of long passwords: truncating internal whitespace The change/reset password dialog for Apple ID does this. If your pas…

I can confirm. I spent days locked out of my Apple account (and all associated devices) because I had spaces in my passwords. After several hours with support, who needed to escalate the issue to tier 2, then engineering, the only thing that fixed it was me briefly trying a simple password -- one without spaces. I'm not sure if the issue was ever fixed, but I don't imagine I'll use spaces in an Apple password again anytime soon.

Re: Password Rules Are Bullshit

#123

Post by snarf21 » Fri, Mar 10, 2017, 3:19 PM UTC

simias wrote: post #25

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…

I agree with what you have said but I think the new guidelines don't go far enough. The biggest problem is that in the balance of security and convenience, users will always opt for convenience. Only via legislation will that change, think credit card chips versus swiping. (We should have chip + PIN in my opinion.)

We need to make passwords a much simpler thing to manage so that people don't create a bigger problem by putting it on post-its on their monitor. What I'm suggesting would take some effort but is where we need to go. Your username is your fingerprint. You won't forget that and it is very hard to fake/brute force. (Your phone already has one and a usb one for you computer would be trivial. A lot already have them.) Your password is always just 8 characters, alpha numeric only (62^8 is plenty big) and you must have 2FA on. It would be trivial for the phone manufacturer to add that at the OS level and it could be visible on your lock screen. Also, finally a good use for a smart watch. The rules are simple and you have removed the biggest security hole most companies have: people. Just my two cents....

Re: Password Rules Are Bullshit

#124

Post by MarkMc » Fri, Mar 10, 2017, 3:20 PM UTC

prairiedock wrote: post #101

Can anyone explain why all authentication systems don't enforce a (say) 2-second delay on repeated password attempts? Wouldn't this solve nearly all insufficient entropy problems? Even a 5-character password should suffice in this situation, and a human user would never even notice the 2-second delay. How would malevolent password-crackers get around this?

Even with a delay of 2 seconds, I can check your password against the most-common 10,000 passwords list in 6 hours.

And I can run the check in parallel. So if I have 1,000 email addresses I can find all the users with low-entropy passwords in just 6 hours.

Re: Password Rules Are Bullshit

#125

Post by GrinningFool » Fri, Mar 10, 2017, 3:21 PM UTC

Raphmedia wrote: post #78

bambax wrote: post #74

Earlier quoted context omitted.

Totally agree. If you annoy the user too much, they will not try to circumvent your rules, they will leave and find something else to do with their time. Also, the big question that's missing from the article is: who's the enemy? If the enemy are Russian genius hackers, then certainly very long passwords and maybe other measures are in order. But the enemy is not always remote. I just bought a new iPad and had to res…

I simply type passwords in the answers. "What is your mother's maiden name?" - "gHk899iL@"

Annoyingly,some sites have started putting limits and validations on their security question answers...

Re: Password Rules Are Bullshit

#126

Post by GrinningFool » Fri, Mar 10, 2017, 3:21 PM UTC

Raphmedia wrote: post #78

bambax wrote: post #74

Earlier quoted context omitted.

Totally agree. If you annoy the user too much, they will not try to circumvent your rules, they will leave and find something else to do with their time. Also, the big question that's missing from the article is: who's the enemy? If the enemy are Russian genius hackers, then certainly very long passwords and maybe other measures are in order. But the enemy is not always remote. I just bought a new iPad and had to res…

I simply type passwords in the answers. "What is your mother's maiden name?" - "gHk899iL@"

Annoyingly,some sites have started putting limits and validations on their security question answers...

Re: Password Rules Are Bullshit

#127

Post by marcosdumay » Fri, Mar 10, 2017, 3:26 PM UTC

coldpie wrote: post #49

corobo wrote: post #38

Earlier quoted context omitted.

> if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing You do. A lot of users don't consider automation when it comes to people hacking their account. I've heard "Nobody will ever guess it though" a few times during my career.

I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords. What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on th…

Yes, many bots try to brute force passwords.

Do you run any ssh or email servers? If so, your logs will tell you already. I've got bots brute forcing passwords on my blogs, that nobody even read, but did have account functionality, with email sending. People made the point of adapting their bots for different captcha schemes just so they could send some email.

Re: Password Rules Are Bullshit

#128

Post by yAnonymous » Fri, Mar 10, 2017, 3:34 PM UTC

"When the DB with clear text passwords is stolen from our server, because we haven't installed updates in three years, at least your other logins won't be affected."

There's no better way to communicate this to your customers than complex password requirements.

Re: Password Rules Are Bullshit

#129

Post by Merad » Fri, Mar 10, 2017, 3:37 PM UTC

nerdponx wrote: post #3

Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…

I had a fun issue a few months ago with Team City at work. I was setting up a build to upload to our internal Nuget server, but the upload kept failing. I finally discovered (I don't remember how, but it took hours) that our randomly generated Nuget API key included a character that Team City didn't like and it was silently stripping that character from the input field in the build setup.

Re: Password Rules Are Bullshit

#130

Post by marcosdumay » Fri, Mar 10, 2017, 3:39 PM UTC

koolba wrote: post #31

nerdponx wrote: post #3

Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…

> Why? Because my password in the "create" page was silently truncated on the front end, but the same truncation does not occur in all places, so I would type a longer password on the login page then what was registered in the system and it would fail. Here's an even worse one than truncating the end of long passwords: truncating internal whitespace The change/reset password dialog for Apple ID does this. If your pas…

I'm siding with vog here. Do not compose hashes¹. You may not think it's relevant that it degrades the security of your site, but nobody knows what consequences it will bring, so how could you know?

Impose your size limitation as a clear password rule. That means, write on your site that passwords must not exceed the 55, 255 or whatever characters, send back an error if the user tries to create a larger password.

1 - And completely avoid weaker hashes in general, it's not like a percent or two increase in CPU usage will have a greater impact on your bottom than having to adapt your software after it's out.