Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules Are Bullshit

blog.codinghorror.com

Post reply on HN
Print view View original

131–140 of 283 posts

Re: Password Rules Are Bullshit

#131

Post by bogomipz »

x1798DE wrote: post #107
bogomipz wrote: post #54

Earlier quoted context omitted.

"There are websites that I don't use often where I literally have to reset the password (and go through all the i-forgot-my-password steps) every time I want to log in because they forced me to come up with an overly creative password." Indeed and then one's email potentially becomes the weakest link in one's password security.

If a site offers email resets at all, how often you (legitimately) use them generally doesn't play into the security analysis. If it's easier to get access to your e-mail than to get the password to the account that can be reset by proving access to the e-mail, then your e-mail is the weakest link.

>"if it's easier to get access to your e-mail than to get the password to the account that can be reset by proving access to the e-mail, then your e-mail is the weakest link."

This was exactly my point yes :)

Re: Password Rules Are Bullshit

#132

Post by hashhar »

nerdponx wrote: post #59
coldpie wrote: post #49

Earlier quoted context omitted.

I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords. What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on th…

I was wondering this as I read it as well. Yes, we know it would be fairly easy to compromise an individual account by guessing common passwords. But that assumes you have one particular account in mind. If you're just looking for bank accounts to access, you first need a list of usernames to try (ideally usernames of non-tech-savvy people) and then you need to run your entire password guessing routine for each one.…

Hah, funny you ask. I was able to siphon off internet quota in my college using a combo of brute-forcing and previously known passwords. Worked quite good until my conscience got the better of me.

Re: Password Rules Are Bullshit

#133

Post by codelitt »

willvarfar wrote: post #103
prairiedock wrote: post #101

Can anyone explain why all authentication systems don't enforce a (say) 2-second delay on repeated password attempts? Wouldn't this solve nearly all insufficient entropy problems? Even a 5-character password should suffice in this situation, and a human user would never even notice the 2-second delay. How would malevolent password-crackers get around this?

Its hard to do at application level, because you might have a multi-thread or multi-server setup. Luckily, there's out-of-the-box solutions that are easy to set up, e.g. Fail2ban. Fail2ban scans your server logs, spots repeat login attempts, and sets up a temporary iptables ban on their IP.

I really like Fail2ban for SSH lockdowns, but I worry about using it for repeat login attempts on an application. Depending on the application, this could possibly lock out everyone in an office, campus, etc. For certain critical services being used by everyone, this could cause a fair amount of headache.

Re: Password Rules Are Bullshit

#134

Post by obsurveyor »

nerdponx wrote: post #3

Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…

This just happened to me on the Wii U with my Nintendo ID. I had set a 20 character password some time in the past(probably the limit on whatever webpage I used to sign up) and when I tried to log into my Wii U recently, only 16 characters were available for entry.

Re: Password Rules Are Bullshit

#135

Post by Wonderdonkey »

Side topic: As an end user, the worst for me software that only tells you what's wrong with your password AFTER you've done it wrong, and then only tells you one thing at a time even when you've made multiple errors (dictionary word, password too short, needs one capital letter, needs one number...). Just tell me the damn rules and let me get on with my life!

Re: Password Rules Are Bullshit

#136

Post by gist »

simias wrote: post #25

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…

> but if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing.

That's you. The average user thinks 'nobody will guess this password'. In other words don't assume they know about brute force attacks, rainbow tables, most common password lists and a host of other things that they haven't thought of or don't know even exist. They don't even know the complete group of actors that could potentially breach the account.

Re: Password Rules Are Bullshit

#138

Post by lostlogin »

coldtea wrote: post #60
coldpie wrote: post #49

Earlier quoted context omitted.

I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords. What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on th…

> I am being serious when I ask this question: does anybody brute force passwords? Very many people. And not all systems stop them from doing so. And database leaks happen all the time too...

It wouldn't really matter how good your password was in the leak/breach scenario would it?

Re: Password Rules Are Bullshit

#139

Post by ajmurmann »

accountface wrote: post #120
ajmurmann wrote: post #100

Earlier quoted context omitted.

So they can ban the spammer?

Then you're effectively banning someone's existing account, which they could have been using for years at that point. There's a lot of potential content there. Not a great feeling for anyone. Seems like the simplest solution is to have some basic password requirements.

I think the OP and other posts here have demonstrated that password requirements won't solve anything given a sufficiently incompetent or not caring user. If the platform provider cares more about the security of the account than the account holder there isn't much you can do.

Re: Password Rules Are Bullshit

#140

Post by coldpie »

SapphireSun wrote: post #112
nerdponx wrote: post #59

Earlier quoted context omitted.

I was wondering this as I read it as well. Yes, we know it would be fairly easy to compromise an individual account by guessing common passwords. But that assumes you have one particular account in mind. If you're just looking for bank accounts to access, you first need a list of usernames to try (ideally usernames of non-tech-savvy people) and then you need to run your entire password guessing routine for each one.…

The last time a company had their password hashes exfiltrated. All the common passwords are quickly broken.

And then what? Like sure, you'll be compromised on that one service and that's bad, but it's not anywhere near as bad as re-using passwords across services. My argument is we should be focusing on stopping password re-use far, far more than we should be nit-picking about password entropy.
Post reply on HN