Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules Are Bullshit

blog.codinghorror.com

Post reply on HN
Print view View original

221–230 of 283 posts

Re: Password Rules Are Bullshit

#221

Post by aianus »

pbhjpbhj wrote: post #119
JulianMorrison wrote: post #92

Earlier quoted context omitted.

Imposed passwords aren't the only solution. Something like Google Authenticator is an alternative. Or key fobs. Or send a confirmation code to their phone. Or something like Barclays' PINsentry [1] for cards where you need the gadget, the card and the PIN. Or face recognition, which I recently saw demonstrated (it includes liveness checks like asking you to blink). [1] http://www.barclays.co.uk/Helpsupport/UpgradetoP…

Authenticator is great, but then you get the arsehole effect - every arsehole company decision maker wants you to only use their authenticator. So, I made an account on MS recently and can't use GA because "fuck you user, we won't stop until we own every facet of your digital existence" or something. That shows you where such companies rank security. [FWIW I expect the reverse situation is probably the same, this is…

GA is just an implementation of an open protocol (TOTP). You can't be locked in to GA.

Re: Password Rules Are Bullshit

#222

Post by ue_ »

DashRattlesnake wrote: post #204
coldpie wrote: post #49

Earlier quoted context omitted.

I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords. What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on th…

> I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords. Weren't the celebrity iCloud account compromises due to Apple neglecting to rate-limit a certain authentication API endpoint, allowing the hacker to brute force passwords online? Also, doesn't some of the current crop of…

I thought it was due to phishing. I'm not sure where I heard that, though.

Re: Password Rules Are Bullshit

#223

Post by zeveb »

camiller wrote: post #155
neikos wrote: post #82

Earlier quoted context omitted.

Two ways why I think E-Mails are useful at signup: - Password Recovery (this can be optional though, for my sites it usually is) - 'Legit Users', sending an email and having them confirmed through a code in them gives a bit more confidence in the user

'legit users' There isn't a day that goes by that I don't get an email intended for someone else, often including personal information, due to a mistyped email address. Whoever decided that email verification was a poor user experience needs to be hit in the head with a shovel after he digs the appropriate sized hole. If you know Catherin (PA) let her know her round trip to vegas is confirmed Carolyn's (NYC) open tab…

> Whoever decided that email verification was a poor user experience needs to be hit in the head with a shovel after he digs the appropriate sized hole.

That's why you get send the verification email first, when creating the application user, and don't do anything until the email is verified.

The flow should be:

User: Please give me an account; my email address is jim@example.invalid

Server: I have sent an email to jim@example.invalid

Server → jim@example.invalid: Please go to https://server.invalid/register?token=KDU6dG9rZW4xOWppbUBleG...

User: visits URL, completes registration

Re: Password Rules Are Bullshit

#225

Post by zeveb »

lostlogin wrote: post #138
coldtea wrote: post #60

Earlier quoted context omitted.

> I am being serious when I ask this question: does anybody brute force passwords? Very many people. And not all systems stop them from doing so. And database leaks happen all the time too...

It wouldn't really matter how good your password was in the leak/breach scenario would it?

Depends. If the leak or breach reveals actual password, then yes, you're screwed. If it reveals SHA-256 hashes, then you're screwed unless you chose a good high-entropy password (e.g. lBBo1f93XbbKs2hKa8T5pR). If it reveals PBKDF2-hashed, bcrypt- or scrypt-hashed passwords, then you're almost certainly safe, unless you chose a really poor password (e.g., the following is a Base64-encoded PBKDF2 hash, with 100,000 iterations of SHA-256 and a seed of 'QDTGEqi8to9PrkpBgCbnN0': 8h1HO6omVWhusXcQRGS0CcTzSC5AkAIvodC+hT/AoRk=; I contend that you will not be able to guess the password I used for it), since trying passwords with a good key-derivation function is so slow.

Re: Password Rules Are Bullshit

#226

Post by Vendan »

vog wrote: post #47
koolba wrote: post #31

Earlier quoted context omitted.

> Why? Because my password in the "create" page was silently truncated on the front end, but the same truncation does not occur in all places, so I would type a longer password on the login page then what was registered in the system and it would fail. Here's an even worse one than truncating the end of long passwords: truncating internal whitespace The change/reset password dialog for Apple ID does this. If your pas…

> Also you can work around that by hashing the entire uses password (with say SHA-512) prior to inputting into bcrypt. I wonder why people are so eager to combine different hash algorithms, especially a strong with a weaker one. If this is isn't a well-established anti-pattern, it should become one.[1] Why? Because in some sense it combines the weaknesses of both algorithms. Assume your password hash is: h(p) = bcryp…

One thing to note is that if you manage to get access to just the hashes, they won't have sha512(p), so they wouldn't be able to figure out sha512(q). So while your are correct that there is (technically) a weakness there, it's not one that's actually exploitable.

Re: Password Rules Are Bullshit

#227

Post by zeveb »

syntheticnature wrote: post #183
GrinningFool wrote: post #125

Earlier quoted context omitted.

Annoyingly,some sites have started putting limits and validations on their security question answers...

Ran into one where it demanded I choose from a drop-down list, e.g. "What was your first pet" had "dog", "cat", "hamster", "gerbil", etc. I recall the list having a scrollbar, but there was not even enough choices for eight bits worth of entropy. Oh, and they referred to these security questions as "2FA."

And what if you never had a pet?

I love the ones that ask about one's favourite sports team (not everyone likes sports), or first girl (or boy) friend (not everyone has dated) or first car (not everyone has ever owned a car).

Re: Password Rules Are Bullshit

#228

Post by camiller »

Sean1708 wrote: post #186
camiller wrote: post #155

Earlier quoted context omitted.

'legit users' There isn't a day that goes by that I don't get an email intended for someone else, often including personal information, due to a mistyped email address. Whoever decided that email verification was a poor user experience needs to be hit in the head with a shovel after he digs the appropriate sized hole. If you know Catherin (PA) let her know her round trip to vegas is confirmed Carolyn's (NYC) open tab…

How generic is your email address? This has literally never happened to me (to my recollection).

I have (first initial)(mid initial)(last name) at gmail. Same as my HN id. And a very common last name! 16 months into my first job out of University I got a call from a headhunter intended for the other Chris Miller sitting 2 cubicles away from me. At my second and fourth jobs there were also other Chris Millers. And from my list of examples, most all have the same last name.

Re: Password Rules Are Bullshit

#229

Post by xtracto »

x1798DE wrote: post #109
jondubois wrote: post #28

I'm surprised that this article didn't mention the most important point about password rules: They force you to come up with a new password that you probably haven't used before and so you will probably forget it. There are websites that I don't use often where I literally have to reset the password (and go through all the i-forgot-my-password steps) every time I want to log in because they forced me to come up with…

You really shouldn't be re-using passwords across sites anyway, since all your accounts are compromised if any of them are compromised. Since re-using passwords is a problem solved by using a password manager, I'm assuming you're not using one, in which case you likely won't even remember the list of sites where you have accounts that have a shared password if you need to change it when any of the other sites are com…

The security process that has really worked for me is using the "forget password" as means to get a "login token" into my mail, which is protected with 2-factor auth.

I don't have to deal with password managers, maintaining their files. Or deal with multiple passwords.

Re: Password Rules Are Bullshit

#230

Post by xtracto »

code_duck wrote: post #44
jondubois wrote: post #28

I'm surprised that this article didn't mention the most important point about password rules: They force you to come up with a new password that you probably haven't used before and so you will probably forget it. There are websites that I don't use often where I literally have to reset the password (and go through all the i-forgot-my-password steps) every time I want to log in because they forced me to come up with…

For me it's gotten to where I just assume next time I need to log into the website, 6 months from now - car insurance for example - I simply expect to recover the password. No password really matters besides my email.

I second this... using the "remember password" as a token-based login + two factor authentication has been the best login method for me.
Post reply on HN