Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules Are Bullshit

blog.codinghorror.com

Post reply on HN
Print view View original

261–270 of 283 posts

Re: Password Rules Are Bullshit

#261

Post by rosser »

officelineback wrote: post #213
snarf21 wrote: post #123

Earlier quoted context omitted.

I agree with what you have said but I think the new guidelines don't go far enough. The biggest problem is that in the balance of security and convenience, users will always opt for convenience. Only via legislation will that change, think credit card chips versus swiping. (We should have chip + PIN in my opinion.) We need to make passwords a much simpler thing to manage so that people don't create a bigger problem b…

2FA is something you know and something you have. So fingerprint gives you part 2 and password gives you part 1. No need for an additional MFA device.

No. Your parent's comment is correct: fingerprints should be usernames, not passwords. An MFA device is still warranted.

Re: Password Rules Are Bullshit

#262

Post by nmat »

prairiedock wrote: post #101

Can anyone explain why all authentication systems don't enforce a (say) 2-second delay on repeated password attempts? Wouldn't this solve nearly all insufficient entropy problems? Even a 5-character password should suffice in this situation, and a human user would never even notice the 2-second delay. How would malevolent password-crackers get around this?

The main problem is not the response time of http requests. Is when you are hacked and the database is leaked and becomes avaliable for anyone to brute force it at any speed they want.

Re: Password Rules Are Bullshit

#263

Post by elchief »

bumblebeard wrote: post #234
criddell wrote: post #64

Somebody got into my bank account and attempted to steal some money. Luckily, we were able to stop it quickly and the bank had the money back in our account the same day. It was pretty upsetting so I sent a letter to them with a lot of questions about their system and eventually somebody from the inside called me. One of the questions I asked was why they limit password length. The (low) limit suggests that they were…

What bank? I wouldn't want to do business with them if that's how they handle security.

Every bank in Canada probably. Because their back-end systems run on old IBM mainframes.

Re: Password Rules Are Bullshit

#264

Post by quacker »

blauditore wrote: post #160
x1798DE wrote: post #109

Earlier quoted context omitted.

You really shouldn't be re-using passwords across sites anyway, since all your accounts are compromised if any of them are compromised. Since re-using passwords is a problem solved by using a password manager, I'm assuming you're not using one, in which case you likely won't even remember the list of sites where you have accounts that have a shared password if you need to change it when any of the other sites are com…

I'm quite hesitant towards using a password manager. All secrets are protected by only one single password, and to make the tool useful, it should be accessible from anywhere and I would use it quite often too, increasing the limit of my master PW being stolen (whatever way, keyloggers, shoulder surfers, cameras...). Thus, I rather memorize a handful of unique high-security passwords for important services and one or…

All secrets are protected by only one single password, and to make the tool useful, it should be accessible from anywhere and I would use it quite often too, increasing the limit of my master PW being stolen (whatever way, keyloggers, shoulder surfers, cameras...)

True, though your handful of passwords can be stolen in the same way.

With a password manager, you:

- ensure your master password is not transmitted over a network

- ensure you never reuse passwords

- ensure you have long, strong passwords everywhere

- never forget login details and never worry about remembering yet another password

On the other hand,

- you _need_ access your password manager in order to login

- you now have a single point of failure

- cloud-based password managers are very attractive targets for hackers

I don't like these aspects of it.

Still, a password manger is incredibly convenient and I do feel a greater sense of security/confidence when I copy a big old 64 character password to log in. As it is, I use so many different services (gmail, github, slack, aws, steam, dropbox, reddit, etc, etc) and that number is only going to increase. I think a password manager is a practical, scalable solution to both remembering login information and improving my security.

Re: Password Rules Are Bullshit

#265

Post by kofejnik »

Symbiote wrote: post #240
coldpie wrote: post #49

Earlier quoted context omitted.

I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords. What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on th…

If you have a server running SSH, you can try the "lastb" command, which shows failed logins. Or, look in the logfile, often /var/log/secure or similar. root ssh:notty 116.31.116.44 Fri Mar 10 22:27 - 22:27 (00:00) root ssh:notty 116.31.116.44 Fri Mar 10 22:27 - 22:27 (00:00) ... My personal server has 153,246 entries from this single IP, from 1 March until now.

why hadn't you installed fail2ban?

Re: Password Rules Are Bullshit

#266

Post by lazyasciiart »

bsder wrote: post #232
SamBam wrote: post #210

Earlier quoted context omitted.

I have [first-initial][last-name]@gmail.con. My last name is pretty uncommon, but there are at least a thousand of us or so in the US. I probably get a dozen emails a month to people who are not me (not counting all the ones that end up in the spam folder after I'm on a damn list). Susan. Stephen. Another Sam. So many damn S. Lastnames around. On occasion I've tracked the people down. I've forwarded their emails if t…

The real problem is that you are all on the same email provider. If we didn't have a monoculture in email providing, this would be far less of an issue.

Do you think yahoo and Gmail are the same email provider?

Re: Password Rules Are Bullshit

#267

Post by fryguy »

simias wrote: post #70
coldtea wrote: post #57

Earlier quoted context omitted.

> I mean, I can imagine that a clueless user might have the illusion of safety if they're using something like "1q2w3e4r5t" but if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. So why even bother? It's not an illusion, 1q2w3e4r5t is indeed better than aaaaaaaaa, even if it's just the numbers interleaved with qwerty (and probably easy to brute force generate up to it). > if I use "aaaaa…

Okay, I'm game: HHHnHHHHnHHHHHnnnnnnnnnHHnnnnnnHHHHH It's a password that I postulate is more secure that the average and yet is only made of two different symbols and would've been rejected by the proposed "x amongst y" character policy. It's a bit far fetched but not that much, you'll notice that the pattern is simply the first digits of pi, so it's fairly easy to remember. And the letters are "Hn", like hacker new…

zxcvbn (https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.ht...) gives it a score of 4/4 and an entropy of 10^20, meaning it would take centuries to hack at 10B a second. I think this is a slight overstatement of the security, because it's probably more along the lines of 50502^30 which is closer to 10^12. And this would be a legal password (but banned by the bullshit password rule).

I feel like the solution to everything in this thread is just to use zxcvbn and stop with the insane rules for things. In your two cases: the bank would disallow passwords below some limit while the blog would just show you a warning (in case you were ignorant of hacking enough to know that "aaaaaaaa" wasn't a good password), but let you use your awful password to spare you from having to remember it.

Re: Password Rules Are Bullshit

#268

Post by fryguy »

vog wrote: post #47
koolba wrote: post #31

Earlier quoted context omitted.

> Why? Because my password in the "create" page was silently truncated on the front end, but the same truncation does not occur in all places, so I would type a longer password on the login page then what was registered in the system and it would fail. Here's an even worse one than truncating the end of long passwords: truncating internal whitespace The change/reset password dialog for Apple ID does this. If your pas…

> Also you can work around that by hashing the entire uses password (with say SHA-512) prior to inputting into bcrypt. I wonder why people are so eager to combine different hash algorithms, especially a strong with a weaker one. If this is isn't a well-established anti-pattern, it should become one.[1] Why? Because in some sense it combines the weaknesses of both algorithms. Assume your password hash is: h(p) = bcryp…

Can you explain how a collision helps? I mean, there's trivial collisions with the truncation that would be used instead. That doesn't mean that bcrypt(f(x)) is any weaker because there may be some other x' that f(x) = f(x').

Re: Password Rules Are Bullshit

#269

Post by dpc59 »

elchief wrote: post #263
bumblebeard wrote: post #234

Earlier quoted context omitted.

What bank? I wouldn't want to do business with them if that's how they handle security.

Every bank in Canada probably. Because their back-end systems run on old IBM mainframes.

I changed my bank's online account password lately because it wasn't a good password, and then I forgot my new password. Resetting my password was a fucking joke, anyone who's acquainted with me and can do a few google searches could get into my bank account if they had my card number. It's not just their hardware, their whole security practices are messed up but they don't care because the federal government insures every account up to 100k.

Re: Password Rules Are Bullshit

#270

Post by e12e »

lloeki wrote: post #34

Travel to some other side of the world and France's CNIL recommends[0] the following password rules as of 27 Jan 2017 (abridged): - if the system uses a login + password scheme: 12 chars min and mandatory mix of all among non-caps/caps/digit/special - if the system uses a login + password + time-based exponential backoff rate limiting with a baseline of 1 min after 5 tries maxxing at 25 per 24h or lockout after 10 tr…

> - if the system uses a login + password scheme: 12 chars min and mandatory mix of all among non-caps/caps/digit/special

P a s s w o r d 2 0 1 7 .

Post reply on HN