Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Algorithms

penguindreams.org

Post reply on HN
Print view View original

71–80 of 114 posts

Re: Password Algorithms

#71

Post by nikcub »

robmcm wrote: post #32
metalliqaz wrote: post #11

Earlier quoted context omitted.

How often do you find yourself in a situation where you need to enter a password, but you don't have the password manager on that device? Algorithms have their downside, sure, but for someone like me who is often working on other computers that aren't mine, managers are a non starter.

Logging into a system that doesn't support your password manager, such as games consoles, shared computers, restricted work machines etc. Copying over a really long generated password is much harder than an algo you can perform in your head.

use KeyPassXC - it supports generating word based or readable passwords and you can set it as the default

Re: Password Algorithms

#73

Post by nanodano »

I don't think this is good advice. An algorithm like this could easily be reverse engineered if someone had more than one. Considering how many places have password breaches it's not that inconceivable someone would get a hold of two of your passwords. The entropy is awful and there are 0 cryptographically secure psuedo random numbers being used.

Yahoo, Disqus, Experian, Tumblr, Adobe, LinkedIn, Dropbox, MySpace, Avast, DaniWeb, YouPorn, Trillian, Brazzers, Unreal Engine, PlayStation Network, Warframe, etc, etc, etc.

Here's a list of even more sites that have had passwords stolen: https://haveibeenpwned.com/PwnedWebsites

Re: Password Algorithms

#74

Post by nanodano »

notzorbo3 wrote: post #49
segmondy wrote: post #29

The problem is passwords, so long as we have passwords we are going to keep talking about password algorithms, password managers, password strength, password requirements, lost passwords, stolen passwords, phished passwords, forgotten passwords, expired passwords and all that crap. My startup is working on killing the password. What if we don't need passwords EVER? No need to argue about algorithm, strength, reset, l…

Can you elaborate a bit? I'm asking because as a bit of security aficionado, I've yet to see a scheme that's better than passwords + 2FA.

I have a feeling it is nothing ground breaking. I bet they are just using biometrics to replace the password so it's something like "Two factors: fingerprint + authenticator app code"

Re: Password Algorithms

#75

Post by jpfed »

donald123 wrote: post #31
jpfed wrote: post #24

Earlier quoted context omitted.

This threat only holds for dedicated attackers. 1. They have to have multiple passwords to have a chance to derive the algorithm. 2. They also need to somehow think it's worth their time to reverse the algorithm instead of just going with lower-hanging fruit.

This is not necessarily true. Attackers with multiple sites' passwords can link users and look at their passwords. When they see some similarity of the passwords for the same user, it would take least effort for them to crack the password. Even if it only applies to dedicated attackers, think about the consequence, once the attacker cracks your password, he knows your algorithm, all your passwords will be exposed. An…

Yes, it really is more secure than exact re-use. Attackers that just try the exact same password on multiple sites on first discovery will be thwarted by algorithmically derived passwords.

I'm not ruling out that there will be attackers that try to harvest passwords from multiple sites, join those sites by username or email, then try some ML to derive people's password algorithms. But there is a whole class of attackers that just won't bother with that level of sophistication.

If your algorithm is any good, you're already not the slowest person running from the bear (cf. easy passwords or exact-password-reuse).

Re: Password Algorithms

#76

Post by wybiral »

ythn wrote: post #64
wybiral wrote: post #44

If you're going to use an algorithm (which seems like a bad idea), wouldn't it be safer to keep a large secret key and then hmac or hash(key + service name) as your password?

At that point just use a manager. The point of an algorithm is that you can generate it using only your brain. Your brain can't easily calculate hashing digests.

I agree.

But if the goal was for it to be universal enough to work anywhere without the password manager installed then these crypto primitives would work.

You'd still be relying on the strength of those primitives and your secret key so it's not nearly as secure as randomly generated password.

So, yeah, use a password manager.

Re: Password Algorithms

#77

Post by iak8god »

Klathmon wrote: post #51
fredley wrote: post #9

Earlier quoted context omitted.

* Your password must be between 7 and 20 characters * Your password must contain * At least one number * At least one upper-case letter * At least one symbol from this list (!@#$%*) * Your password must be changed every 30 days Plus this: https://blog.mamota.net/resources/img/wat_2.gif

The "must be changed every 30 days" always annoys me to no end. A system I use not only has that requirement (along with a very insane set of requirements like "no patterns like 123 or ABC"), but they also NEVER let you reuse a password. Which means they have a database of every password I've ever used on a machine somewhere, hashed or otherwise. So the annoying workaround is to append year+month on the end of each p…

> So the annoying workaround is to append year+month on the end of each password (which I was basically told to do when first setting up my account). So combined with a "maximum 10 characters" leaves 6 for my actual password...

Or do , 1, 2, ...

Re: Password Algorithms

#78

Post by theophrastus »

fredley wrote: post #9
gregmac wrote: post #2

> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character. This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do? I use a pa…

* Your password must be between 7 and 20 characters * Your password must contain * At least one number * At least one upper-case letter * At least one symbol from this list (!@#$%*) * Your password must be changed every 30 days Plus this: https://blog.mamota.net/resources/img/wat_2.gif

And: "Must be four characters different than your last password" (this from a particular state's health insurance system). What does this mean? That four characters from the previous password must not appear in the new one at all, or only not in the same position? (fans of the little game Mastermind suffer deja-vu) What if the previous password contained all of the must have set of alternate symbols, then you've got a direct contradiction.

Re: Password Algorithms

#79

Post by gregmac »

theophrastus wrote: post #78
fredley wrote: post #9

Earlier quoted context omitted.

* Your password must be between 7 and 20 characters * Your password must contain * At least one number * At least one upper-case letter * At least one symbol from this list (!@#$%*) * Your password must be changed every 30 days Plus this: https://blog.mamota.net/resources/img/wat_2.gif

And: "Must be four characters different than your last password" (this from a particular state's health insurance system). What does this mean? That four characters from the previous password must not appear in the new one at all, or only not in the same position? (fans of the little game Mastermind suffer deja-vu) What if the previous password contained all of the must have set of alternate symbols, then you've got…

I can't think of a way to do that without actually storing the plain text password. If it is in fact plain text, the irony is that by enforcing such "strong" password requirements, they've actually made the overall system less secure.

Re: Password Algorithms

#80

Post by setr »

gregmac wrote: post #79
theophrastus wrote: post #78

Earlier quoted context omitted.

And: "Must be four characters different than your last password" (this from a particular state's health insurance system). What does this mean? That four characters from the previous password must not appear in the new one at all, or only not in the same position? (fans of the little game Mastermind suffer deja-vu) What if the previous password contained all of the must have set of alternate symbols, then you've got…

I can't think of a way to do that without actually storing the plain text password. If it is in fact plain text, the irony is that by enforcing such "strong" password requirements, they've actually made the overall system less secure.

N choose 4 permutations of hashes could do it
Post reply on HN