Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Algorithms

penguindreams.org

Post reply on HN
Print view View original

81–90 of 114 posts

Re: Password Algorithms

#81

Post by alkonaut »

I try to think about whether the account is sensitive. I use long random passwords and 2FA for the very few really important accounts. Especially mail and social accounts since those are used to recover other passwords.

For all those 90% of places where the data protected by the password isn't valuable, I just use a crap password. Usually the same password everywhere suffix with with something from the domain or whatever.

All those forums I needed to register just to use the search, or the mandatory registration to download a software trial.

Same with all those passwords that I need to enter on a TV remote or console controller: I just use a crap (short lowercase) pass and hope for the best. I don't consider the account worth protecting so long as I can reset the password with my (well protected) email account.

I must have 100+ accounts registered but maybe 4 that I really would worth about being stolen.

Re: Password Algorithms

#82

Post by AdmiralAsshat »

ythn wrote: post #68
AdmiralAsshat wrote: post #66

Earlier quoted context omitted.

Regardless, I'd say there's a good chance your password will be compromised at some point, through no fault of your own. Hell, if you had a Yahoo account, you should have probably rotated it, what? Three times in the past year? It's the forced rotation of passwords due to breaches that throw a wrench into the algorithm scheme. Even assuming no one ever actually figures out your leaked password because it was properly…

Even worse than password rotations are site-specific password requirements. Every site has different requirements that require my algorithm to take different branches. To remedy this, I have a google doc that has a list of sites I use along with what their password rules are and how many times they've been compromised. The difference between this and a manager is that I don't care if that google doc file is compromis…

Okay, so, having established that this is something you personally use, let me try being less combative in proclaiming it broken.

So I agree, in principle, that the idea of letting your document be public is a good one. Then it could work like public-key cryptography. Even still, my concerns would be the following:

  1. You are still guarding the "secret" of how you generate those passwords. That cannot be known, or your security breaks down. Is your algorithm sufficiently resilient to reverse-engineering that it won't be obvious  to an attacker who sees a password that is compromised during a breach? If so, great! Personally, I can't see myself coming up with a one-way hash in my head that would not be trivial for someone else to figure out. I don't think the average person can, either.

  2. You mentioned non-uniform password complexity requirements, which means that your algorithm (or algorithms) need to be able to accommodate that. I, again, feel like that would be very difficult to juggle. You're now remembering not just one algorithm, but several, and possibly several variants within.

  3. Based on what you have to track just to know what algorithm to use, it sounds like your spreadsheet already has four or five columns:  the site, the username, the password rules (which I assume is the "hint" that you use to tell you to use Algorithm A/B/C or Algorithm A var. 2, etc.), and the number of times compromised. At that point, I don't feel like the convenience of a "secret-free" document that doesn't need to be kept hidden outweighs the mental effort required to maintain the sheet and keep all processing within one's brain.

  4. Your algorithm may be tweaked for the "max" the site will allow, but I imagine most people's are tweaked only to the minimum. What is nice about the password manager is that since I don't have to remember it, I can make the password arbitrary long. If the site allows your passwords to be up to 50 characters, I make it 50 characters. Always. I could never do that if I were forced to memorize it (unless it were a password phrase with some vowel-to-number/special char substitutions, but crackers have shown that rainbow tables already account for those).
It may well work for you. I just don't think it's a good idea for the average person.

Re: Password Algorithms

#83

Post by gregmac »

metalliqaz wrote: post #11
gregmac wrote: post #2

> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character. This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do? I use a pa…

How often do you find yourself in a situation where you need to enter a password, but you don't have the password manager on that device? Algorithms have their downside, sure, but for someone like me who is often working on other computers that aren't mine, managers are a non starter.

Almost never. I do have it synchronized across a few devices, including my phone (which is PIN protected, plus my password manager has its own different PIN, and requires passphrase after a reboot).

For the couple passwords I have to enter on other devices (like Netflix) I often just create them by hand, and choose something easy to type on an on-screen keyboard, and then store it in my password manager. For example: "assdeeeerffghhhjuiop". If the keyboard is sorted alphabetically instead of QWERTY, I'll adapt to that.

I generally only have to type this in once or twice a year so it's not a huge deal.

Re: Password Algorithms

#84

Post by lederhosen »

gregmac wrote: post #79
theophrastus wrote: post #78

Earlier quoted context omitted.

And: "Must be four characters different than your last password" (this from a particular state's health insurance system). What does this mean? That four characters from the previous password must not appear in the new one at all, or only not in the same position? (fans of the little game Mastermind suffer deja-vu) What if the previous password contained all of the must have set of alternate symbols, then you've got…

I can't think of a way to do that without actually storing the plain text password. If it is in fact plain text, the irony is that by enforcing such "strong" password requirements, they've actually made the overall system less secure.

You can permutate all possible character positions for combinations of four changed characters, and for _each_ permutation permutate all four characters and then compare the hash, and if the hash is the same you do not accept the password (even though of course you could have false positives with hashes). It is of course much slower than the change of one character which is only 256 iterations if you mutate the underlying bytes and not Unicode characters.

But I would guess they use plain text :-(

Re: Password Algorithms

#85

Post by fapjacks »

iak8god wrote: post #77
Klathmon wrote: post #51

Earlier quoted context omitted.

The "must be changed every 30 days" always annoys me to no end. A system I use not only has that requirement (along with a very insane set of requirements like "no patterns like 123 or ABC"), but they also NEVER let you reuse a password. Which means they have a database of every password I've ever used on a machine somewhere, hashed or otherwise. So the annoying workaround is to append year+month on the end of each p…

> So the annoying workaround is to append year+month on the end of each password (which I was basically told to do when first setting up my account). So combined with a "maximum 10 characters" leaves 6 for my actual password... Or do , 1, 2, ...

Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords". In particular, the US military won't let you set a password that is similar to the last ten of your passwords. What constitutes "too similar"? It seems that your new password can't have more than a three-character substring from your old passwords.

Re: Password Algorithms

#86

Post by linopolus »

I use a password manager, and generate passwords using the xkcd aproach[0] (only more words), which so have like 50-70 characters total. Easy to type in if I happen to use a retarded app which doesn't let me paste or something like a game console, but secure enough for me. On retarded sites which restrict passwords to length or characters or need some characters, I need a minute or two to modify the generated one (and maybe can't login after registering, as the max length on register is longer than on login).

If this simple modification which I have to do one time costs me a minute, how many years of my life will it take to go through some algorithm, and this every single time I log in?

Besides any security considerations, its just too much of a hassle for me to use some password algorithm technique.

[0]: https://xkcd.com/936/

Re: Password Algorithms

#87

Post by donald123 »

jpfed wrote: post #75
donald123 wrote: post #31

Earlier quoted context omitted.

This is not necessarily true. Attackers with multiple sites' passwords can link users and look at their passwords. When they see some similarity of the passwords for the same user, it would take least effort for them to crack the password. Even if it only applies to dedicated attackers, think about the consequence, once the attacker cracks your password, he knows your algorithm, all your passwords will be exposed. An…

Yes, it really is more secure than exact re-use. Attackers that just try the exact same password on multiple sites on first discovery will be thwarted by algorithmically derived passwords. I'm not ruling out that there will be attackers that try to harvest passwords from multiple sites, join those sites by username or email, then try some ML to derive people's password algorithms. But there is a whole class of attack…

Having less hackers or taking hackers a little more effort to crack the password do not make it more secure in any ways. This is security through obscurity. Do you think the hackers will stop like a bear when they crack the first password?

If password can be cracked, they are insecure, no matter it takes the hacker 10 minutes or 10 hours.

And it does not take ML to derive these simple algorithms at all. People may think their password algorithm is good, but it lacks the fundamentals of cryptography. It's really just a puzzle you play with the attacker.

Re: Password Algorithms

#88

Post by lederhosen »

setr wrote: post #80
gregmac wrote: post #79

Earlier quoted context omitted.

I can't think of a way to do that without actually storing the plain text password. If it is in fact plain text, the irony is that by enforcing such "strong" password requirements, they've actually made the overall system less secure.

N choose 4 permutations of hashes could do it

Nah, that is only the character position sets to change, you also have to permutate the characters (which would be 2^(4*8) if we consider byte characters)

Or did I misunderstand you?

Re: Password Algorithms

#89

Post by Ajedi32 »

knodi123 wrote: post #50
Ajedi32 wrote: post #17

Earlier quoted context omitted.

Yeah, the default word list is pretty terrible. Try one of the ones from the EFF: https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...

ugh, the actual wordlist is a single hyperlinked sentence in the center of a thousand word essay. Here's a direct link: https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt

There are multiple word lists mentioned in that article, accompanied by an explanation of what types of words they include. Depending on your personal preferences, you might want to use a different list. That's why I linked the blog post and not the word lists directly.

Re: Password Algorithms

#90

Post by iak8god »

fapjacks wrote: post #85
iak8god wrote: post #77

Earlier quoted context omitted.

> So the annoying workaround is to append year+month on the end of each password (which I was basically told to do when first setting up my account). So combined with a "maximum 10 characters" leaves 6 for my actual password... Or do , 1, 2, ...

Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords". In particular, the US military won't let you set a password that is similar to the last ten of your passwords. What constitutes "too similar"? It seems that your new password can't have more than a three-character substring from your old passwords.

> Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords".

(╯°□°）╯︵ ┻━┻

I don't know how people who don't use password managers are able to deal with this kind of crap at all.

Post reply on HN