Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Algorithms

penguindreams.org

Post reply on HN
Print view View original

91–100 of 114 posts

Re: Password Algorithms

#91

Post by JeanMarcS »

fapjacks wrote: post #85
iak8god wrote: post #77

Earlier quoted context omitted.

> So the annoying workaround is to append year+month on the end of each password (which I was basically told to do when first setting up my account). So combined with a "maximum 10 characters" leaves 6 for my actual password... Or do , 1, 2, ...

Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords". In particular, the US military won't let you set a password that is similar to the last ten of your passwords. What constitutes "too similar"? It seems that your new password can't have more than a three-character substring from your old passwords.

So how do they know it's similar ? Is there a distance that could be calculated between 2 hashes and tell if they are similar ?

I don't think so... So are your old passwords stored in plain text somewhere so they can compare ?

Scary...

Re: Password Algorithms

#92

Post by MattSteelblade »

senectus1 wrote: post #39
xorfish wrote: post #13

Earlier quoted context omitted.

LastPass is not open source.

BitWarden is... I swapped from lastpass and have been loving it...

I've been thinking about switching, but I'm leery of it, as it is the work of a sole developer and it lacks a security audit.

Re: Password Algorithms

#93

Post by KMag »

gregmac wrote: post #79
theophrastus wrote: post #78

Earlier quoted context omitted.

And: "Must be four characters different than your last password" (this from a particular state's health insurance system). What does this mean? That four characters from the previous password must not appear in the new one at all, or only not in the same position? (fans of the little game Mastermind suffer deja-vu) What if the previous password contained all of the must have set of alternate symbols, then you've got…

I can't think of a way to do that without actually storing the plain text password. If it is in fact plain text, the irony is that by enforcing such "strong" password requirements, they've actually made the overall system less secure.

Password change dialogs generally have entries for:

    Previous Password:
    New Password:
    Confirm New Password:
They don't need to store the plaintext password, as you're giving the old password plaintext to them in the same dialog. Now, if such rules were against "any of your last 4 passwords" instead of just the last password, then that's much more difficult to do. (Obviously nobody is going to cooperate with a form requiring the person to submit their last 4 passwords as part of the password change dialog.)

Re: Password Algorithms

#94

Post by ajr0 »

iak8god wrote: post #90
fapjacks wrote: post #85

Earlier quoted context omitted.

Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords". In particular, the US military won't let you set a password that is similar to the last ten of your passwords. What constitutes "too similar"? It seems that your new password can't have more than a three-character substring from your old passwords.

> Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords". (╯°□°）╯︵ ┻━┻ I don't know how people who don't use password managers are able to deal with this kind of crap at all .

  ┬─┬ノ(º_ºノ) calm down, take it easy.
they do not deal with it, they reuse passwords increasing the degree if the problem

Re: Password Algorithms

#96

Post by metalliqaz »

Ajedi32 wrote: post #14
metalliqaz wrote: post #11

Earlier quoted context omitted.

How often do you find yourself in a situation where you need to enter a password, but you don't have the password manager on that device? Algorithms have their downside, sure, but for someone like me who is often working on other computers that aren't mine, managers are a non starter.

You have a phone, don't you? Just look up your passwords on there. You can even use something like InputStick to auto-type the password into the other computer if you'd rather not do it manually.

Hmm... InputStick, that's a cool little gadget, never heard of that.

Re: Password Algorithms

#97

Post by djsumdog »

nanodano wrote: post #73

I don't think this is good advice. An algorithm like this could easily be reverse engineered if someone had more than one. Considering how many places have password breaches it's not that inconceivable someone would get a hold of two of your passwords. The entropy is awful and there are 0 cryptographically secure psuedo random numbers being used. Yahoo, Disqus, Experian, Tumblr, Adobe, LinkedIn, Dropbox, MySpace, Ava…

You need to be specifically targeted though. People rarely are. Most compromised accounts are discovered using automated scripts and credential stuffing (taking a compromised password and trying it on other websites).

If you are being specifically targeted to that extent, a password manager may not be as helpful as you think .. and you probably have much bigger problems to worry about.

Re: Password Algorithms

#98

Post by seuss1969 »

iak8god wrote: post #77
Klathmon wrote: post #51

Earlier quoted context omitted.

The "must be changed every 30 days" always annoys me to no end. A system I use not only has that requirement (along with a very insane set of requirements like "no patterns like 123 or ABC"), but they also NEVER let you reuse a password. Which means they have a database of every password I've ever used on a machine somewhere, hashed or otherwise. So the annoying workaround is to append year+month on the end of each p…

> So the annoying workaround is to append year+month on the end of each password (which I was basically told to do when first setting up my account). So combined with a "maximum 10 characters" leaves 6 for my actual password... Or do , 1, 2, ...

That is not always feasible. There are also requirements like your passwords should be different in atleast 3 places.

Re: Password Algorithms

#99

Post by 4e1a »

gregmac wrote: post #79
theophrastus wrote: post #78

Earlier quoted context omitted.

And: "Must be four characters different than your last password" (this from a particular state's health insurance system). What does this mean? That four characters from the previous password must not appear in the new one at all, or only not in the same position? (fans of the little game Mastermind suffer deja-vu) What if the previous password contained all of the must have set of alternate symbols, then you've got…

I can't think of a way to do that without actually storing the plain text password. If it is in fact plain text, the irony is that by enforcing such "strong" password requirements, they've actually made the overall system less secure.

Give each user a random salt. Hash each subsection of the password with their salt and store that. No need for plaintext.

Re: Password Algorithms

#100

Post by bjpbakker »

iak8god wrote: post #90
fapjacks wrote: post #85

Earlier quoted context omitted.

Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords". In particular, the US military won't let you set a password that is similar to the last ten of your passwords. What constitutes "too similar"? It seems that your new password can't have more than a three-character substring from your old passwords.

> Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords". (╯°□°）╯︵ ┻━┻ I don't know how people who don't use password managers are able to deal with this kind of crap at all .

If a website warns me about this, I immediately remove my account. Because if they can tell how similar my new password is to my old password, it means they store information about my password.

I do use a password manager however, so I don’t really notice.

Post reply on HN