Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Algorithms

penguindreams.org

Post reply on HN
Print view View original

101–110 of 114 posts

Re: Password Algorithms

#101

Post by setr »

lederhosen wrote: post #88
setr wrote: post #80

Earlier quoted context omitted.

N choose 4 permutations of hashes could do it

Nah, that is only the character position sets to change, you also have to permutate the characters (which would be 2^(4*8) if we consider byte characters) Or did I misunderstand you?

I was counting the number of hashes to store; im not sure why the size of each character would matter?

But now that Im writing it out, I was clearly wrong anyways

I thinking something along the lines of taking every substring of 4 characters, and then for all permutations of those 4-tuples, plug it back into the string hash and store. Assuming the goal is to not share any 4-substring with the new string

So I think (N-4) + 1 gives you the number of 4-character windows

4! for the number of permutations of that 4-char window

So 4!*(n-3) total hashes

Which I guess is actually the same work you'd have to do anyways if you stored the plaintext; just without storing each variant

Re: Password Algorithms

#102

Post by featherverse »

It occured to me last night that password strength is a predatory system similar to capitalism.

My bank recently reduced it's max password length from 20 characters to 15, so in an E-mail I was writing to the CEO demanding they fix it, I was recommending improvements and I realize that an 18 character password SHOULD be minimum, however...

If an 18 character password is minimum that actually reduces the length of brute force attacks. If the minimum length is 8 characters and the maximum something ridiculous like 64, then people with 32-64 characters will have the strongest passwords.

However, this relies on the assumption that lots of people will be using weak passwords, the brute forcers are going to target and exploit those people first. The number of possible permutations are increased by allowing weaker passwords, but that isn't enough. If everyone uses 18 char or greater passwords then brute forcers will start their searches at 18 characters so it would matter if 8 characters are allowed.

Just some food for thought, and reason to encourage the use of stronger passwords than the recommended 180 bits. If the system supports 64 characters, might as well use 64 characters. And if it doesn't support 64 characters, fix it.

Re: Password Algorithms

#103

Post by WorldMaker »

throwawayReply wrote: post #57
jksmith wrote: post #8

Earlier quoted context omitted.

diceware.com

Diceware is good for encryption passkeys or for master passwords for password managers. It is awful for actual third-party passwords.

I also find Diceware-style wordlists useful for those "security questions" that are really "backup passwords for use over the phone". Instead of "real" answers to "What's the maiden name of my third grade elementary school teacher?" I try to roll a passphrase, store it in key/value section of the password manager. The Diceware might give "weird" words, but they are all at least pronounceable/describable to a human on the other end of a phone, which still matters in some cases.

Re: Password Algorithms

#104

Post by iak8god »

JeanMarcS wrote: post #91
fapjacks wrote: post #85

Earlier quoted context omitted.

Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords". In particular, the US military won't let you set a password that is similar to the last ten of your passwords. What constitutes "too similar"? It seems that your new password can't have more than a three-character substring from your old passwords.

So how do they know it's similar ? Is there a distance that could be calculated between 2 hashes and tell if they are similar ? I don't think so... So are your old passwords stored in plain text somewhere so they can compare ? Scary...

> Is there a distance that could be calculated between 2 hashes and tell if they are similar ?

Yes, maybe: https://en.wikipedia.org/wiki/Locality-preserving_hashing

> So are your old passwords stored in plain text somewhere so they can compare?

You betcha!

Re: Password Algorithms

#105

Post by TeddyBear060 »

metalliqaz wrote: post #11
gregmac wrote: post #2

> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character. This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do? I use a pa…

How often do you find yourself in a situation where you need to enter a password, but you don't have the password manager on that device? Algorithms have their downside, sure, but for someone like me who is often working on other computers that aren't mine, managers are a non starter.

And what about a decentralized passwords manager. Just enter the platform name, your master key and a PIN and boum ! You got your password back :-)

It's free, fast and secure. Try ANPM:

https://teddybear06.github.io/ANPM/

Re: Password Algorithms

#106

Post by TeddyBear060 »

linopolus wrote: post #86

I use a password manager, and generate passwords using the xkcd aproach[0] (only more words), which so have like 50-70 characters total. Easy to type in if I happen to use a retarded app which doesn't let me paste or something like a game console, but secure enough for me. On retarded sites which restrict passwords to length or characters or need some characters, I need a minute or two to modify the generated one (an…

You can use ANPM, a web-based password generator algorithm. Just enter a platform name, a master key and a PIN and boum you obtain a brand new secure password.

It's free and you won't loose a minute again :-)

https://teddybear06.github.io/ANPM/

Re: Password Algorithms

#107

Post by Terr_ »

featherverse wrote: post #102

It occured to me last night that password strength is a predatory system similar to capitalism. My bank recently reduced it's max password length from 20 characters to 15, so in an E-mail I was writing to the CEO demanding they fix it, I was recommending improvements and I realize that an 18 character password SHOULD be minimum, however... If an 18 character password is minimum that actually reduces the length of bru…

Or to cheekily summarize your post: "You don't need to outrun the bear/hacker. You just need to outrun the other people."

Re: Password Algorithms

#108

Post by yellowapple »

seuss1969 wrote: post #98
iak8god wrote: post #77

Earlier quoted context omitted.

> So the annoying workaround is to append year+month on the end of each password (which I was basically told to do when first setting up my account). So combined with a "maximum 10 characters" leaves 6 for my actual password... Or do , 1, 2, ...

That is not always feasible. There are also requirements like your passwords should be different in atleast 3 places.

If they're able to detect that, then it's basically guaranteed that they're not hashing their passwords.

Re: Password Algorithms

#109

Post by JeanMarcS »

iak8god wrote: post #104
JeanMarcS wrote: post #91

Earlier quoted context omitted.

So how do they know it's similar ? Is there a distance that could be calculated between 2 hashes and tell if they are similar ? I don't think so... So are your old passwords stored in plain text somewhere so they can compare ? Scary...

> Is there a distance that could be calculated between 2 hashes and tell if they are similar ? Yes, maybe: https://en.wikipedia.org/wiki/Locality-preserving_hashing > So are your old passwords stored in plain text somewhere so they can compare? You betcha!

Thanks for your answers :)

Re: Password Algorithms

#110

Post by linopolus »

TeddyBear060 wrote: post #106
linopolus wrote: post #86

I use a password manager, and generate passwords using the xkcd aproach[0] (only more words), which so have like 50-70 characters total. Easy to type in if I happen to use a retarded app which doesn't let me paste or something like a game console, but secure enough for me. On retarded sites which restrict passwords to length or characters or need some characters, I need a minute or two to modify the generated one (an…

You can use ANPM, a web-based password generator algorithm. Just enter a platform name, a master key and a PIN and boum you obtain a brand new secure password. It's free and you won't loose a minute again :-) https://teddybear06.github.io/ANPM/

> It's free and you won't loose a minute again :-)

Unless the sites password policy won’t accept it..

Post reply on HN