86% of CrashCrate subscribers used passwords already leaked in other breaches • Hacker News Board

Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches

#141

Post by zargon » Thu, May 03, 2018, 3:10 PM UTC

moviuro wrote: post #98

devit wrote: post #92

Letting users choose passwords is the default behavior of websites, but it's incredibly dumb. Just generate a random password on the server side and tell the user to store it in their password manager or in a plain text file. Do not let users enter their own password under any circumstance. All password issues solved instantly (yeah, if the client is compromised the password is too, but the attacker can install a key…

Can't possibly work. Everyone is going to have their own notebook for passwords, protected by rubber band. Yay. Also, I use a password manager on my machines (for websites I use privately: amazon, taxes, etc.), a different one at work (for corporate tools). I also use my own passwords + 2FA(if available) for things I use at both places (like my own gmail, HackerNews, etc.). Forcing users to remember/write down someth…

These arguments aren't convincing me. I still like devit's idea.

> Can't possibly work. Everyone is going to have their own notebook for passwords, protected by rubber band. Yay.

I don't consider this a bad thing per se. A notebook of secure passwords is a lot better than dictionary passwords. (Dictionary in the sense of a leaked password dictionary.)

> Chances are your "reset password" feature will be DDoS-ed into oblivion by your legitimate users.

I had a co-worker who, on most sites, set passwords by mashing the keyboard and then always logged in using the reset password functionality. I also don't see the problem with this.

Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches

#142

Post by yunruse » Thu, May 03, 2018, 8:59 PM UTC

tmd83 wrote: post #131

Does anyone know of good libraries to gauge password strength or find easy password. I'm conflicted between using all leaked password vs. simply excluding super popular and well known pattern. Not sure exactly what measure to take to stop easy password. The password crackers now recognizing so many patterns some of the big passwords can be very trivial and it can be hard to recognize those. I have found some librarie…

Have you tried zxcvbn [1]? It’s a pretty good heuristic, with common names and character replacement built in, alongside the ability to provide a custom dictionary with heavy weighting (eg your user’s names, email, address).

[1] https://github.com/nulab/zxcvbn4j

Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches

#143

Post by tatersolid » Sat, May 05, 2018, 3:22 AM UTC

MarkMc wrote: post #95

The takeaway is that if your site handles highly sensitive data like financial or medical records and you allow users to login with just an email and a password, you are doing it wrong. Almost no bank website allows login with just email/password - there's always some extra field required such as a User ID with random characters, an account number, a PIN number or a code from a second device. The reason is simple: if…

All six of the (major) banks I use require username and password only. And four of those limit password length to less than 12 characters.

Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches

#144

Post by MarkMc » Sat, May 05, 2018, 9:45 AM UTC

tatersolid wrote: post #143

MarkMc wrote: post #95

The takeaway is that if your site handles highly sensitive data like financial or medical records and you allow users to login with just an email and a password, you are doing it wrong. Almost no bank website allows login with just email/password - there's always some extra field required such as a User ID with random characters, an account number, a PIN number or a code from a second device. The reason is simple: if…

All six of the (major) banks I use require username and password only. And four of those limit password length to less than 12 characters.

I should have said 'extra information', not 'extra field'. A username with random characters like C85Y922 is clearly more secure than an email username.

Of the 6 major banks you use how many have email address as the username?

Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches

#145

Post by tatersolid » Tue, May 15, 2018, 1:39 AM UTC

MarkMc wrote: post #144

tatersolid wrote: post #143

Earlier quoted context omitted.

All six of the (major) banks I use require username and password only. And four of those limit password length to less than 12 characters.

I should have said 'extra information', not 'extra field'. A username with random characters like C85Y922 is clearly more secure than an email username. Of the 6 major banks you use how many have email address as the username?

Some require a separate username crafted by the bank, but they are low entropy. Something like last name plus 2 digits. One is a clearly sequential integer of limited range.

Usernames are not secrets and add no security by being kept secret. Just lengthen the damn password instead!