Why [Insert Thing Here] Is Not a Password Killer

Post by chromaton » Mon, Nov 05, 2018, 3:56 PM UTC

meuk wrote: post #83

snarf21 wrote: post #75

Earlier quoted context omitted.

It is generally always a trade-off between security and convenience. You can demand that a site allow passwords but you also aren't memorizing a 24 character nonsense password for each site login. The holy grail is can you bend the line and have something that is super secure and mostly convenient.

I currently work in an environment where I don't have access to a password manager, yet I am expected to have unique passwords for each service, and rotate passwords every month, and am not allowed to store passwords somewhere. Of course, this method requires you to remember more passwords than practically possible. If all accounts would have sane restrictions on the password it would become trivial to have something…

Post by TremendousJudge » Mon, Nov 05, 2018, 4:01 PM UTC

WorldMaker wrote: post #117

screye wrote: post #57

Earlier quoted context omitted.

> I think the problem is that people don't understand how to use passwords From the looks of it, neither do the authenticators. The capital letter + symbol + number requirement had led to the current predicament. Just asking for really long passwords would have been a lot better. As it stands, people either use a predictable string of num-symbol to satisfy requirements or remember that one strong password,.which qual…

People aren't good at memorizing long lists of things, so just requiring long passwords isn't sufficient unless you are willing to also allow everyone to use the same password everywhere, and that's worse than the single point of failure problem than password managers because that's a distributed point of failure (just one breach of any site/application that you use; your security there is only as good as the weakest…

Post by creeble » Mon, Nov 05, 2018, 4:02 PM UTC

bhauer wrote: post #114

creeble wrote: post #107

I just wish there were a more universal acceptance of entropy. I.e.: Use at least one upper case letter and symbol OR Use a password that is at least 20 characters long Passwords are fine, it's the differing standards that are nutty. Especially when you don't know them until after trying.

You can satisfy most entropy requirements without even trying by using a password manager's "create random password" feature. I feel the more important thing to attack is making password management more approachable to laypeople. To your point though: the most bothersome constraint put on passwords by applications and web sites are limits such as restricting certain special characters (To what end? You're going to ha…

Post by devit » Mon, Nov 05, 2018, 4:05 PM UTC

thecatspaw wrote: post #72

devit wrote: post #52

Earlier quoted context omitted.

Just set a never-expiring authentication cookie in the browser, so they never need to enter the password in typical one-device use. When they need to change devices, have the standard e-mail based password reset as well as "show password" in the account settings (make the password reset not reset login, unless the user explicitly elects to "log me out on all devices").

> show password You should not be able to do that if you're doing security properly. If you can show the password it means you're not hashing it properly and instead storing it as plaintext

Post by bradstewart » Mon, Nov 05, 2018, 4:08 PM UTC

Spooky23 wrote: post #122

meuk wrote: post #83

Earlier quoted context omitted.

I currently work in an environment where I don't have access to a password manager, yet I am expected to have unique passwords for each service, and rotate passwords every month, and am not allowed to store passwords somewhere. Of course, this method requires you to remember more passwords than practically possible. If all accounts would have sane restrictions on the password it would become trivial to have something…

The key is to come up with a repeatable pattern that defeats whatever repeatable pattern detection that is in place and just apply it. You don't write down the password, you write down parts of the pattern. Is it secure? No. But if you work at a place where SSO isn't a thing in 2018, it's not secure anyway.