Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why [Insert Thing Here] Is Not a Password Killer

troyhunt.com

Post reply on HN
Print view View original

131–140 of 277 posts

Re: Why [Insert Thing Here] Is Not a Password Killer

#131

Post by michaelt »

WorldMaker wrote: post #117
screye wrote: post #57

Earlier quoted context omitted.

> I think the problem is that people don't understand how to use passwords From the looks of it, neither do the authenticators. The capital letter + symbol + number requirement had led to the current predicament. Just asking for really long passwords would have been a lot better. As it stands, people either use a predictable string of num-symbol to satisfy requirements or remember that one strong password,.which qual…

People aren't good at memorizing long lists of things, so just requiring long passwords isn't sufficient unless you are willing to also allow everyone to use the same password everywhere, and that's worse than the single point of failure problem than password managers because that's a distributed point of failure (just one breach of any site/application that you use; your security there is only as good as the weakest…

screye is almost certainly referring to XKCD-style passwords, like "correct horse battery staple" [1] which are memorable and comparatively high-entropy, but don't have symbols or numbers.

[1] https://xkcd.com/936/

Re: Why [Insert Thing Here] Is Not a Password Killer

#132

Post by ryan-c »

meuk wrote: post #83
snarf21 wrote: post #75

Earlier quoted context omitted.

It is generally always a trade-off between security and convenience. You can demand that a site allow passwords but you also aren't memorizing a 24 character nonsense password for each site login. The holy grail is can you bend the line and have something that is super secure and mostly convenient.

I currently work in an environment where I don't have access to a password manager, yet I am expected to have unique passwords for each service, and rotate passwords every month, and am not allowed to store passwords somewhere. Of course, this method requires you to remember more passwords than practically possible. If all accounts would have sane restrictions on the password it would become trivial to have something…

> We could have one master password, use site and username (and maybe a counter, to make it easy to rotate passwords) as salt, and use a hashing or password derivation algorithm to derive a unique password for each service. This would only require you to pick and remember a strong master password.

This has been tried. While it initially sounds appealing, it is a monumentally terrible idea.

* You need software to implement the scheme.

* Rotation is a problem, you need a counter for state

* Different services have widely different password rules which are additional state

* If a site stores password data in cleartext or weakly hashed, your master password/passphrase can potentially be cracked

* People choose passphrases just as badly as they choose passwords

Just write your passwords down. Maybe leave a few characters off or don't label them.

Re: Why [Insert Thing Here] Is Not a Password Killer

#133

Post by ryan-c »

jki275 wrote: post #86
meuk wrote: post #83

Earlier quoted context omitted.

I currently work in an environment where I don't have access to a password manager, yet I am expected to have unique passwords for each service, and rotate passwords every month, and am not allowed to store passwords somewhere. Of course, this method requires you to remember more passwords than practically possible. If all accounts would have sane restrictions on the password it would become trivial to have something…

I know that environment well, you pretty much have to come up with a hash function you can do in your head. Is it secure? Maybe you can pull it off. I think most people can't, and that's what leads to people writing down passwords.

Writing down passwords is usually less bad than password reuse and use of weak passwords.

Re: Why [Insert Thing Here] Is Not a Password Killer

#134

Post by ken »

cyborgx7 wrote: post #5

It is not just that everyone knows how passwords work. It is also that you can always enter a password. What if I don't have my phone to scan a qr-code? What if I want to use a minimalistic browser that doesn't implement a key pair store and I don't want to or can't set up one external? What if my minimal browser is text only? What if I'm on another device and don't have my stuff on there? I will pretty much always b…

Sort of. You're selectively quoting "Write programs to handle text streams, because that is a universal interface" -- but that was from the days when "text" was basically synonymous with "ASCII".

Passwords aren't streams, and in the Unicode world, they're not even (predictable) byte arrays. This isn't just hypothetical. There have been recent bugs in major systems where people with non-ASCII passwords couldn't type them.

One of the major failings of QR codes for consumer use, IMHO, is that there is no fallback. With UPC, the number is printed right below the barcode, so when it doesn't scan, the clerk can just type in the digits.

ASCII digits are universal. Bytes are universal. Text is ... complicated.

Re: Why [Insert Thing Here] Is Not a Password Killer

#135

Post by ryan-c »

rocqua wrote: post #116

From the article: > I'm referring to passwordless solutions that involves things like QR codes, pictorial representations, 3rd party mobile apps, dedicated hardware devices or "magic" links sent via email. I'm not entirely sure the argument holds for the magic links sent via email. To me, those feel like lower friction that entering a password. Because all of a sudden, users don't have to remember their password. For…

There are some minor issues with the magic link workflow - one of them is security scanning software potentially visiting the link.

So then you need to open the link in the same browser you want to use. But what if you want to log in on a desktop browser and only have your email on your phone?

Maybe have the magic link show a couple letters you need to type into the browser?

Re: Why [Insert Thing Here] Is Not a Password Killer

#136

Post by PhasmaFelis »

> The point of all this is that usability is an absolutely essential attribute of the auth discussion. What I often find when I have these discussions is a myopic focus on technical merits.

This problem is ubiquitous to all of tech, pretty much. It's particularly iconic to FOSS grognards like Richard Stallman. Software that respects people's rights is fantastic, and we need more of it, but if you're not making that software usable then you're wasting your time.

Re: Why [Insert Thing Here] Is Not a Password Killer

#137

Post by ukulele »

rocqua wrote: post #116

From the article: > I'm referring to passwordless solutions that involves things like QR codes, pictorial representations, 3rd party mobile apps, dedicated hardware devices or "magic" links sent via email. I'm not entirely sure the argument holds for the magic links sent via email. To me, those feel like lower friction that entering a password. Because all of a sudden, users don't have to remember their password. For…

We've had "magic" links as the primary sign in method for our site for about a year now. It works well but we very regularly get requests to allow password login. So much so that we'll introduce that eventually.

Seems like both in combo could be a nice solution, but I'm sure we'll just start getting support requests from people whose password doesn't work because they never set one...

Re: Why [Insert Thing Here] Is Not a Password Killer

#139

Post by jki275 »

ryan-c wrote: post #133
jki275 wrote: post #86

Earlier quoted context omitted.

I know that environment well, you pretty much have to come up with a hash function you can do in your head. Is it secure? Maybe you can pull it off. I think most people can't, and that's what leads to people writing down passwords.

Writing down passwords is usually less bad than password reuse and use of weak passwords.

Depending on the physical security posture of the location where the passwords are stored, that can be a correct statement. I wouldn't argue "usually" simply because most people aren't smart about where they're stored.

Re: Why [Insert Thing Here] Is Not a Password Killer

#140

Post by ryan-c »

TremendousJudge wrote: post #123
WorldMaker wrote: post #117

Earlier quoted context omitted.

People aren't good at memorizing long lists of things, so just requiring long passwords isn't sufficient unless you are willing to also allow everyone to use the same password everywhere, and that's worse than the single point of failure problem than password managers because that's a distributed point of failure (just one breach of any site/application that you use; your security there is only as good as the weakest…

>People aren't good at memorizing long lists of things It's much easier to remember a 40 character passphrase of real words than a 12 character password of random symbols including punctuation

A 40 character password of real words is usually easier to crack than a random 12 character string, though.
Post reply on HN