Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why [Insert Thing Here] Is Not a Password Killer

troyhunt.com

Post reply on HN
Print view View original

161–170 of 277 posts

Re: Why [Insert Thing Here] Is Not a Password Killer

#161

Post by WorldMaker »

TremendousJudge wrote: post #123
WorldMaker wrote: post #117

Earlier quoted context omitted.

People aren't good at memorizing long lists of things, so just requiring long passwords isn't sufficient unless you are willing to also allow everyone to use the same password everywhere, and that's worse than the single point of failure problem than password managers because that's a distributed point of failure (just one breach of any site/application that you use; your security there is only as good as the weakest…

>People aren't good at memorizing long lists of things It's much easier to remember a 40 character passphrase of real words than a 12 character password of random symbols including punctuation

Yes, but it doesn't solve the problem of memorizing a list of 40 character passphrases for every single website/app that you use. Length alone as a password strength requirement is not sufficient. Length alone only further encourages password reuse, because people won't memorize more than one or two passwords, especially as they get longer.

Re: Why [Insert Thing Here] Is Not a Password Killer

#162

Post by guitarbill »

hyperpape wrote: post #113
screye wrote: post #57

Earlier quoted context omitted.

> I think the problem is that people don't understand how to use passwords From the looks of it, neither do the authenticators. The capital letter + symbol + number requirement had led to the current predicament. Just asking for really long passwords would have been a lot better. As it stands, people either use a predictable string of num-symbol to satisfy requirements or remember that one strong password,.which qual…

Just by itself, long passwords will result in people using "franklymydearIdontgiveadamn" and other things susceptible to a dictionary attack. Long passwords plus a bad password check ( https://www.troyhunt.com/ive-just-launched-pwned-passwords-v... ) might suffice. However, without that check, I suspect requiring special characters marginally improves entropy in practice.

Pretty much everybody I know and asked in the office just sticks some punctuation at the end, e.g. "Passw0rd$". IDK how much of an "improvement" that is, compared to e.g. 4 extra characters.

Re: Why [Insert Thing Here] Is Not a Password Killer

#163

Post by krupan »

Troy Hunt's whole career is basically based on the brokenness of passwords, but now he's defending them here, and then touting his own services that claim to make passwords better. Something is fishy here.

It could be that passwords are terrible, but everything else is worse, but I'm not convinced. We have had a big push towards SSL (TLS, actually) everywhere lately. I don't have to ask Amazon for a password to verify that it's really Amazon that I'm transacting with. It really feels like we should be able to come up with a seamless way for that to work both ways in every web transaction.

Re: Why [Insert Thing Here] Is Not a Password Killer

#164

Post by detaro »

creeble wrote: post #160
Ajedi32 wrote: post #90

WebAuthn is coming. In fact, it's actually already here. There are only two things it needs before it can start to take over the world: a cross-browser, cross-platform implementation with synced credentials, and server-side implementations from a few large companies like Google and Facebook. A cross-browser, cross-platform implementation with synced credentials will solve the one remaining usability issue WebAuthn ha…

Doesn't WebAuthn require hardware? I can't find any user examples that don't mention a phone or yubikey or whatever.

No, it doesn't. It's the most advertised scenario, but a software application could act as an Authenticator too. The spec explicitly mentions platform authenticators that just require a PIN as a possibility.

Re: Why [Insert Thing Here] Is Not a Password Killer

#165

Post by cyborgx7 »

bhaak wrote: post #32
cyborgx7 wrote: post #5

It is not just that everyone knows how passwords work. It is also that you can always enter a password. What if I don't have my phone to scan a qr-code? What if I want to use a minimalistic browser that doesn't implement a key pair store and I don't want to or can't set up one external? What if my minimal browser is text only? What if I'm on another device and don't have my stuff on there? I will pretty much always b…

I see where you are coming from but sometimes you have to enforce some things. If you don't have 2FA, you can't login into this site is a completely rational consequence if for example this site is handling financial assets of yours. But it's possible that in the future we will put the bar higher. Then these arguments might be considered as silly as "with HTTPS I can no longer telnet into a web site and issue HTTP co…

I would never claim there is no legitimacy to enforcing 2FA. At my last job we ran into a situation like that. I always lacked things other people and services took for granted for financial and political reasons (like a smartphone). When we were required to use 2FA for some services at work it caused some friction for me. We found a workable solution, but it was less than ideal.

They were right to turn on 2FA but it does come at a cost, and that cost isn't always worth it.

>But it's possible that in the future we will put the bar higher. Then these arguments might be considered as silly as "with HTTPS I can no longer telnet into a web site and issue HTTP commands by hand!" (and don't tell me people didn't do that, I did it myself).

I'm actually going to make the opposite counter-argument. I do think https is a great achievement but I also think we lost something with the additional complexity introduced in, what used to be, a fairly simple protocol with wide adoption. I don't think those were silly arguments to have had.

Re: Why [Insert Thing Here] Is Not a Password Killer

#166

Post by mkane848 »

krupan wrote: post #163

Troy Hunt's whole career is basically based on the brokenness of passwords, but now he's defending them here, and then touting his own services that claim to make passwords better. Something is fishy here. It could be that passwords are terrible, but everything else is worse, but I'm not convinced. We have had a big push towards SSL (TLS, actually) everywhere lately. I don't have to ask Amazon for a password to verif…

>passwords are terrible, but everything else is worse

I mean, isn't that a decent summary of a lot of things we rely on in the real world? Too late to stop, already out running in the wild, and everyone hates it but are used to using it, but what's the alternative?

NJTRANSIT, I'm looking at you.

Re: Why [Insert Thing Here] Is Not a Password Killer

#167

Post by Guest9812398 »

FooBarWidget wrote: post #62
AstralStorm wrote: post #56

Earlier quoted context omitted.

This does not work, you're a single point of failure. If you say, get sick, family members will override security. Nice try though. I'd recommend an actual password manager instead. Authenticated with biometrics and a simpler local password. Your service does the same, using voice and phone number as biometrics. (Perhaps with recovery question.) Feel free to replace it with sufficiently advanced AI.

Please, try to be in my shoes. Even teaching copy-paste is so difficult, how do you want me to teach them biometrics? The "I'll manage all your passwords for you" is the only solution that actually works. The ONLY other alternative is that they use 123456 as password everywhere. I already explained why I can't get them to use a password manager.

What about going back to the notebook idea? You give them a notebook that's called 'Passwords' and it sits on the desk beside their computer. They only write passwords in that notebook, and you can explain to them to write at least 20 random numbers and letters for new passwords.

When you visit, you can write those passwords down in your password manager. This way if the book goes missing or there is a disaster, you have a backup.

Re: Why [Insert Thing Here] Is Not a Password Killer

#168

Post by MrStonedOne »

Passwords can always be used.

You can forget a password, but you can't drop it down a storm drain, or have it all of the sudden fail to boot, or forget to bring it when you're at a friends house and now you can't answer your user's calls to fix the site that went down for some reason.

Re: Why [Insert Thing Here] Is Not a Password Killer

#169

Post by onion2k »

krupan wrote: post #163

Troy Hunt's whole career is basically based on the brokenness of passwords, but now he's defending them here, and then touting his own services that claim to make passwords better. Something is fishy here. It could be that passwords are terrible, but everything else is worse, but I'm not convinced. We have had a big push towards SSL (TLS, actually) everywhere lately. I don't have to ask Amazon for a password to verif…

Troy Hunt's whole career is basically based on the brokenness of passwords...

That's unfair. Troy's career is based on the brokenness of bad password implementations, not passwords themselves.

Re: Why [Insert Thing Here] Is Not a Password Killer

#170

Post by TremendousJudge »

ajford wrote: post #143
TremendousJudge wrote: post #128

Earlier quoted context omitted.

my _bank_ requires passwords to be exactly 8 characters and is case insensitive. when I first realized I literally couldn't believe it, it's infuriating

Sounds like it might be time to switch banks....

I know, but it's one of those things that are much easier said than done sadly
Post reply on HN