Passwords: Using 3 Random Words Is a Really Bad Idea (2017) • Hacker News Board

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#81

Post by PaulMoore » Sat, Dec 08, 2018, 2:27 PM UTC

dwighttk wrote: post #36

strictnein wrote: post #31

No, using 3 random words isn't "a really bad idea". That's complete nonsense. The only "really bad idea" for passwords is password reuse. A unique 14 character three word password for each site you use will protect you from the threats you face online. The fact that someone can relatively quickly crack your password if you used 3 random words is meaningless. That only works if they knew that you did that in the first…

I think they are trying to point out that if "use three words" gets popular enough then it isn't good for any individual who does so.

Thank you! Spot on.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#82

Post by PaulMoore » Sat, Dec 08, 2018, 2:31 PM UTC

guitarbill wrote: post #2

i hate this kind of pedantry. it just has to be better than what people currently use, which is stuff like password1, or 123456. yes, in an ideal world we would all use password managers, but that hasn't happened yet, either.

I'm sorry, but that's nonsense if you actually think about it.

Existing passwords are broken in a matter of milliseconds, perhaps a few seconds. Do you honestly believe it's sufficient consolation to an end-user to know it took 40 seconds instead? The end result is the same... they're breached.

My point is simple. We already have FAR superior techniques in 2018 and wasting time advocating questionable techniques is an exercise in futility. The people who follow the advice are still at considerable risk, the majority will ignore it and remain almost as vulnerable.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#83

Post by PaulMoore » Sat, Dec 08, 2018, 2:34 PM UTC

jeremysalwen wrote: post #24

mbreedlove wrote: post #4

I feel like the real take-away from this article is that MD5 is broken, something we've all known for ages. An application using a memory-hard algorithm like bcrypt would yield the same results, but without the hassle of retraining all users to use longer passwords.

Yup, also no mention of salting the passwords. The 200 billion md5 hashes per second figure they use matches up nicely with this 8x GTX 1080 system: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... which cracks bcrypt (at a weak security factor) two million times slower. So, that same system would crack a 3 word password at this weak bcrypt setting in about 3 years, and a 4 word password in 50 thousand…

Salts make no difference here. They do not harden passwords, but make an otherwise deterministic process random to ensure no two inputs result in the same output.

Of course, using a slower hash algorith will increase the time required to break it... but we know the majority of sites don't adequately protect passwords.

There are 331 breaches on HIBP. 108 used MD5, 43 used SHAx... meaning half of all firms used algorithms which we can break quickly & easily.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#84

Post by evrydayhustling » Sat, Dec 08, 2018, 3:19 PM UTC

PaulMoore wrote: post #79

evrydayhustling wrote: post #20

I guess this is a good primer for some folks, but there are two really spurious arguments: (1) Your working vocabulary of 20k words is irrelevant. If you pick the words yourself, they aren't random and your random-word-vocabulary (the ones you'd actually pick) is waaaay less. If you use a randomizer, which you should, just give it the full dictionary (or say, top 100k for memorability). (2) Faced with the suggestion…

Hi evrydayhustling "If you use a randomizer, which you should" That's a big IF. People should use a password manager, or create unique random passwords for every site... but they don't. Of course, if someone other than you chooses the words, you'd need to include the entire dictionary. "But go to 5, and you're solid for 400y. This is so clearly relevant that excluding it seems suspect." I haven't excluded this; I mak…

Oops - I didn't notice this part was related because I haven't used diceware! I still think it's weird to put something this fundamental to your argument in a footnote under one product above, but apologies for implying you if ignored it entirely.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#85

Post by guitarbill » Sun, Dec 09, 2018, 7:11 PM UTC

PaulMoore wrote: post #82

guitarbill wrote: post #2

i hate this kind of pedantry. it just has to be better than what people currently use, which is stuff like password1, or 123456. yes, in an ideal world we would all use password managers, but that hasn't happened yet, either.

I'm sorry, but that's nonsense if you actually think about it. Existing passwords are broken in a matter of milliseconds, perhaps a few seconds. Do you honestly believe it's sufficient consolation to an end-user to know it took 40 seconds instead? The end result is the same... they're breached. My point is simple. We already have FAR superior techniques in 2018 and wasting time advocating questionable techniques is a…

That's if they're encrypted in the first place. Avoiding re-use is far more important, as others have said in this thread. And humans are bad at remembering random combinations of letters and numbers, but ok at remembering words. If I could get my parents to use a password manager, I would.

But until then, three words is better than re-use, and your pedantry still isn't helping the people who need it most, i.e. people lacking technical literacy in the first place.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#86

Post by atoponce » Mon, Dec 10, 2018, 12:00 AM UTC

Niceware ships 65,536 unique words. 3 words chosen randomly is 1 "password" of 281,474,976,710,656 possibilities.

https://diracdeltas.github.io/niceware

If that password was hashed with a single pass of vanilla MD5, the Jeremi Gonsey's cluster of 8 Nvidia GTX 1080i GPUs [2] would be running at 307,200,000,000 hashes per second.

https://gist.github.com/epixoip/ace60d09981be09544fdd3500505...

In order to exhaust half of the keyspace, so odds would be in the favor of the password cracker finding the original hash, they would need to search only 140,737,488,355,328 hashes.

At 307.2 gigahashes per second, this would take approximately 458 seconds, or just under 8 hours using the Niceware list.

However, jumping to 4 random words grows that time by a factor of 65,536, which means reaching 50% exhaustion would take approximately 1 full year. Moving to 5 randomly generated Niceware words, and it's impractical to attempt cracking the MD5 hash.

Cherry-picking 3 words is a little dishonest for the discussion surrounding password security. The right "best answer" for password generation is to use a password manager, no argument there. And I don't know of any password generators that generate passphrases by default, Niceware, Diceware, or otherwise.

But if a user wants a passphrase instead, I don't know of a security expert who would recommend 3 words.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#87

Post by PaulMoore » Wed, Dec 12, 2018, 1:01 PM UTC

guitarbill wrote: post #85

PaulMoore wrote: post #82

Earlier quoted context omitted.

I'm sorry, but that's nonsense if you actually think about it. Existing passwords are broken in a matter of milliseconds, perhaps a few seconds. Do you honestly believe it's sufficient consolation to an end-user to know it took 40 seconds instead? The end result is the same... they're breached. My point is simple. We already have FAR superior techniques in 2018 and wasting time advocating questionable techniques is a…

That's if they're encrypted in the first place. Avoiding re-use is far more important, as others have said in this thread. And humans are bad at remembering random combinations of letters and numbers, but ok at remembering words. If I could get my parents to use a password manager, I would. But until then, three words is better than re-use, and your pedantry still isn't helping the people who need it most, i.e. peopl…

I'm guessing you mean hashed, or am I being pedantic? ;)

Anything is better than re-use, that's not really an argument. If I recommended using "1", "2", "3" for three different sites, that's technically better than reusing the same password... but still not safe.

Labelling it as pedantry really ignores the wider point. Having 3 unique passwords which take 40 seconds to break really isn't a great improvement, neither is it pedantic to point out that fact.