Prevent users registering with passwords from data breaches • Hacker News Board

Re: Prevent users registering with passwords from data breaches

#31

Post by rmtech » Sat, Jan 19, 2019, 2:05 AM UTC

geofft wrote: post #21

throwawaymath wrote: post #13

Earlier quoted context omitted.

> If the password actually has a lot of entropy but it appears in a breach then that's some fairly strong evidence that the user is reusing it. I'm not talking about scenarios where you can associate the password with a specific user.

You can in fact associate the password with a specific user - the fact that that exact password is being reused is, by itself , strong mathematical evidence that it's the same user or someone they told the password to, because it is basically mathematically impossible that anyone else could generate the same password by coincidence (unless they're both using a password generator that doesn't have good random seeds or…

> exact password is being reused is, by itself, strong mathematical evidence that it's the same user

yes, exactly.

Re: Prevent users registering with passwords from data breaches

#32

Post by [deleted] » Sat, Jan 19, 2019, 2:06 AM UTC

throwawaymath wrote: post #27

geofft wrote: post #23

Earlier quoted context omitted.

No, you're not screwed either way, because there are trillions of trillions of trillions of possible 20-character passwords. So even if they can get one trillion attempts per second, it will still take an attacker trillions of trillions of seconds to brute-force all possible 20-character passwords, which is longer than the lifetime of the universe.

Now keep in mind that 1) it is possible to choose a strong password with fewer than 20 characters, and 2) most people will not choose a password that long. Extrapolating further, this "policy" would disallow people from choosing passwords below a certain length, because it's theoretically plausible someone has published the set of all possible strings fewer than n characters long.

[deleted]

Re: Prevent users registering with passwords from data breaches

#33

Post by geofft » Sat, Jan 19, 2019, 2:08 AM UTC

throwawaymath wrote: post #27

geofft wrote: post #23

Earlier quoted context omitted.

No, you're not screwed either way, because there are trillions of trillions of trillions of possible 20-character passwords. So even if they can get one trillion attempts per second, it will still take an attacker trillions of trillions of seconds to brute-force all possible 20-character passwords, which is longer than the lifetime of the universe.

Now keep in mind that 1) it is possible to choose a strong password with fewer than 20 characters, and 2) most people will not choose a password that long. Extrapolating further, this "policy" would disallow people from choosing passwords below a certain length, because it's theoretically plausible someone has published the set of all possible strings fewer than n characters long.

> Extrapolating further, this "policy" would disallow people from choosing passwords below a certain length, because it's theoretically plausible someone has published the set of all possible strings fewer than n characters long.

Yes, that seems like a good password policy. A list of possible alphanumeric strings that is actually reasonable to physically publish (i.e., not 20 trillion) is a list of extremely short alphanumeric strings. 5 alphanumeric characters is 380 million possible strings. 6 is about 2 billion. You should absolutely ban passwords that are 6 characters or shorter!

In fact, I would go so far as to say that the questions of "Is this password too short because someone could brute-force all the possibilities, even if we're using a good password hash and a previously-unknown salt" and "Can someone physically enumerate all passwords of this size and put them on Pastebin or otherwise get them in the HIBP database" are equivalent.

Re: Prevent users registering with passwords from data breaches

#34

Post by rmtech » Sat, Jan 19, 2019, 2:09 AM UTC

Just a quick point that is worth considering: If a user types in a password and that password appears once in the HIBP breach list, then it is extremely likely that the source of the password in the breach list IS that user.

If it appears 2-3 times, then there is still a significant chance that that user is the source of the password getting into the HIBP database.

And if that user is the source, then the bad guys most likely know that user's email and password, and their account is wide open.

Re: Prevent users registering with passwords from data breaches

#35

Post by 21 » Sat, Jan 19, 2019, 2:11 AM UTC

This is a terrible idea which will backfire.

Many users have a "universal weak password" for sites that don't really matter, now you will be forcing them to jump through hoops just because so.

Re: Prevent users registering with passwords from data breaches

#36

Post by rmtech » Sat, Jan 19, 2019, 2:12 AM UTC

cpburns2009 wrote: post #4

And I thought we were getting away from arcane rules for passwords. Now you have to avoid every compromised password from any unrelated account? I may use random passwords, but I don't expect the typical consumer to do the same. Sometimes I simply don't care about security for a one off account on a free service where I'll happily use the simplest permutation of "password" for the password.

If the service doesn't care about security at all then you could just not have a password, log on using your email.

If it cares a little bit then you have to characterize exactly how bad it would be if the account was compromised. The right solution might be to just accept any non-blank password that's less than 32 chars or something.

Re: Prevent users registering with passwords from data breaches

#37

Post by geofft » Sat, Jan 19, 2019, 2:12 AM UTC

cpburns2009 wrote: post #4

And I thought we were getting away from arcane rules for passwords. Now you have to avoid every compromised password from any unrelated account? I may use random passwords, but I don't expect the typical consumer to do the same. Sometimes I simply don't care about security for a one off account on a free service where I'll happily use the simplest permutation of "password" for the password.

The existence of password breach databases means that attackers are already attempting other people's passwords against your accounts.

We should honestly move to the world where typical consumers are using password managers that generate passwords randomly. I think it is pretty reasonable to expect the typical consumer to install and use a password manager; I think it's pretty unreasonable to expect the typical consumer to generate memorable, strong, and unique passwords for each website and store them in their head.

Re: Prevent users registering with passwords from data breaches

#38

Post by rmtech » Sat, Jan 19, 2019, 2:13 AM UTC

21 wrote: post #35

This is a terrible idea which will backfire. Many users have a "universal weak password" for sites that don't really matter, now you will be forcing them to jump through hoops just because so.

this shouldn't be used on all sites, only ones where security matters.

Re: Prevent users registering with passwords from data breaches

#39

Post by Dylan16807 » Sat, Jan 19, 2019, 2:14 AM UTC

cpburns2009 wrote: post #4

And I thought we were getting away from arcane rules for passwords. Now you have to avoid every compromised password from any unrelated account? I may use random passwords, but I don't expect the typical consumer to do the same. Sometimes I simply don't care about security for a one off account on a free service where I'll happily use the simplest permutation of "password" for the password.

Most people don't know how to make a good password. So don't let them make a bad password, and make that easy by providing a button that generates good ones.

"It has to be new" is about as elegant as you can get for password rules. You can use any secure method you want. Whatever characters you want, just don't do it wrong. If you want it to be easier, press the button.

Even with a one-off account, a complex password you don't bother to remember is better than a weak password, because the service won't have to deal with tons of misused accounts.

Re: Prevent users registering with passwords from data breaches

#40

Post by rmtech » Sat, Jan 19, 2019, 2:16 AM UTC

geofft wrote: post #29

rmtech wrote: post #25

Earlier quoted context omitted.

Editing since I misunderstood you: If you publish one trillion passwords from a large space then each one of them gets a probability boost (of approximately 1/1 trillion), though not enough to ban them, especially if they are not actually associated with accounts. The danger with using a rare but breached password is that there is actually quite a high chance that it was breached from your account elsewhere.

I think we're reading the question differently - I'm responding to the question of, what if you publish a tiny subset of the passwords, 20 trillion out of 0.7 trillion trillion trillion. That does change the probabilities. I do agree that if the entire space of possible passwords is only 20 trillion, that doesn't change the probabilities. But there are over 20 trillion eight-character alphanumeric passwords. So, I wo…

Well there is one important factor about these 20 trillion passwords: are they associated with real user accounts?

If not then it really doesn't matter that they got published. They're useless to hackers without knowing what email to type in. The attack model is that the attacker actually has to log into a website and you don't get 20 trillion attempts.