Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Prevent users registering with passwords from data breaches

jordanhall.co.uk

Post reply on HN
Print view View original

41–50 of 129 posts

Re: Prevent users registering with passwords from data breaches

#41

Post by throwawaymath »

geofft wrote: post #33
throwawaymath wrote: post #27

Earlier quoted context omitted.

Now keep in mind that 1) it is possible to choose a strong password with fewer than 20 characters, and 2) most people will not choose a password that long. Extrapolating further, this "policy" would disallow people from choosing passwords below a certain length, because it's theoretically plausible someone has published the set of all possible strings fewer than n characters long.

> Extrapolating further, this "policy" would disallow people from choosing passwords below a certain length, because it's theoretically plausible someone has published the set of all possible strings fewer than n characters long. Yes, that seems like a good password policy. A list of possible alphanumeric strings that is actually reasonable to physically publish (i.e., not 20 trillion) is a list of extremely short al…

Salts do not need to be previously unknown. This goes back to what I was saying - they're either securely protected with a key derivation function, or they're not.

Re: Prevent users registering with passwords from data breaches

#42

Post by Dylan16807 »

dwighttk wrote: post #30

I need password fields to: 1)not silently fail when I try a 64 character (or 32 character) password 2)not fail and say my password is "too short" when it is 32 characters and you have an unrevealed maximum password length of fewer characters than that. 3)just all-around quit failing when my password is totally fine, it's a quasi-random string of letters, numbers, and symbols and I'll never type it... oh yeah 4)don't…

64? How much entropy is in the passwords you're pasting? While holistically I like to see maximum lengths of 200+, personally I'm satisfied with 20 characters holding 119 bits of entropy.

Re: Prevent users registering with passwords from data breaches

#43

Post by AmericanChopper »

geofft wrote: post #37
cpburns2009 wrote: post #4

And I thought we were getting away from arcane rules for passwords. Now you have to avoid every compromised password from any unrelated account? I may use random passwords, but I don't expect the typical consumer to do the same. Sometimes I simply don't care about security for a one off account on a free service where I'll happily use the simplest permutation of "password" for the password.

The existence of password breach databases means that attackers are already attempting other people's passwords against your accounts. We should honestly move to the world where typical consumers are using password managers that generate passwords randomly. I think it is pretty reasonable to expect the typical consumer to install and use a password manager; I think it's pretty unreasonable to expect the typical consu…

Even putting online attacks aside, breached password lists make fantastic dictionaries for cracking hashes.

Re: Prevent users registering with passwords from data breaches

#44

Post by geofft »

21 wrote: post #35

This is a terrible idea which will backfire. Many users have a "universal weak password" for sites that don't really matter, now you will be forcing them to jump through hoops just because so.

I suspect there's a relatively small window of folks who have a universal weak password. There are lots of folks who have a universal password for everything; there are some folks who have a unique password for everything, because once you use a password manager or even a password scheme you might as well customize your password for every site.

And I think forcing people who are in a position to use unique passwords easily, but too lazy to do so, to get around to using unique passwords is a good thing to do. I include myself in this category - I was sloppy at password hygiene until very recently and I should have gotten on it a long time ago.

(Note that I'm not endorsing password schemes because they're very vulnerable to targeted attacks, but they are popular and arguably easier than password managers and they do technically count as letting you use a unique password on each site - if you use one, the HIBP API will not block you from logging in to any sites other than the one that got breached.)

Re: Prevent users registering with passwords from data breaches

#45

Post by Dylan16807 »

rmtech wrote: post #40
geofft wrote: post #29

Earlier quoted context omitted.

I think we're reading the question differently - I'm responding to the question of, what if you publish a tiny subset of the passwords, 20 trillion out of 0.7 trillion trillion trillion. That does change the probabilities. I do agree that if the entire space of possible passwords is only 20 trillion, that doesn't change the probabilities. But there are over 20 trillion eight-character alphanumeric passwords. So, I wo…

Well there is one important factor about these 20 trillion passwords: are they associated with real user accounts? If not then it really doesn't matter that they got published. They're useless to hackers without knowing what email to type in. The attack model is that the attacker actually has to log into a website and you don't get 20 trillion attempts.

Never underestimate the ingenuity of the user. They might search for a list of good passwords, find it, and pick one.

> The attack model is that the attacker actually has to log into a website

Not to find the password. If it was then nobody would get upset about plaintext password storage.

Re: Prevent users registering with passwords from data breaches

#46

Post by geofft »

rmtech wrote: post #31
geofft wrote: post #21

Earlier quoted context omitted.

You can in fact associate the password with a specific user - the fact that that exact password is being reused is, by itself , strong mathematical evidence that it's the same user or someone they told the password to, because it is basically mathematically impossible that anyone else could generate the same password by coincidence (unless they're both using a password generator that doesn't have good random seeds or…

> exact password is being reused is, by itself, strong mathematical evidence that it's the same user yes, exactly.

I thought of another way of putting this - a 20-character alphanumeric password is a random 114-bit value. A UUIDv4 is a random 122-bit value (the remaining bits are specified by the UUID spec). If you generate UUIDs for your users, and you don't expect two users to end up with the same UUID, it would be confusing if you somehow expected two users with 20-character alphanumeric passwords to potentially collide. The probabilities are just a factor of 256 from each other.

Re: Prevent users registering with passwords from data breaches

#47

Post by Dylan16807 »

throwawaymath wrote: post #41
geofft wrote: post #33

Earlier quoted context omitted.

> Extrapolating further, this "policy" would disallow people from choosing passwords below a certain length, because it's theoretically plausible someone has published the set of all possible strings fewer than n characters long. Yes, that seems like a good password policy. A list of possible alphanumeric strings that is actually reasonable to physically publish (i.e., not 20 trillion) is a list of extremely short al…

Salts do not need to be previously unknown. This goes back to what I was saying - they're either securely protected with a key derivation function, or they're not.

Right. That was just to give the most generous possible circumstances to a password when arguing that it's still too weak.

Re: Prevent users registering with passwords from data breaches

#49

Post by Dylan16807 »

geofft wrote: post #46
rmtech wrote: post #31

Earlier quoted context omitted.

> exact password is being reused is, by itself, strong mathematical evidence that it's the same user yes, exactly.

I thought of another way of putting this - a 20-character alphanumeric password is a random 114-bit value. A UUIDv4 is a random 122-bit value (the remaining bits are specified by the UUID spec). If you generate UUIDs for your users, and you don't expect two users to end up with the same UUID, it would be confusing if you somehow expected two users with 20-character alphanumeric passwords to potentially collide. The p…

(119 not 114, there are 62 alphanumerics)

Re: Prevent users registering with passwords from data breaches

#50

Post by erik_seaberg »

Dylan16807 wrote: post #42
dwighttk wrote: post #30

I need password fields to: 1)not silently fail when I try a 64 character (or 32 character) password 2)not fail and say my password is "too short" when it is 32 characters and you have an unrevealed maximum password length of fewer characters than that. 3)just all-around quit failing when my password is totally fine, it's a quasi-random string of letters, numbers, and symbols and I'll never type it... oh yeah 4)don't…

64? How much entropy is in the passwords you're pasting? While holistically I like to see maximum lengths of 200+, personally I'm satisfied with 20 characters holding 119 bits of entropy.

I find a passphrase (e.g., half a dozen words from the diceware list) easier to memorize than random gibberish and symbols, so it's disappointing that they're so rarely allowed.
Post reply on HN