Prevent users registering with passwords from data breaches • Hacker News Board

Re: Prevent users registering with passwords from data breaches

#61

Post by 0db532a0 » Sat, Jan 19, 2019, 9:01 AM UTC

dwighttk wrote: post #30

I need password fields to: 1)not silently fail when I try a 64 character (or 32 character) password 2)not fail and say my password is "too short" when it is 32 characters and you have an unrevealed maximum password length of fewer characters than that. 3)just all-around quit failing when my password is totally fine, it's a quasi-random string of letters, numbers, and symbols and I'll never type it... oh yeah 4)don't…

There’s something that I don’t really understand regarding password managers which maybe you could explain. How is using a password manager to manage multiple passwords more secure than using a single password everywhere?

In the case of a password manager, if your computer is breached, then all passwords are breached. If your passwords are hosted encrypted on a website, then if that website is breached, the master password you send it will be visible to the attacker, and thus all passwords are breached.

In the case of using the same password everywhere, if one website is breached, then the password to all sites is breached.

Am I missing something?

Re: Prevent users registering with passwords from data breaches

#62

Post by CJefferson » Sat, Jan 19, 2019, 9:13 AM UTC

0db532a0 wrote: post #61

dwighttk wrote: post #30

I need password fields to: 1)not silently fail when I try a 64 character (or 32 character) password 2)not fail and say my password is "too short" when it is 32 characters and you have an unrevealed maximum password length of fewer characters than that. 3)just all-around quit failing when my password is totally fine, it's a quasi-random string of letters, numbers, and symbols and I'll never type it... oh yeah 4)don't…

There’s something that I don’t really understand regarding password managers which maybe you could explain. How is using a password manager to manage multiple passwords more secure than using a single password everywhere? In the case of a password manager, if your computer is breached, then all passwords are breached. If your passwords are hosted encrypted on a website, then if that website is breached, the master pa…

Think of it this way -- your password managers password never gets passed to untrustworthy websites, so there is a very small chance it would ever get breached.

You now only have to trust one website/program, rather than every website (and we have evidence that many major websites can't be trusted with our passwords).

Re: Prevent users registering with passwords from data breaches

#63

Post by CamperBob2 » Sat, Jan 19, 2019, 9:19 AM UTC

That is going to be insanely annoying.

Re: Prevent users registering with passwords from data breaches

#64

Post by itmeyou » Sat, Jan 19, 2019, 9:29 AM UTC

0db532a0 wrote: post #61

dwighttk wrote: post #30

I need password fields to: 1)not silently fail when I try a 64 character (or 32 character) password 2)not fail and say my password is "too short" when it is 32 characters and you have an unrevealed maximum password length of fewer characters than that. 3)just all-around quit failing when my password is totally fine, it's a quasi-random string of letters, numbers, and symbols and I'll never type it... oh yeah 4)don't…

There’s something that I don’t really understand regarding password managers which maybe you could explain. How is using a password manager to manage multiple passwords more secure than using a single password everywhere? In the case of a password manager, if your computer is breached, then all passwords are breached. If your passwords are hosted encrypted on a website, then if that website is breached, the master pa…

When using a single password for all sites, any malicious or breached website exposes access to all your accounts. When using a password manager, only a breach of your computer or the password manager itself (or your email) will totally pwn you.

Breaches online are very, very common, and I would expect any password used on every single website you use to get leaked quickly.

Re: Prevent users registering with passwords from data breaches

#65

Post by zeeZ » Sat, Jan 19, 2019, 9:33 AM UTC

0db532a0 wrote: post #61

dwighttk wrote: post #30

I need password fields to: 1)not silently fail when I try a 64 character (or 32 character) password 2)not fail and say my password is "too short" when it is 32 characters and you have an unrevealed maximum password length of fewer characters than that. 3)just all-around quit failing when my password is totally fine, it's a quasi-random string of letters, numbers, and symbols and I'll never type it... oh yeah 4)don't…

There’s something that I don’t really understand regarding password managers which maybe you could explain. How is using a password manager to manage multiple passwords more secure than using a single password everywhere? In the case of a password manager, if your computer is breached, then all passwords are breached. If your passwords are hosted encrypted on a website, then if that website is breached, the master pa…

If your computer is "breached" then it doesn't matter where your passwords come from. They could just run a keylogger and get them that way.

It really depends on your threat model. No system is perfect and we're mostly balancing security and convenience most of the time.

The same password everywhere is super convenient, but only one site needs to fail and it's all over. A cloud password manager with unique passwords protect from that. A local password manager eliminates the threat of them being compromised, but is less convenient if you have multiple devices. Storing your passwords offline on paper in a safe protects your from someone getting read access to your PC or outright stealing it, but is annoying and gets more inconvenient based on your passwords entropy.

Re: Prevent users registering with passwords from data breaches

#66

Post by simion314 » Sat, Jan 19, 2019, 9:33 AM UTC

0db532a0 wrote: post #61

dwighttk wrote: post #30

I need password fields to: 1)not silently fail when I try a 64 character (or 32 character) password 2)not fail and say my password is "too short" when it is 32 characters and you have an unrevealed maximum password length of fewer characters than that. 3)just all-around quit failing when my password is totally fine, it's a quasi-random string of letters, numbers, and symbols and I'll never type it... oh yeah 4)don't…

There’s something that I don’t really understand regarding password managers which maybe you could explain. How is using a password manager to manage multiple passwords more secure than using a single password everywhere? In the case of a password manager, if your computer is breached, then all passwords are breached. If your passwords are hosted encrypted on a website, then if that website is breached, the master pa…

The password for the password manager is only in my brain, the only way to get it is to install a keylogger on my machine. If instead I used it on all 30 + websites that requier login the only thing you need to do it is to hack or wait for one of this sites to get hacked and get it from there, then login with it in all this websites.

I had used the one password on most websites years ago(I did not known better back then but I did used different password for my important email account), I think my credentials were leacked in 5 data leaks and hackers are still attempting to login with my old credentials in present. The only time this affected me when someone hacked and stole my Minecraft account but I got it back.

Re: Prevent users registering with passwords from data breaches

#67

Post by MarkMc » Sat, Jan 19, 2019, 9:42 AM UTC

mnutt wrote: post #53

MarkMc wrote: post #48

If you say to the user, "sorry but that password is too common - please try again" then the user will simply add a 1 to the end of the password and press submit. That doesn't offer much improvement in security.

If that happens commonly, the original password with a 1 appended will probably eventually appear in a future HIBP database. In fact, the user could continue adding 1s until they either give up and try something different, or until it becomes uncommon enough.

Here's an example of that user experience:

User: Set my password to 'monkey'

Website: Sorry that's a common password

User: OK, set my password to 'monkey1'

Website: Sorry that's a common password

User: What?! OK, set my password to 'monkey123'

Website: Sorry that's a common password

User: Grr! Set my password to 'monkey123fuckyou!!'

Website: Sorry that's a common password

User: Screw this, I'll just sign up to your competitor's website instead

Re: Prevent users registering with passwords from data breaches

#68

Post by dawnerd » Sat, Jan 19, 2019, 9:46 AM UTC

dwighttk wrote: post #30

I need password fields to: 1)not silently fail when I try a 64 character (or 32 character) password 2)not fail and say my password is "too short" when it is 32 characters and you have an unrevealed maximum password length of fewer characters than that. 3)just all-around quit failing when my password is totally fine, it's a quasi-random string of letters, numbers, and symbols and I'll never type it... oh yeah 4)don't…

I like to call those sites out and have submitted some to https://github.com/duffn/dumb-password-rules

Re: Prevent users registering with passwords from data breaches

#69

Post by [deleted] » Sat, Jan 19, 2019, 9:49 AM UTC

Dylan16807 wrote: post #42

dwighttk wrote: post #30

I need password fields to: 1)not silently fail when I try a 64 character (or 32 character) password 2)not fail and say my password is "too short" when it is 32 characters and you have an unrevealed maximum password length of fewer characters than that. 3)just all-around quit failing when my password is totally fine, it's a quasi-random string of letters, numbers, and symbols and I'll never type it... oh yeah 4)don't…

64? How much entropy is in the passwords you're pasting? While holistically I like to see maximum lengths of 200+, personally I'm satisfied with 20 characters holding 119 bits of entropy.

[deleted]

Re: Prevent users registering with passwords from data breaches

#70

Post by darkpuma » Sat, Jan 19, 2019, 9:58 AM UTC

throwawaymath wrote: post #22

geofft wrote: post #16

Earlier quoted context omitted.

But what is the harm in blocking all 20 trillion such passwords? Do you expect to have any false positives?

The harm is the principle of it. You should not design a system that greps through e.g. every single breach dump for arbitrary passwords every single time someone tries to sign up for your service. That's maddeningly inefficient.

Bloom filters! B-trees!

There are MUCH smarter ways to implement this than grepping a list line by line. I mean seriously who the hell would do that... If your bio isn't complete BS then surely you understand that proposed implementation is BS.