Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Prevent users registering with passwords from data breaches

jordanhall.co.uk

Post reply on HN
Print view View original

81–90 of 129 posts

Re: Prevent users registering with passwords from data breaches

#81

Post by ss248 »

air7 wrote: post #76

This is over the top. Even enforcing password complexity is over-rated. For online attacks, an attacker can't even try the top 1000 passwords on for an account in any major website in reasonable time without triggering the alarm, as they all(?) have rate limiting (usually in the form of account lockdown after single-digit failed attempts). For offline attacks, there first needs to be a breach. While they undoubtedly…

You're right. I don't know why it's still not a common knowledge that nobody bruteforces the login pages in this day and age. But I guess too many people, who have products to sell, benefit from the status quo, so things are not going to change.

Re: Prevent users registering with passwords from data breaches

#82

Post by pbhjpbhj »

jrootabega wrote: post #71
dwighttk wrote: post #30

I need password fields to: 1)not silently fail when I try a 64 character (or 32 character) password 2)not fail and say my password is "too short" when it is 32 characters and you have an unrevealed maximum password length of fewer characters than that. 3)just all-around quit failing when my password is totally fine, it's a quasi-random string of letters, numbers, and symbols and I'll never type it... oh yeah 4)don't…

and allow spaces

But then the support workers might cut-and-paste it wrongly!

Re: Prevent users registering with passwords from data breaches

#83

Post by hombre_fatal »

ss248 wrote: post #81
air7 wrote: post #76

This is over the top. Even enforcing password complexity is over-rated. For online attacks, an attacker can't even try the top 1000 passwords on for an account in any major website in reasonable time without triggering the alarm, as they all(?) have rate limiting (usually in the form of account lockdown after single-digit failed attempts). For offline attacks, there first needs to be a breach. While they undoubtedly…

You're right. I don't know why it's still not a common knowledge that nobody bruteforces the login pages in this day and age. But I guess too many people, who have products to sell, benefit from the status quo, so things are not going to change.

No, login pages are definitely "still" brute forced. Why wouldn't they be? It's easier than ever.

Re: Prevent users registering with passwords from data breaches

#84

Post by pbhjpbhj »

CM30 wrote: post #78

So what happens when a significantly large percentage of 'standard' passwords are disallowed and your average Joe just can't be bothered to create another one? Seems like eventualy you'll end up driving away everyone who isn't tech savvy/doesn't use a password manager/randomly generated password, which seems like something that'll significantly limit your site or app's audience. I get the logic behind it, and it's a…

If you need your users to have a secure password then that's a good thing. We need to make password managers simple enough, and default, for all users.

Re: Prevent users registering with passwords from data breaches

#85

Post by pbhjpbhj »

masa331 wrote: post #80

Please don't use passwords at all. They are wrong for so many reasons. Use emailed sign-in links.

Which, in general rely on your users email password .. which may not be as secure as their bank password, because "email doesn't handle money".

So, to access your bank now crackers just need to get in to your email (which may be true anyway, of course 2FA helps in both cases).

Re: Prevent users registering with passwords from data breaches

#86

Post by ss248 »

hombre_fatal wrote: post #83
ss248 wrote: post #81

Earlier quoted context omitted.

You're right. I don't know why it's still not a common knowledge that nobody bruteforces the login pages in this day and age. But I guess too many people, who have products to sell, benefit from the status quo, so things are not going to change.

No, login pages are definitely "still" brute forced. Why wouldn't they be? It's easier than ever.

>Why wouldn't they be?

Because it's trivial to implement decent ratelimiter which stops attackers, but still allows normal users to login.

Re: Prevent users registering with passwords from data breaches

#87

Post by pbhjpbhj »

rmtech wrote: post #36
cpburns2009 wrote: post #4

And I thought we were getting away from arcane rules for passwords. Now you have to avoid every compromised password from any unrelated account? I may use random passwords, but I don't expect the typical consumer to do the same. Sometimes I simply don't care about security for a one off account on a free service where I'll happily use the simplest permutation of "password" for the password.

If the service doesn't care about security at all then you could just not have a password, log on using your email. If it cares a little bit then you have to characterize exactly how bad it would be if the account was compromised. The right solution might be to just accept any non-blank password that's less than 32 chars or something.

In theory blank passwords aren't a problem for some sites, because usernames shouldn't be the same as display names, and usernames can carry enough entropy to deter simple attacks from outside the organisation?

Re: Prevent users registering with passwords from data breaches

#88

Post by spacehome »

air7 wrote: post #76

This is over the top. Even enforcing password complexity is over-rated. For online attacks, an attacker can't even try the top 1000 passwords on for an account in any major website in reasonable time without triggering the alarm, as they all(?) have rate limiting (usually in the form of account lockdown after single-digit failed attempts). For offline attacks, there first needs to be a breach. While they undoubtedly…

I'm not so sure about that. Hire time on a botnet so you have lots of IPs and start trying mixed usernames with mixed passwords. You won't have any choice over which username you eventually break in with, but I don't think you'd trip any alarms either.

Re: Prevent users registering with passwords from data breaches

#89

Post by nsgi »

ss248 wrote: post #86
hombre_fatal wrote: post #83

Earlier quoted context omitted.

No, login pages are definitely "still" brute forced. Why wouldn't they be? It's easier than ever.

>Why wouldn't they be? Because it's trivial to implement decent ratelimiter which stops attackers, but still allows normal users to login.

Just because it's trivial doesn't mean all websites are doing it.

Re: Prevent users registering with passwords from data breaches

#90

Post by air7 »

hombre_fatal wrote: post #79
air7 wrote: post #76

This is over the top. Even enforcing password complexity is over-rated. For online attacks, an attacker can't even try the top 1000 passwords on for an account in any major website in reasonable time without triggering the alarm, as they all(?) have rate limiting (usually in the form of account lockdown after single-digit failed attempts). For offline attacks, there first needs to be a breach. While they undoubtedly…

Our solution for a bitcoin casino was to generate passwords for users. But you can imagine how few sites can get away with such a thing. Our create-password input was a disabled textfield with a reroll button. Before that, attackers would just wait for new usernames to appear on the scoreboard/chat and check them against password dumps. The easy come, easy go nature of bitcoin made it particularly lucrative. Password…

> Aside, how do you implement account-locking without making it trivial for users to DoS each other that way?

By adding an (increasing) time delay after each failed attempt. However many sites, banking in particular, just lock your account and you have to call them on the phone to reopen it. Totally open for massive DoS but the world still stands.

Post reply on HN