Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When it comes to composition and length, passwords mostly don't matter

techcommunity.microsoft.com

Post reply on HN
Print view View original

11–20 of 160 posts

Re: When it comes to composition and length, passwords mostly don't matter

#11

Post by Latty »

DecoPerson wrote: post #5

If we start thinking passwords don't matter, we go back to single-factor authentication. What makes the "second" factor in 2FA more secure than the first? Is that it's usually a time-based generated key? Or is it that users usually use a physical device for this second key, hence removing a lot of internet-only attack vectors?

Definitely your second point, although it's worth noting that mobile authentication apps are still weak (although not as weak as just a password) to remote phishing attacks where security keys aren't.

Mobile authentication apps rely on the user only typing that code into the right website—and people suck at noticing if they are on the wrong site. Right now, this is mostly only a problem with spear-phishing as most don't bother, but if 2FA becomes too popular, they'll start to adapt.

Security keys, on the other hand, get the host directly from the browser. This means they should be safe even if you fall for a phishing attack.

Re: When it comes to composition and length, passwords mostly don't matter

#12

Post by Polyisoprene »

deogeo wrote: post #9
metildaa wrote: post #8

Earlier quoted context omitted.

Rate-limiting & banning after repeat failed login attempts should be the baseline moat an IT admin or selfhosted infrastructure should have. Fail2ban rules like "after 5 failed logins, ban for 30min, 10 failed logins in a day (with no succesful login) is a permaban" will curtail most non-spear phishing attacks.

A permaban is an awful idea. A legitimate user who forgot their password can easily go through more than 10 failed attempts as they try variations of what they think their own password might be. "I know I used my usual password, but did it start lower or upper case? Or camel case... did I end it with a number? Did the service require a special symbol, so I added that to the end? Or to the beginning.." - banned .

Or getting your account banned after someone failed trying to brute force it and not being able to access it due to changes in security policies.

Re: When it comes to composition and length, passwords mostly don't matter

#13

Post by methodover »

This is a good article. However, in regards to credential stuffing:

> Some guidance says to ban all passwords on this list. Try that and see how successful your users are at choosing passwords at all.

We're doing that. We don't let you choose any password that's been discovered in a prior breach.

Did Microsoft implement the same thing and discover a high rate of users bouncing off the registration page?

Re: When it comes to composition and length, passwords mostly don't matter

#14

Post by Spivak »

danShumway wrote: post #7

> Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA. An important thing to remember here is that MFA works with a password. Otherwise, that 99% goes down dramatically because I can just steal your phone/Yubikey/whatever. This article isn't suggesting that we get rid of passwords. It's suggesting that the energy we spend making sure that passwords are good would be bett…

> Otherwise, that 99% goes down dramatically because I can just steal your phone/Yubikey/whatever.

If this were true your car would probably get stolen a lot more often. You're less secure from targeted attacks from people who know you IRL but that's a lot rarer than the attacks you'll actually encounter.

Re: When it comes to composition and length, passwords mostly don't matter

#15

Post by jessriedel »

methodover wrote: post #13

This is a good article. However, in regards to credential stuffing: > Some guidance says to ban all passwords on this list. Try that and see how successful your users are at choosing passwords at all. We're doing that. We don't let you choose any password that's been discovered in a prior breach. Did Microsoft implement the same thing and discover a high rate of users bouncing off the registration page?

Do you guys specifically alert the user that the password has been exposed publicly? If I got that sort of message, I would be grateful to the website rather than annoyed I couldn't use my favorite password.

Re: When it comes to composition and length, passwords mostly don't matter

#16

Post by oceliker »

This is somewhat unrelated, but I think the Microsoft 2FA (in Outlook, Skype, Xbox, etc.) has a lot of unnecessary friction.

After entering my password, the app usually takes me to a second page where I am required to type out my email address. I'd much rather prefer that I get an email immediately, because the way things currently are, I won't be notified of any attempts that breach my password but not my 2FA. It provides no perceivable security benefit to me (and if someone did hijack my email account, then they know my address anyway).

If I pick the text message option, then (after confirming my number the same way as above) I get a 7-digit code. For some odd reason, I find it much more difficult to remember a 7-digit code than a 6-digit one, which seems to be standard for most other companies. I don't see any extra security benefit in a longer 2FA code, but maybe there's a valid reason for this one.

The issues above are mildly annoying on a PC. In an Xbox, however, with the onscreen keyboard, it honestly makes me want to throw my console out the window.

Re: When it comes to composition and length, passwords mostly don't matter

#17

Post by Someone1234 »

The number one reason I don't turn on MFA has nothing to do with the effort in entering the MFA code/pressing a confirm button. The lifecycle of MFA is the problem.

The backup/recovery options are just terrible. You either print out a sheet of "one time codes" (which I need to not lose forever), my phone simply needs to never break, or I need to configure an insecure recovery account (creating a whole chicken/egg problem).

This is in no way mitigated by using physical keys either. Which can also be lost/broken/stolen/etc. You still need recovery/backup.

Plus a ton of vendors allow customer support to trivially turn off MFA via social-engineering, so what is the point? If people want MFA to be more common, make the lifecycle better. Right now the backup/recovery situation is all over the place and frankly bad.

Re: When it comes to composition and length, passwords mostly don't matter

#18

Post by q_queue »

default-kramer wrote: post #2

> Your password doesn’t matter, but MFA does! Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA. I'd be much more interested what that percentage is when you only consider people who use password managers. (Which is not to imply that MFA isn't good.)

Furthermore many sites make it difficult to use a password manager because it's hard to block automated password guessers and not interfere with password managers trying to enter passwords.

Re: When it comes to composition and length, passwords mostly don't matter

#19

Post by [deleted] »

Someone1234 wrote: post #17

The number one reason I don't turn on MFA has nothing to do with the effort in entering the MFA code/pressing a confirm button. The lifecycle of MFA is the problem. The backup/recovery options are just terrible. You either print out a sheet of "one time codes" (which I need to not lose forever), my phone simply needs to never break, or I need to configure an insecure recovery account (creating a whole chicken/egg pro…

[deleted]

Re: When it comes to composition and length, passwords mostly don't matter

#20

Post by dillutedfixer »

In my opinion, Microsoft's implementation of MFA on Office 365 (at least our instance) is broken. SMS MFA is inadequate and should not be used, the SS7 network is apparently trivially hackable in some circles and text messages can be rerouted. So they want us to use MS Authenticator, great. However the 365 login screen always has the "Sign in another way" option in which I can just bypass the Authenticator app and use an SMS text. I cannot remove my mobile number from my profile to disable the option to SMS text because they are worried about me losing access to my app. I don't know if this is a limitation of Office 365 through our VAR or what, but it just seems pointless to offer an Authenticator app if there's an easy way to fall back to SMS and no way to disable SMS. If someone has my password and can reroute my text messages, a fancy shmancy Authenticator app is pointless. If this is not how it is for others with 365 I would love to know that, I hope it's not a limitation or policy put in place by our VAR.
Post reply on HN