When it comes to composition and length, passwords mostly don't matter • Hacker News Board

Re: When it comes to composition and length, passwords mostly don't matter

#21

Post by danShumway » Thu, Jul 11, 2019, 10:50 PM UTC

Spivak wrote: post #14

danShumway wrote: post #7

> Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA. An important thing to remember here is that MFA works with a password. Otherwise, that 99% goes down dramatically because I can just steal your phone/Yubikey/whatever. This article isn't suggesting that we get rid of passwords. It's suggesting that the energy we spend making sure that passwords are good would be bett…

> Otherwise, that 99% goes down dramatically because I can just steal your phone/Yubikey/whatever. If this were true your car would probably get stolen a lot more often. You're less secure from targeted attacks from people who know you IRL but that's a lot rarer than the attacks you'll actually encounter.

Eh... cars are really big. A better way of phrasing this is, "if this were true, your wallet/phone would get stolen a lot more often."

But aren't wallet/phone thefts relatively common?

> You're less secure from targeted attacks from people who know you IRL

I'm also not completely certain this is true. If a YubiKey is the only thing securing most people's accounts, I don't need to target you. I can walk into a coffee shop, or locker room, or office and steal as many YubiKeys as I can find.

And then I can check later whether or not any of them are linked to bank accounts. I don't know the stats; are most petty wallet/phone thefts targeted?

Re: When it comes to composition and length, passwords mostly don't matter

#22

Post by metildaa » Thu, Jul 11, 2019, 11:40 PM UTC

Polyisoprene wrote: post #12

deogeo wrote: post #9

Earlier quoted context omitted.

A permaban is an awful idea. A legitimate user who forgot their password can easily go through more than 10 failed attempts as they try variations of what they think their own password might be. "I know I used my usual password, but did it start lower or upper case? Or camel case... did I end it with a number? Did the service require a special symbol, so I added that to the end? Or to the beginning.." - banned .

Or getting your account banned after someone failed trying to brute force it and not being able to access it due to changes in security policies.

Fail2ban bans an IP address or range of IPs, not specific users.

Re: When it comes to composition and length, passwords mostly don't matter

#23

Post by privateSFacct » Thu, Jul 11, 2019, 11:41 PM UTC

dillutedfixer wrote: post #20

In my opinion, Microsoft's implementation of MFA on Office 365 (at least our instance) is broken. SMS MFA is inadequate and should not be used, the SS7 network is apparently trivially hackable in some circles and text messages can be rerouted. So they want us to use MS Authenticator, great. However the 365 login screen always has the "Sign in another way" option in which I can just bypass the Authenticator app and us…

This.

I deal with relatively higher volumes of information that must remain secure.

With google, I have hardware authentication device and 10 codes.

Every 30 days or so it asks me to plug in the hardware device. Randomly it asks me more often - I have no idea why but no objection. My password is secure as well and only used on google but THANKFULLY I do not need to change it all the time and so I don't have to write it down. This feels like a reasonably secure approach.

No SMS text option. The idea that your phone number is the key that allows you to reset all your passwords (no matter how complicated / securing no matter how much sensitive info) is ridiculous.

Re: When it comes to composition and length, passwords mostly don't matter

#24

Post by qot » Thu, Jul 11, 2019, 11:43 PM UTC

Someone1234 wrote: post #17

The number one reason I don't turn on MFA has nothing to do with the effort in entering the MFA code/pressing a confirm button. The lifecycle of MFA is the problem. The backup/recovery options are just terrible. You either print out a sheet of "one time codes" (which I need to not lose forever), my phone simply needs to never break, or I need to configure an insecure recovery account (creating a whole chicken/egg pro…

Use an MFA app that supports exporting an encrypted backup, like Aegis.

Re: When it comes to composition and length, passwords mostly don't matter

#25

Post by metildaa » Thu, Jul 11, 2019, 11:43 PM UTC

deogeo wrote: post #9

metildaa wrote: post #8

Earlier quoted context omitted.

Rate-limiting & banning after repeat failed login attempts should be the baseline moat an IT admin or selfhosted infrastructure should have. Fail2ban rules like "after 5 failed logins, ban for 30min, 10 failed logins in a day (with no succesful login) is a permaban" will curtail most non-spear phishing attacks.

A permaban is an awful idea. A legitimate user who forgot their password can easily go through more than 10 failed attempts as they try variations of what they think their own password might be. "I know I used my usual password, but did it start lower or upper case? Or camel case... did I end it with a number? Did the service require a special symbol, so I added that to the end? Or to the beginning.." - banned .

Hence following current NIST guidelines which do not require regular password changes, capitals, special characters or numbers in passwords: https://www.enzoic.com/surprising-new-password-guidelines-ni...

Don't be a PITA to your users, and you've eliminated most of the "guess what password you used" game.

Re: When it comes to composition and length, passwords mostly don't matter

#26

Post by djakjxnanjak » Thu, Jul 11, 2019, 11:45 PM UTC

dillutedfixer wrote: post #20

In my opinion, Microsoft's implementation of MFA on Office 365 (at least our instance) is broken. SMS MFA is inadequate and should not be used, the SS7 network is apparently trivially hackable in some circles and text messages can be rerouted. So they want us to use MS Authenticator, great. However the 365 login screen always has the "Sign in another way" option in which I can just bypass the Authenticator app and us…

Does anyone know if there’s a way to prevent your SMS from being rerouted, or get a special protected number?

The ability to do this would not mitigate Microsoft’s responsibilities here, but at least it would allow some people to help themselves.

Re: When it comes to composition and length, passwords mostly don't matter

#27

Post by pier25 » Thu, Jul 11, 2019, 11:48 PM UTC

> 500M is ½ a billion, home rigs can run 100B guesses a second – so that complete list just takes 5ms to try.

5ms?

It would take more than that to just read the 500M passwords into memory, no?

Re: When it comes to composition and length, passwords mostly don't matter

#28

Post by RandomInteger4 » Thu, Jul 11, 2019, 11:53 PM UTC

q_queue wrote: post #18

default-kramer wrote: post #2

> Your password doesn’t matter, but MFA does! Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA. I'd be much more interested what that percentage is when you only consider people who use password managers. (Which is not to imply that MFA isn't good.)

Furthermore many sites make it difficult to use a password manager because it's hard to block automated password guessers and not interfere with password managers trying to enter passwords.

The web developers that think like this are bad at web development, and likely security. Why would anyone trying to brute force your authentication portal care about using your UI?

Re: When it comes to composition and length, passwords mostly don't matter

#29

Post by smitty1e » Thu, Jul 11, 2019, 11:55 PM UTC

privateSFacct wrote: post #23

dillutedfixer wrote: post #20

In my opinion, Microsoft's implementation of MFA on Office 365 (at least our instance) is broken. SMS MFA is inadequate and should not be used, the SS7 network is apparently trivially hackable in some circles and text messages can be rerouted. So they want us to use MS Authenticator, great. However the 365 login screen always has the "Sign in another way" option in which I can just bypass the Authenticator app and us…

This. I deal with relatively higher volumes of information that must remain secure. With google, I have hardware authentication device and 10 codes. Every 30 days or so it asks me to plug in the hardware device. Randomly it asks me more often - I have no idea why but no objection. My password is secure as well and only used on google but THANKFULLY I do not need to change it all the time and so I don't have to write…

Any redundancy on that piece of hardware?

"Two is one and one is none," as the Special Operations folks will explain.

Sure, the math is squirrely; but the sentiment is real.

Re: When it comes to composition and length, passwords mostly don't matter

#30

Post by mquander » Thu, Jul 11, 2019, 11:57 PM UTC

I think the thesis of this article is rather forced. The actual claim is something like:

"Passwords don't matter, as long as your password isn't in the top few dozen common ones, it's not in any credentials breach accessible to attackers, it's longer than 8 characters or so, and you don't reuse it."

That was a lot of criteria that seemed to matter, if you ask me.