Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When it comes to composition and length, passwords mostly don't matter

techcommunity.microsoft.com

Post reply on HN
Print view View original

31–40 of 160 posts

Re: When it comes to composition and length, passwords mostly don't matter

#31

Post by stouset »

smitty1e wrote: post #29
privateSFacct wrote: post #23

Earlier quoted context omitted.

This. I deal with relatively higher volumes of information that must remain secure. With google, I have hardware authentication device and 10 codes. Every 30 days or so it asks me to plug in the hardware device. Randomly it asks me more often - I have no idea why but no objection. My password is secure as well and only used on google but THANKFULLY I do not need to change it all the time and so I don't have to write…

Any redundancy on that piece of hardware? "Two is one and one is none," as the Special Operations folks will explain. Sure, the math is squirrely; but the sentiment is real.

The recovery codes.

Re: When it comes to composition and length, passwords mostly don't matter

#32

Post by mquander »

Someone1234 wrote: post #17

The number one reason I don't turn on MFA has nothing to do with the effort in entering the MFA code/pressing a confirm button. The lifecycle of MFA is the problem. The backup/recovery options are just terrible. You either print out a sheet of "one time codes" (which I need to not lose forever), my phone simply needs to never break, or I need to configure an insecure recovery account (creating a whole chicken/egg pro…

I was blown away when I discovered that there was no way for me to export my Google Authenticator TOTP secrets from my locked Android phone, since unlocking it wipes the disk. I guess I will not make the mistake of not immediately unlocking an Android phone again.

Re: When it comes to composition and length, passwords mostly don't matter

#33

Post by gpm »

RandomInteger4 wrote: post #28
q_queue wrote: post #18

Earlier quoted context omitted.

Furthermore many sites make it difficult to use a password manager because it's hard to block automated password guessers and not interfere with password managers trying to enter passwords.

The web developers that think like this are bad at web development, and likely security. Why would anyone trying to brute force your authentication portal care about using your UI?

This is giving me bad ideas about making the UI (and only way to log in) be to send the password 1 character at a time as it's typed, and then using some form of ml to try and identify probable bots.

You'd probably mostly catch password managers and people copy-pasting passwords though. If you had per-user fingerprints also people typing on a new device...

Re: When it comes to composition and length, passwords mostly don't matter

#34

Post by simonebrunozzi »

privateSFacct wrote: post #23
dillutedfixer wrote: post #20

In my opinion, Microsoft's implementation of MFA on Office 365 (at least our instance) is broken. SMS MFA is inadequate and should not be used, the SS7 network is apparently trivially hackable in some circles and text messages can be rerouted. So they want us to use MS Authenticator, great. However the 365 login screen always has the "Sign in another way" option in which I can just bypass the Authenticator app and us…

This. I deal with relatively higher volumes of information that must remain secure. With google, I have hardware authentication device and 10 codes. Every 30 days or so it asks me to plug in the hardware device. Randomly it asks me more often - I have no idea why but no objection. My password is secure as well and only used on google but THANKFULLY I do not need to change it all the time and so I don't have to write…

> No SMS text option. ... ridicolous

Agreed. My Twitter account was recently hacked thanks to T-Mobile's incompetence. [0]

[0]: https://medium.com/@simon/mobile-twitter-hacked-please-help-...

Re: When it comes to composition and length, passwords mostly don't matter

#35

Post by will4274 »

oceliker wrote: post #16

This is somewhat unrelated, but I think the Microsoft 2FA (in Outlook, Skype, Xbox, etc.) has a lot of unnecessary friction. After entering my password, the app usually takes me to a second page where I am required to type out my email address. I'd much rather prefer that I get an email immediately, because the way things currently are, I won't be notified of any attempts that breach my password but not my 2FA. It pr…

> It provides no perceivable security benefit to me (and if someone did hijack my email account, then they know my address anyway).

I think you're over focused on targeted attacks. Consider: some company gets hacked. Hackers take the credential list, try all the passwords for @outlook accounts against Microsoft using cloud VMs to avoid IP blocking. If Microsoft displayed the full email address without having the user re-type it, the attacker has now discovered the TFA email address and will try the same hacked password against that (usually Gmail) account. If Microsoft displays nothing, users with multiple emails get confused about which inbox to check. Displaying a starred out email address and asking for a re-type solves both problems. It also prevents Microsoft from having a huge SMS bill each time a big company gets hacked and the hackers try all the passwords.

The solution for Xbox is really for Xbox to use a flow designed for low input devices, like the OAuth device flow which allows you to do all the typing on your computer of cell phone, not the Xbox controller.

Re: When it comes to composition and length, passwords mostly don't matter

#36

Post by hombre_fatal »

metildaa wrote: post #22
Polyisoprene wrote: post #12

Earlier quoted context omitted.

Or getting your account banned after someone failed trying to brute force it and not being able to access it due to changes in security policies.

Fail2ban bans an IP address or range of IPs, not specific users.

That advice is pretty antiquated.

The reality is that, these days, I rent $5 worth of botnet time and make {user,password} combo login attempts from thousands of residential IP addresses.

You might think your advice is a good "might as well" elementary, but generally if people want to curl your /login page from their laptop, then they are also buying $5 scripts off Hack-Forums that automate botnet cred stuffing against your service as well. And you'll need a better gameplan than fail2ban.

Re: When it comes to composition and length, passwords mostly don't matter

#37

Post by jedberg »

default-kramer wrote: post #2

> Your password doesn’t matter, but MFA does! Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA. I'd be much more interested what that percentage is when you only consider people who use password managers. (Which is not to imply that MFA isn't good.)

It's hard to know who is using a password manager, but I'm sure the number is much lower, because if you're using a password manager, you are most likely smart enough to avoid phishing and some of the other attacks too (not always, but at least much more likely to be conscience about these things).

Re: When it comes to composition and length, passwords mostly don't matter

#38

Post by oceliker »

will4274 wrote: post #35
oceliker wrote: post #16

This is somewhat unrelated, but I think the Microsoft 2FA (in Outlook, Skype, Xbox, etc.) has a lot of unnecessary friction. After entering my password, the app usually takes me to a second page where I am required to type out my email address. I'd much rather prefer that I get an email immediately, because the way things currently are, I won't be notified of any attempts that breach my password but not my 2FA. It pr…

> It provides no perceivable security benefit to me (and if someone did hijack my email account, then they know my address anyway). I think you're over focused on targeted attacks. Consider: some company gets hacked. Hackers take the credential list, try all the passwords for @outlook accounts against Microsoft using cloud VMs to avoid IP blocking. If Microsoft displayed the full email address without having the user…

> Displaying a starred out email address and asking for a re-type solves both problems.

Sure, but why not simply show the starred out email without asking for the re-type?

I agree with the Xbox idea, that would perfectly solve the problem.

Re: When it comes to composition and length, passwords mostly don't matter

#39

Post by zaroth »

jessriedel wrote: post #15
methodover wrote: post #13

This is a good article. However, in regards to credential stuffing: > Some guidance says to ban all passwords on this list. Try that and see how successful your users are at choosing passwords at all. We're doing that. We don't let you choose any password that's been discovered in a prior breach. Did Microsoft implement the same thing and discover a high rate of users bouncing off the registration page?

Do you guys specifically alert the user that the password has been exposed publicly? If I got that sort of message, I would be grateful to the website rather than annoyed I couldn't use my favorite password.

Not the password for you, just that password, for someone, on some site, ever.

If that’s happened thousands of times, sure, that’s the sign of a relatively common/weak password. If it’s happened once? I’d be frustrated if I was trying to pick something memorable and got stuck because of that.

Re: When it comes to composition and length, passwords mostly don't matter

#40

Post by spydum »

gpm wrote: post #33
RandomInteger4 wrote: post #28

Earlier quoted context omitted.

The web developers that think like this are bad at web development, and likely security. Why would anyone trying to brute force your authentication portal care about using your UI?

This is giving me bad ideas about making the UI (and only way to log in) be to send the password 1 character at a time as it's typed, and then using some form of ml to try and identify probable bots. You'd probably mostly catch password managers and people copy-pasting passwords though. If you had per-user fingerprints also people typing on a new device...

I’m pretty sure that would be unmanageable, but love to see it tried.. Are you thinking of each character acting more like a number in a combination lock and needing to be provided to the app sequentially to be checked? I dont get how you distinguish between password managers and bots or API dictionary attacks on the same interface?
Post reply on HN