Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When it comes to composition and length, passwords mostly don't matter

techcommunity.microsoft.com

Post reply on HN
Print view View original

41–50 of 160 posts

Re: When it comes to composition and length, passwords mostly don't matter

#41

Post by jessriedel »

zaroth wrote: post #39
jessriedel wrote: post #15

Earlier quoted context omitted.

Do you guys specifically alert the user that the password has been exposed publicly? If I got that sort of message, I would be grateful to the website rather than annoyed I couldn't use my favorite password.

Not the password for you , just that password, for someone, on some site, ever. If that’s happened thousands of times, sure, that’s the sign of a relatively common/weak password. If it’s happened once? I’d be frustrated if I was trying to pick something memorable and got stuck because of that.

Yes, I understand it was whether it's exposed anywhere, not just for this user. If it was someone else's password, I would still find it super valuable information to know I'm using something that's common enough to have been used by a stranger.

Re: When it comes to composition and length, passwords mostly don't matter

#42

Post by closeparen »

Someone1234 wrote: post #17

The number one reason I don't turn on MFA has nothing to do with the effort in entering the MFA code/pressing a confirm button. The lifecycle of MFA is the problem. The backup/recovery options are just terrible. You either print out a sheet of "one time codes" (which I need to not lose forever), my phone simply needs to never break, or I need to configure an insecure recovery account (creating a whole chicken/egg pro…

I hope a future version of U2F will support enrolling a not-physically-present token by public key.

Re: When it comes to composition and length, passwords mostly don't matter

#43

Post by padobson »

mquander wrote: post #30

I think the thesis of this article is rather forced. The actual claim is something like: "Passwords don't matter, as long as your password isn't in the top few dozen common ones, it's not in any credentials breach accessible to attackers, it's longer than 8 characters or so, and you don't reuse it." That was a lot of criteria that seemed to matter, if you ask me.

And also "Passwords don't matter as long as you aren't important enough or connected to a person or organization important enough to try more than the most routine password vulnerabilities"

Re: When it comes to composition and length, passwords mostly don't matter

#44

Post by red_phone »

djakjxnanjak wrote: post #26
dillutedfixer wrote: post #20

In my opinion, Microsoft's implementation of MFA on Office 365 (at least our instance) is broken. SMS MFA is inadequate and should not be used, the SS7 network is apparently trivially hackable in some circles and text messages can be rerouted. So they want us to use MS Authenticator, great. However the 365 login screen always has the "Sign in another way" option in which I can just bypass the Authenticator app and us…

Does anyone know if there’s a way to prevent your SMS from being rerouted, or get a special protected number? The ability to do this would not mitigate Microsoft’s responsibilities here, but at least it would allow some people to help themselves.

I'm not a subject matter expert, but a Google Voice number can be used to receive texts and is protected by the relatively robust security of your Google account.

Re: When it comes to composition and length, passwords mostly don't matter

#45

Post by floo »

pier25 wrote: post #27

> 500M is ½ a billion, home rigs can run 100B guesses a second – so that complete list just takes 5ms to try. 5ms? It would take more than that to just read the 500M passwords into memory, no?

Well yeah. But you, presumably, only have to do that once. After that you get 5ms per account, which seems to be the important takeaway.

Re: When it comes to composition and length, passwords mostly don't matter

#46

Post by kortilla »

red_phone wrote: post #44
djakjxnanjak wrote: post #26

Earlier quoted context omitted.

Does anyone know if there’s a way to prevent your SMS from being rerouted, or get a special protected number? The ability to do this would not mitigate Microsoft’s responsibilities here, but at least it would allow some people to help themselves.

I'm not a subject matter expert, but a Google Voice number can be used to receive texts and is protected by the relatively robust security of your Google account.

If the issue is the SS7 network, that won’t help unless the originating text is also in Google Voice.

Re: When it comes to composition and length, passwords mostly don't matter

#47

Post by kortilla »

danShumway wrote: post #21
Spivak wrote: post #14

Earlier quoted context omitted.

> Otherwise, that 99% goes down dramatically because I can just steal your phone/Yubikey/whatever. If this were true your car would probably get stolen a lot more often. You're less secure from targeted attacks from people who know you IRL but that's a lot rarer than the attacks you'll actually encounter.

Eh... cars are really big. A better way of phrasing this is, "if this were true, your wallet/phone would get stolen a lot more often." But aren't wallet/phone thefts relatively common? > You're less secure from targeted attacks from people who know you IRL I'm also not completely certain this is true. If a YubiKey is the only thing securing most people's accounts, I don't need to target you. I can walk into a coffee…

A wallet is useful to a thief, a yubikey is not.

There is little overlap between petty thieves and people trying to get into a particular target’s account.

Re: When it comes to composition and length, passwords mostly don't matter

#48

Post by q_queue »

gpm wrote: post #33
RandomInteger4 wrote: post #28

Earlier quoted context omitted.

The web developers that think like this are bad at web development, and likely security. Why would anyone trying to brute force your authentication portal care about using your UI?

This is giving me bad ideas about making the UI (and only way to log in) be to send the password 1 character at a time as it's typed, and then using some form of ml to try and identify probable bots. You'd probably mostly catch password managers and people copy-pasting passwords though. If you had per-user fingerprints also people typing on a new device...

I think this is actually done, and I wish I could remember the godforsaken website I encountered it on.

Re: When it comes to composition and length, passwords mostly don't matter

#49

Post by methodover »

jessriedel wrote: post #15
methodover wrote: post #13

This is a good article. However, in regards to credential stuffing: > Some guidance says to ban all passwords on this list. Try that and see how successful your users are at choosing passwords at all. We're doing that. We don't let you choose any password that's been discovered in a prior breach. Did Microsoft implement the same thing and discover a high rate of users bouncing off the registration page?

Do you guys specifically alert the user that the password has been exposed publicly? If I got that sort of message, I would be grateful to the website rather than annoyed I couldn't use my favorite password.

We do yeah.

Here's the text: "This password has previously appeared in a data breach. Please choose a more secure alternative."

Re: When it comes to composition and length, passwords mostly don't matter

#50

Post by elliekelly »

dillutedfixer wrote: post #20

In my opinion, Microsoft's implementation of MFA on Office 365 (at least our instance) is broken. SMS MFA is inadequate and should not be used, the SS7 network is apparently trivially hackable in some circles and text messages can be rerouted. So they want us to use MS Authenticator, great. However the 365 login screen always has the "Sign in another way" option in which I can just bypass the Authenticator app and us…

Can you explain this a bit further? We just switched to Office 365 and I ran into this today but I had assumed user error. So even though I have an authentication key set up there’s always the possibility that a password reset can be authenticated via my phone number?
Post reply on HN