Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When it comes to composition and length, passwords mostly don't matter

techcommunity.microsoft.com

Post reply on HN
Print view View original

91–100 of 160 posts

Re: When it comes to composition and length, passwords mostly don't matter

#91

Post by gdfiutyer »

dillutedfixer wrote: post #20

In my opinion, Microsoft's implementation of MFA on Office 365 (at least our instance) is broken. SMS MFA is inadequate and should not be used, the SS7 network is apparently trivially hackable in some circles and text messages can be rerouted. So they want us to use MS Authenticator, great. However the 365 login screen always has the "Sign in another way" option in which I can just bypass the Authenticator app and us…

Apple’s iCloud Accounts are the same now. They now require a phone number for new accounts and there is no way to remove the number.

Re: When it comes to composition and length, passwords mostly don't matter

#92

Post by gdfiutyer »

red_phone wrote: post #44
djakjxnanjak wrote: post #26

Earlier quoted context omitted.

Does anyone know if there’s a way to prevent your SMS from being rerouted, or get a special protected number? The ability to do this would not mitigate Microsoft’s responsibilities here, but at least it would allow some people to help themselves.

I'm not a subject matter expert, but a Google Voice number can be used to receive texts and is protected by the relatively robust security of your Google account.

Unfortunately, some services won’t accept a Google Voice or any voip number.

Re: When it comes to composition and length, passwords mostly don't matter

#93

Post by tempestn »

rkagerer wrote: post #83

If you are using a password manager, use the maximum possible length – there’s no usability downside if you are already cutting and pasting. That's fine and dandy until you need to manually type it in somewhere (e.g. reading it from your phone, typing it in on another device). Has this guy ever even used a password manager? He understands how they work in theory, but in practice it's not always quite so clean. Humans…

From that and lines like this one, I'm guessing the author does not use a password manager:

> use more than 8 characters, or use a password manager if you are really nervous

Also the article mentions that pw managers will get you long passwords, which will protect against brute force, but doesn't really mention the more significant benefit, that they protect against password reuse. Not to mention they're far more convenient than trying to remember strong passwords.

So don't use a PW manager only if you're really nervous. Just use one, full stop.

(But yeah, set password length at something like 13-14 characters. More than that doesn't provide any real world benefit, and there will occasionally be cases where you have to type it in. Plus you'll hit fewer snags with poorly designed systems enforcing max pw length.)

Re: When it comes to composition and length, passwords mostly don't matter

#94

Post by LeonB »

sxates wrote: post #86
rkagerer wrote: post #83

If you are using a password manager, use the maximum possible length – there’s no usability downside if you are already cutting and pasting. That's fine and dandy until you need to manually type it in somewhere (e.g. reading it from your phone, typing it in on another device). Has this guy ever even used a password manager? He understands how they work in theory, but in practice it's not always quite so clean. Humans…

The best is typing that 20 character mixed-case-plus-numbers-and-symbols password for Netflix into your TV app using an on screen keyboard and directional arrows...

Signing into some new tvs recently, the google account sign in experience was better than Netflix sign in, as it let you use your phone to sign in (once you’d scanned a QR code shown on screen).

Re: When it comes to composition and length, passwords mostly don't matter

#95

Post by war1025 »

sxates wrote: post #86
rkagerer wrote: post #83

If you are using a password manager, use the maximum possible length – there’s no usability downside if you are already cutting and pasting. That's fine and dandy until you need to manually type it in somewhere (e.g. reading it from your phone, typing it in on another device). Has this guy ever even used a password manager? He understands how they work in theory, but in practice it's not always quite so clean. Humans…

The best is typing that 20 character mixed-case-plus-numbers-and-symbols password for Netflix into your TV app using an on screen keyboard and directional arrows...

I generate my passwords with:

$ head -c 100 /dev/urandom | sha256sum

Same pain as you any time I have to type the password in someplace I don't have my password manager installed, but with the advantage that its just [0-9a-f]. I figure with that many characters there's no need to use the full character set.

Also honestly just tend to use weaker passwords on things I'll need to log into on other machines. Usually those are accounts I don't care as much about anyway.

Re: When it comes to composition and length, passwords mostly don't matter

#96

Post by [deleted] »

rkagerer wrote: post #83

If you are using a password manager, use the maximum possible length – there’s no usability downside if you are already cutting and pasting. That's fine and dandy until you need to manually type it in somewhere (e.g. reading it from your phone, typing it in on another device). Has this guy ever even used a password manager? He understands how they work in theory, but in practice it's not always quite so clean. Humans…

[deleted]

Re: When it comes to composition and length, passwords mostly don't matter

#97

Post by snowwrestler »

danShumway wrote: post #7

> Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA. An important thing to remember here is that MFA works with a password. Otherwise, that 99% goes down dramatically because I can just steal your phone/Yubikey/whatever. This article isn't suggesting that we get rid of passwords. It's suggesting that the energy we spend making sure that passwords are good would be bett…

Microsoft does intend to get rid of passwords altogether:

https://techcommunity.microsoft.com/t5/Azure-Active-Director...

Re: When it comes to composition and length, passwords mostly don't matter

#98

Post by function_seven »

sxates wrote: post #86
rkagerer wrote: post #83

If you are using a password manager, use the maximum possible length – there’s no usability downside if you are already cutting and pasting. That's fine and dandy until you need to manually type it in somewhere (e.g. reading it from your phone, typing it in on another device). Has this guy ever even used a password manager? He understands how they work in theory, but in practice it's not always quite so clean. Humans…

The best is typing that 20 character mixed-case-plus-numbers-and-symbols password for Netflix into your TV app using an on screen keyboard and directional arrows...

This is a huge benefit of AppleTV and having an iOS device. When the password is prompted for on the TV, my phone buzzes and I use the LastPass vault on the phone to paste the gibberish automatically.

I'm sure there are similar schemes for other devices (Chromecast/FireTV?). But when the TV itself is "smart", I bet it's infuriating.

Re: When it comes to composition and length, passwords mostly don't matter

#99

Post by closeparen »

DecoPerson wrote: post #5

If we start thinking passwords don't matter, we go back to single-factor authentication. What makes the "second" factor in 2FA more secure than the first? Is that it's usually a time-based generated key? Or is it that users usually use a physical device for this second key, hence removing a lot of internet-only attack vectors?

TOTP and U2F both perform a single authentication from a captive secret, rather than revealing a reusable secret.

U2F does even better, and ensures you are authenticating to the right website, not an intermediary.

If we eliminated passwords in favor of onboard U2F chips, we'd be much better off than today, though not as amazing as U2F + passwords.

Re: When it comes to composition and length, passwords mostly don't matter

#100

Post by tempestn »

smacktoward wrote: post #10
TimTheTinker wrote: post #6

Note this is from the perspective of a security decision maker, like an IT administrator. Policy-wise, users can't be forced or trusted to create excellent passwords on their own. But as an individual, your passwords do matter. It makes a world of a difference to use a password manager and long, completely random passwords - such passwords are immune to all sorts of cracking attempts, and using them can often make MF…

The point of the article is that many common attacks work just as well against completely random, unique passwords as they do against weak/reused ones. If you get phished, it doesn't matter if your password is strong. If your machine has a keylogger on it, it doesn't matter if your password is strong. Etc. Lots of attacks boil down to the attacker convincing you to unknowingly divulge your password, and if that passw…

The point of the article is that strong passwords are mostly useless, but unique passwords are very important. The article doesn't emphasize this, nor does it point out that this is the primary benefit of password managers. However, the very first attack they describe, which is listed as very high frequency and very easy, is credential stuffing—ie, trying credentials from a breach in other places. Unique passwords completely prevent this common attack.
Post reply on HN