Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When it comes to composition and length, passwords mostly don't matter

techcommunity.microsoft.com

Post reply on HN
Print view View original

101–110 of 160 posts

Re: When it comes to composition and length, passwords mostly don't matter

#101

Post by mNovak »

mquander wrote: post #32
Someone1234 wrote: post #17

The number one reason I don't turn on MFA has nothing to do with the effort in entering the MFA code/pressing a confirm button. The lifecycle of MFA is the problem. The backup/recovery options are just terrible. You either print out a sheet of "one time codes" (which I need to not lose forever), my phone simply needs to never break, or I need to configure an insecure recovery account (creating a whole chicken/egg pro…

I was blown away when I discovered that there was no way for me to export my Google Authenticator TOTP secrets from my locked Android phone, since unlocking it wipes the disk. I guess I will not make the mistake of not immediately unlocking an Android phone again.

Likewise, it was not fun when my phone with GA suprise died. Many services with 2FA do not provide backup codes. I switched over to Authy for this reason--they allow an encrypted backup of the TOTP secrets.

Re: When it comes to composition and length, passwords mostly don't matter

#102

Post by dillutedfixer »

elliekelly wrote: post #90
dillutedfixer wrote: post #68

Earlier quoted context omitted.

When I uncheck Authentication phone I get a red error message: "Configure at least one phone so that if you lose the app you are not locked out of the account." If You are able to remove it, I’m wondering if there is some sort of policy or limitation our VAR is adding to our instance. edit - added quotes to the error message

Yes, same thing happens to me. I’m the first account (and the only current admin) that purchased all the licenses so I wonder if that’s why. Is your account an admin or do you have any additional privileges? It makes sense that they need at least one phone number on file but there should be a way to opt out of SMS 2FA.

There are 2 other admins in our domain. We all get the same error. Through the Azure console I can disable MFA for other accounts, so even if I lost my app, one of the other 2 admins could just disable MFA until I re-enable it on another device.

Re: When it comes to composition and length, passwords mostly don't matter

#103

Post by mNovak »

neotek wrote: post #58
q_queue wrote: post #18

Earlier quoted context omitted.

Furthermore many sites make it difficult to use a password manager because it's hard to block automated password guessers and not interfere with password managers trying to enter passwords.

My old bank used to "encrypt" your password as you typed it into the input field, on keydown it would take the character you typed and — and I'm not making this up — ROT13 it . This had the effect of making it impossible to paste anything into the input field since the script would capture your ctrl+v and replace it with the letter "i". The icing on the cake is that when I called to complain about it, the support age…

This reminds me of the time I was trying to explain to the Verizon store rep why I was concerned that my SIM suddenly went offline, and they told me "Oh hun, nobody steals a phone number!"

Re: When it comes to composition and length, passwords mostly don't matter

#104

Post by jimmaswell »

sxates wrote: post #86
rkagerer wrote: post #83

If you are using a password manager, use the maximum possible length – there’s no usability downside if you are already cutting and pasting. That's fine and dandy until you need to manually type it in somewhere (e.g. reading it from your phone, typing it in on another device). Has this guy ever even used a password manager? He understands how they work in theory, but in practice it's not always quite so clean. Humans…

The best is typing that 20 character mixed-case-plus-numbers-and-symbols password for Netflix into your TV app using an on screen keyboard and directional arrows...

Does Netflix show your full card number to you if you're logged in or is there some other justification for this level of security on it?

Re: When it comes to composition and length, passwords mostly don't matter

#105

Post by dillutedfixer »

djakjxnanjak wrote: post #26
dillutedfixer wrote: post #20

In my opinion, Microsoft's implementation of MFA on Office 365 (at least our instance) is broken. SMS MFA is inadequate and should not be used, the SS7 network is apparently trivially hackable in some circles and text messages can be rerouted. So they want us to use MS Authenticator, great. However the 365 login screen always has the "Sign in another way" option in which I can just bypass the Authenticator app and us…

Does anyone know if there’s a way to prevent your SMS from being rerouted, or get a special protected number? The ability to do this would not mitigate Microsoft’s responsibilities here, but at least it would allow some people to help themselves.

>> or get a special protected number?

That's an interesting point. Maybe an unlisted burner that you don't use for anything else could be your SMS backup number. At least that adds one small layer of security.

It's like being in an episode of The Wire just to stay semi-secure online ;-).

Re: When it comes to composition and length, passwords mostly don't matter

#106

Post by josteink »

tempestn wrote: post #93
rkagerer wrote: post #83

If you are using a password manager, use the maximum possible length – there’s no usability downside if you are already cutting and pasting. That's fine and dandy until you need to manually type it in somewhere (e.g. reading it from your phone, typing it in on another device). Has this guy ever even used a password manager? He understands how they work in theory, but in practice it's not always quite so clean. Humans…

From that and lines like this one, I'm guessing the author does not use a password manager: > use more than 8 characters, or use a password manager if you are really nervous Also the article mentions that pw managers will get you long passwords, which will protect against brute force, but doesn't really mention the more significant benefit, that they protect against password reuse. Not to mention they're far more con…

> So don't use a PW manager only if you're really nervous. Just use one, full stop.

And all modern browsers ship with one included, so it’s not like it’s hard to get started.

Re: When it comes to composition and length, passwords mostly don't matter

#107

Post by galkk »

rkagerer wrote: post #83

If you are using a password manager, use the maximum possible length – there’s no usability downside if you are already cutting and pasting. That's fine and dandy until you need to manually type it in somewhere (e.g. reading it from your phone, typing it in on another device). Has this guy ever even used a password manager? He understands how they work in theory, but in practice it's not always quite so clean. Humans…

Totally agree. VUDU app on my smart tv required me to log on every couple months, and I stopped using it eventually.

Re: When it comes to composition and length, passwords mostly don't matter

#108

Post by roganartu »

jimmaswell wrote: post #104
sxates wrote: post #86

Earlier quoted context omitted.

The best is typing that 20 character mixed-case-plus-numbers-and-symbols password for Netflix into your TV app using an on screen keyboard and directional arrows...

Does Netflix show your full card number to you if you're logged in or is there some other justification for this level of security on it?

You need to login because accounts have different quality tiers (standard vs high definition) and different max concurrent user counts.

Hulu does this much better though. They display a hulu.com shortlink on the TV app that you type into your browser on a computer, login if you aren't already, and click a button to authorise the TV.

Re: When it comes to composition and length, passwords mostly don't matter

#109

Post by Zancarius »

neotek wrote: post #85
gruez wrote: post #73

Earlier quoted context omitted.

>since the script would capture your ctrl+v and replace it with the letter "i". not an issue on firefox because you can toggle the dom.event.clipboardevents.enabled to false, and sites won't be able to hijack your pastes.

The only problem with that is that the stupid ROT13 step wouldn't be performed so the site would reject your login attempt anyway. It was one of the dumbest design decisions I've ever seen, honestly.

I'm guessing the solution would've then been to 1) disable the update event and 2) paste the ROT13'd password, either into the browser or into the input field value via the inspector.

Like you, whenever I run into sites that do weird things like that, I always find it hard to shake a bit of suspicion about how their backend is implemented (or not, depending on the case). For instance, when they start rejecting characters like "%" or "'" which have special meaning in SQL. I can't help but wonder if they're storing things in plain text.

I've run into at least two vendors I can think off the top of my head that limit what characters you can use for a password. That always makes me uneasy, and I don't buy anything from them on principle. Who knows what else they're doing that's not immediately obvious.

Re: When it comes to composition and length, passwords mostly don't matter

#110

Post by TimTheTinker »

tempestn wrote: post #100
smacktoward wrote: post #10

Earlier quoted context omitted.

The point of the article is that many common attacks work just as well against completely random, unique passwords as they do against weak/reused ones. If you get phished, it doesn't matter if your password is strong. If your machine has a keylogger on it, it doesn't matter if your password is strong. Etc. Lots of attacks boil down to the attacker convincing you to unknowingly divulge your password, and if that passw…

The point of the article is that strong passwords are mostly useless, but unique passwords are very important. The article doesn't emphasize this, nor does it point out that this is the primary benefit of password managers. However, the very first attack they describe, which is listed as very high frequency and very easy, is credential stuffing—ie, trying credentials from a breach in other places. Unique passwords co…

I disagree with the article on that. Password strength derives from uniqueness and entropy -- nothing else. By this definition, strong passwords are very useful.

It's a bad but common security error to equate password strength with matching an arbitrary schema - so yes, by that definition, so-called "strong" passwords are often useless. When a "strong" password is required, most people will unfortunately take a low-entropy word/phrase and perform single additions/substitutions until it clears the bar. Such passwords are indeed nearly worthless.

Post reply on HN