Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When it comes to composition and length, passwords mostly don't matter

techcommunity.microsoft.com

Post reply on HN
Print view View original

141–150 of 160 posts

Re: When it comes to composition and length, passwords mostly don't matter

#141

Post by arethuza »

mikekchar wrote: post #56
methodover wrote: post #13

This is a good article. However, in regards to credential stuffing: > Some guidance says to ban all passwords on this list. Try that and see how successful your users are at choosing passwords at all. We're doing that. We don't let you choose any password that's been discovered in a prior breach. Did Microsoft implement the same thing and discover a high rate of users bouncing off the registration page?

Just idly wondering... I wonder how many AJAX style sites do password checking server side and send the password to the server in plain text...

What would the alternative be - sending the stored hash from the server so the comparison can be done on the client side? That doesn't sound like a great idea...

Re: When it comes to composition and length, passwords mostly don't matter

#142

Post by ScottFree »

johndough wrote: post #131
TimTheTinker wrote: post #114

Earlier quoted context omitted.

1Password lets you use dictionary words separated by spaces when generating random passwords. This can be really helpful on iOS/tvOS devices -- just use speech-to-text to type them in (not to mention being easier to remember).

With the recent controversy about Amazon and Google snooping in on smart speaker recordings, people should probably avoid reading out their passwords to human listeners.

How would they determine that a particular string of words was a password as opposed to any other sentence?

Re: When it comes to composition and length, passwords mostly don't matter

#143

Post by jvanderbot »

petjuh wrote: post #139
mehrdadn wrote: post #80

Earlier quoted context omitted.

> sure its better than not having 2FA but only a little better. I'm becoming convinced this is a pervasive fallacy (perhaps not for all users in all cases, but for many). Having SMS as your 2FA potentially makes your phone, phone line, and everything linked to it an attack target. So you might lose a heck of a lot more than you would if they were all unlinked. It depends kind of on what your current security practice…

Someone who steals your phone needs to have "physical access" to you. A random pickpocket is most likely to steal your phone and they're not interested in your phone. Most hackers never have physical access to people. The intersection between the 2 sets - hackers and pickpockets - approaches zero.

No, as other threads have pointed out, SMS is trivially hacked

Re: When it comes to composition and length, passwords mostly don't matter

#144

Post by padobson »

mikekchar wrote: post #53
padobson wrote: post #43

Earlier quoted context omitted.

And also "Passwords don't matter as long as you aren't important enough or connected to a person or organization important enough to try more than the most routine password vulnerabilities"

That would be a shocking statement to make. However, I don't see anything like that in the original article. Did I miss it somewhere?

From the third paragraph:

That’s a key difference between hypothetical and practical security – your attacker will only do really wacky, creative stuff you hear about at conferences (or wherever) when there’s no easier way and the target of the attack justifies the extra effort.

Emphasis mine.

Re: When it comes to composition and length, passwords mostly don't matter

#145

Post by slaymaker1907 »

rkagerer wrote: post #83

If you are using a password manager, use the maximum possible length – there’s no usability downside if you are already cutting and pasting. That's fine and dandy until you need to manually type it in somewhere (e.g. reading it from your phone, typing it in on another device). Has this guy ever even used a password manager? He understands how they work in theory, but in practice it's not always quite so clean. Humans…

That’s why when I made my password generator/manager I included the option to generate translate the entropy into various forms including just alphanumeric and english words. https://slaymaker1907.github.io/password/

Not sure how common of a feature that is with most password managers, but I find it incredibly useful. For reference in case anyone wants to use it, my generator works by running scrypt on a master password as well some identifier for the site.

Re: When it comes to composition and length, passwords mostly don't matter

#146

Post by pier25 »

floo wrote: post #45
pier25 wrote: post #27

> 500M is ½ a billion, home rigs can run 100B guesses a second – so that complete list just takes 5ms to try. 5ms? It would take more than that to just read the 500M passwords into memory, no?

Well yeah. But you, presumably, only have to do that once. After that you get 5ms per account, which seems to be the important takeaway.

But even then, 5ms seems extraordinarily fast on a home machine.

A couple of years ago I tried to bruteforce my WPA wifi handshakes and also played a bit with Hydra and I don't think I got even close to such speed.

Re: When it comes to composition and length, passwords mostly don't matter

#147

Post by kerng »

There is some very bad analysis or interpretation done here.

Just with one or two minor tweaks the analysis falls flat.

For instance, they seem to only look at mass scale script kiddie sprays, a targeted attack will likely not use the mentioned passwords. As one can come up with much better and more likely to succeed candidates.

It also entirely misses attacks that come from a more privileged position (like in Windows directly authenticating to the domain controller) where an adversary can do millions of attempts in short time because of typical monitoring gaps.

Re: When it comes to composition and length, passwords mostly don't matter

#148

Post by kerng »

mquander wrote: post #30

I think the thesis of this article is rather forced. The actual claim is something like: "Passwords don't matter, as long as your password isn't in the top few dozen common ones, it's not in any credentials breach accessible to attackers, it's longer than 8 characters or so, and you don't reuse it." That was a lot of criteria that seemed to matter, if you ask me.

There is some very bad analysis or interpretation done here.

Just with one or two minor tweaks the analysis falls flat.

For instance, they seem to only look at mass scale script kiddie sprays, a targeted attack will likely not use the mentioned passwords. As one can come up with much better and more likely to succeed candidates.

It also entirely misses attacks that come from a more privileged position (like in Windows directly authenticating to the domain controller) where an adversary can do millions of attempts in short time because of typical monitoring gaps.

Re: When it comes to composition and length, passwords mostly don't matter

#149

Post by testvox »

kortilla wrote: post #46
red_phone wrote: post #44

Earlier quoted context omitted.

I'm not a subject matter expert, but a Google Voice number can be used to receive texts and is protected by the relatively robust security of your Google account.

If the issue is the SS7 network, that won’t help unless the originating text is also in Google Voice.

That seems pretty possible though, if SS7 is the only issue then providers of 2factor SMS auth should just have a number on each network and when a 2factor request comes in they should determine what network its being sent to and then actually send the SMS from the number they have on that network.

Re: When it comes to composition and length, passwords mostly don't matter

#150

Post by testvox »

function_seven wrote: post #98
sxates wrote: post #86

Earlier quoted context omitted.

The best is typing that 20 character mixed-case-plus-numbers-and-symbols password for Netflix into your TV app using an on screen keyboard and directional arrows...

This is a huge benefit of AppleTV and having an iOS device. When the password is prompted for on the TV, my phone buzzes and I use the LastPass vault on the phone to paste the gibberish automatically. I'm sure there are similar schemes for other devices (Chromecast/FireTV?). But when the TV itself is "smart", I bet it's infuriating.

Chromecast doesn't have its own UI or authentication, it just uses the authentication of the device the stream was started from (being able to delegate that is a requirement for chromecast support). So it solves the same issue but in a very different way. Its a pretty clever solution but requiring all interaction with your tv to happen through another computing device can get annoying.
Post reply on HN