Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NULL license plate not such a bright idea

knrs.iheart.com

Post reply on HN
Print view View original

351–360 of 484 posts

Re: NULL license plate not such a bright idea

#351

Post by mehrdadn »

monocasa wrote: post #343
mehrdadn wrote: post #337

Earlier quoted context omitted.

That's most definitely not how security works. The strength of your password is not proportional to the number of bits of entropy it has.

In the context of randomly generated passwords, it's absolutely ok to think about it in terms of the logarithmic relationship between 1) entropy per symbol times number of symbols and 2) strength of the password. He said 10% stronger (which I took to mean 10% more entropy), not 10% more time to crack.

> He said 10% stronger (which I took to mean 10% more entropy), not 10% more time to crack.

Hence the problem?

Yes, measuring "strength" by "bits of entropy" is technically correct (the best kind of correct...).

It's also exponentially misleading... possibly the worst kind of misleading?

Just look at the question: "Is there even a reason to include special characters in passwords? They add 10% more to security...". I don't know about you, but to me doesn't really portray an understanding of the fact that it takes twenty-five times longer to crack such a password for merely 8 characters, not merely 10%.

Re: NULL license plate not such a bright idea

#352

Post by monocasa »

mehrdadn wrote: post #351
monocasa wrote: post #343

Earlier quoted context omitted.

In the context of randomly generated passwords, it's absolutely ok to think about it in terms of the logarithmic relationship between 1) entropy per symbol times number of symbols and 2) strength of the password. He said 10% stronger (which I took to mean 10% more entropy), not 10% more time to crack.

> He said 10% stronger (which I took to mean 10% more entropy), not 10% more time to crack. Hence the problem? Yes, measuring "strength" by "bits of entropy" is technically correct (the best kind of correct...). It's also exponentially misleading ... possibly the worst kind of misleading? Just look at the question: "Is there even a reason to include special characters in passwords? They add 10% more to security..." .…

I mean, counting in entropy with the knowledge that the applied effects can be logarithmic is the standard way of discussing such matters. It's sort of the basis for the information theory that's underneath this type of work.

Edit: And the point of his argument is that more symbols of a smaller corpus of symbols can be equivalent if the entropy is equivalent.

Re: NULL license plate not such a bright idea

#354

Post by rtkwe »

retzkek wrote: post #347
rtkwe wrote: post #145

Earlier quoted context omitted.

I'm surprised more places don't do what Nintendo did with course ids in Super Mario Maker 2. They intentionally removed some characters that are visually similar to avoid confusion when writing out codes.

base32? "an alphabet of A–Z, followed by 2–7. 0 and 1 are skipped due to their similarity with the letters O and I (thus "2" actually has a decimal value of 26)." https://en.wikipedia.org/wiki/Base32

No they removed Z, I, & O from A-Z+0-9. They removed Z because it looks similar to 2 in some cases too I bet.

Re: NULL license plate not such a bright idea

#356

Post by mbuinl989 »

kevinmchugh wrote: post #242
gruez wrote: post #184

Earlier quoted context omitted.

>Avoid backticks in passwords. Is there even a reason to include special characters in passwords? They add 10% more security[1] but cause all sorts of issues with systems. Just use an alphanumeric password that's 10% longer, and if special characters are mandatory, use a safe character at the end like _ or -. [1] 6.55 bits per character (all printable ascii characters) rather than 5.95 (only alphanumeric)

Special characters in passwords were highly recommended when rainbow tables were an effective way to attack password hashes. See this old Coding Horror blogpost for an idea what it was like at the time: https://blog.codinghorror.com/rainbow-hash-cracking/ Salted hashes have made rainbow tables less effective. Password managers have made single-use passwords more tenable. Not knowing how a system will store my passwor…

Password Managers are the new goto for obtaining all passwords and web browser zero days make it very easy to lift and then use for a variety of purposes. A simple lined small note book is good, but made secure is best, yet how would you make a pwd note book secure from someone else? This even applies to devices like bank cards and other things which needs a security code of sorts.

Re: NULL license plate not such a bright idea

#357

Post by ben-schaaf »

cgriswald wrote: post #236
linker3000 wrote: post #132

A colleague used an app's "generate secure password" feature to change their ISP's web portal login - which then also became the WAN router's password - which they didn't realise. It was about a week before the router dropped its connection and needed to re-authenticate - and that's when I was called in to investigate the loss of connectivity - which Windows 10 very unhelpfully reported as the network cable disconnec…

Many, many websites will happily accept passwords of $X characters and then hash only $(X-Y) characters on registration, but try to hash all $X characters on login, so of course the hashes don’t match. And at no point do they tell you the maximum number of characters.

I once had a page that prevented pasting, but last pass's password generator still worked. So I put in a long password using that, but when I clicked to register it came up with a blank error message. Turns out they had a 16 character limit that was only enforced when you typed in the box, so I had to count the number of letters they allowed me to type and then let lastpass generate a password of that length. Infuriating.

Re: NULL license plate not such a bright idea

#358

Post by hultner »

stevekemp wrote: post #152
linker3000 wrote: post #132

A colleague used an app's "generate secure password" feature to change their ISP's web portal login - which then also became the WAN router's password - which they didn't realise. It was about a week before the router dropped its connection and needed to re-authenticate - and that's when I was called in to investigate the loss of connectivity - which Windows 10 very unhelpfully reported as the network cable disconnec…

So many home-routers are run with horrid CGI-scripts on the back-end - I'd not be amazed to learn that submitting a form-field with `blah` in it would try to run the command blah (probably via busybox). If you have time/patience it might be worth exploring.

I've actually rooted an Asus router owned by a relative, this was about 5 years back so it's hopefully fixed now. Noticed some strange behavior after a mistype and tried something like `whoami` (not exactly) and got root back so tried a reverse she'll with NC which worked perfectly. Googled it afterwards and found a ton of similar flaws on other home routers. Tried to do some kind of responsible disclosure but never got a reply or saw a fix then I forgot about it.

Re: NULL license plate not such a bright idea

#359

Post by m463 »

kens wrote: post #43

I read years ago in comp.risks about a similar story. A guy in 1979(!) requested a personalized plate "SAILING", with second choice "BOATING". He didn't want a customized plate if he couldn't get those, so for his third choice he put down "NO PLATE". Of course, he ended up with "NO PLATE". He ended up getting 2500 parking tickets, since cars with no plate had "NO PLATE" written on the ticket. References: http://www.m…

I saw a car with that specific plate a year or two ago.

It seemed like it might work like humor in the TSA line.

Fine as long as you have extra time on your hands.

I wonder if it has even been towed/impounded?

Re: NULL license plate not such a bright idea

#360

Post by ValleZ »

gruez wrote: post #220
cezart wrote: post #203

Earlier quoted context omitted.

Based on your numbers they add 10% entropy per character. Which compounds into an increase of 210% over a length of 12 characters. Thus you'd need the password to be at least 3 times longer with only alphanumeric characters to have the same entropy.

no, check your math. number of characters required for 128 bit entropy password using alphanumerics: 21.49[1]. round off to 22 number of characters required for 128 bit entropy password using all printable characters: 19.5[2]. round off to 20. 22/20 = 110% [1] https://www.wolframalpha.com/input/?i=solve+log_2(62%5Ex)%3D... (under "real solution", click on "approximate form") [2] https://www.wolframalpha.com/input/?i=…

There are about 138k printable characters, not 62.
Post reply on HN