Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"…encourage your users to enter stronger passwords."

nakedpassword.com

Post reply on HN
Print view View original

41–50 of 50 posts

Re: "…encourage your users to enter stronger passwords."

#41

Post by BoppreH »

lukifer wrote: post #39
BoppreH wrote: post #23

Earlier quoted context omitted.

"password" -> "This password would take 0.1 seconds to crack" "betterpassword" -> "This password would take 15 seconds to crack" "S89&;al(l_2z0Z¨" -> "This password would take 56 years to crack" Security by fear?

I love this idea. Is there an easy and accurate-ish algorithm that could generate the numbers involved?

Estimating time with dictionary attacks would be hard because, well, you have to have a dictionary at hand to see how far down the list the word is.

Personally, I would make a list of the top 1k or 10k most common passwords and assign a very low number to them. Say, a few seconds max.

For any password that is not on the list, get the subset of characters used (upper+lower case, lower case+numbers, symbols+numbers, etc); raise it to the power of the password length to get number of possibilities; multiply by a random number (Absolutely naive and a bit too rough around the edges, but good enough to send the message.

Re: "…encourage your users to enter stronger passwords."

#42

Post by drdaeman »

knowtheory wrote: post #11

clothed to naked with just "1!aAA" :| What is with HN recently? I just do not understand why the uber-creep factor is out in force. Even if the image set is replaceable and you dont' have to use a naked lady, that is the default demo, and the stated objective of the site is Strong Password == Naked Lady. Aside from the blatant sexist targeting, this is trying to take advantage of entirely the wrong impulse. Associati…

Tthey do not measure entropy (very good point about measuring entropy here: http://codereview.stackexchange.com/questions/868/calculatin...), but just check that password conforms to several simple rules.

So, yes, "2tcUKstR" (which I've just generated with `openssl rand -base64 6`) is considered less secure than "Aa1!!".

Well, the good thing that they're just suggesting about password's quality, not enforcing it. It really pissed me off when one site declined to accept password and said it was "insecure" just because I was using base64, and (by chance) password did not contain any non-alphanumeric characters. I've also seen another site which rejected "/" in passwords, insisting on /^[A-Za-z0-9]$/ only.

Re: "…encourage your users to enter stronger passwords."

#43

Post by djhomeless »

Will the password nazis please go home?

Sure, your shell account, bank website, ebay/amazon password should be very secure, secure to the point of not needing to be prompted, but does every site on the net, ie your blog, twitter, etc, need to have a min of 8 characters w/at least one number and one capital?

Oh, agree with everyone here on the creepiness factor here...

Re: "…encourage your users to enter stronger passwords."

#45

Post by drdaeman »

djhomeless wrote: post #43

Will the password nazis please go home? Sure, your shell account, bank website, ebay/amazon password should be very secure, secure to the point of not needing to be prompted, but does every site on the net, ie your blog, twitter, etc, need to have a min of 8 characters w/at least one number and one capital? Oh, agree with everyone here on the creepiness factor here...

I've seen many of users typing their birth year, their first name or just "123qwe" as their password. Way too many I'd ever expected.

I really doubt they understood the possible consequences. Restricting is inacceptable, but warning against using seemingly-insecure password should be perfectly fine.

Re: "…encourage your users to enter stronger passwords."

#46

Post by mcarlin »

lukifer wrote: post #39
BoppreH wrote: post #23

Earlier quoted context omitted.

"password" -> "This password would take 0.1 seconds to crack" "betterpassword" -> "This password would take 15 seconds to crack" "S89&;al(l_2z0Z¨" -> "This password would take 56 years to crack" Security by fear?

I love this idea. Is there an easy and accurate-ish algorithm that could generate the numbers involved?

Meh, this probably encourages people to distrust your website.

Re: "…encourage your users to enter stronger passwords."

#47

Post by ktsmith »

giberson wrote: post #40
pavel_lishin wrote: post #29

Earlier quoted context omitted.

And when your database is out in the wild, it'll let crackers know exactly which passwords to go after first, and which ones not to bother with!

What now? You're statement is a little confusing. All our passwords are munged with encryption, they all look like hash garbage. How could they differentiate? My only guess is that perhaps you've interpreted my comment as a database entry, rather than a UI progression--and you think that "%1 off coupon" is stored with the login table. That clearly wasn't what I was saying--thats a poor design. I'm saying simply offer…

If your database is in the wild and you give a discount based on password strength they could look at the first order for each account and start working on the hashes associated with the smallest discounts first knowing those would be the weakest passwords.

Re: "…encourage your users to enter stronger passwords."

#48

Post by BoppreH »

mcarlin wrote: post #46
lukifer wrote: post #39

Earlier quoted context omitted.

I love this idea. Is there an easy and accurate-ish algorithm that could generate the numbers involved?

Meh, this probably encourages people to distrust your website.

Excellent insight. Looking back, people would clearly avoid sites that tell them how insecure their accounts are, even if it's for a feel good measure.

Re: "…encourage your users to enter stronger passwords."

#49

Post by pavel_lishin »

giberson wrote: post #40
pavel_lishin wrote: post #29

Earlier quoted context omitted.

And when your database is out in the wild, it'll let crackers know exactly which passwords to go after first, and which ones not to bother with!

What now? You're statement is a little confusing. All our passwords are munged with encryption, they all look like hash garbage. How could they differentiate? My only guess is that perhaps you've interpreted my comment as a database entry, rather than a UI progression--and you think that "%1 off coupon" is stored with the login table. That clearly wasn't what I was saying--thats a poor design. I'm saying simply offer…

> I'm saying simply offer a coupon code to users if their password validates certain levels of difficulty. It doesn't need to be tied to the account in anyway.

Ah, my assumption was that the entire DB was in the wild, and that every user had a unique discount code they could use once.

And why are you storing payment details, anyway?

Post reply on HN