Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

411–420 of 447 posts

Re: I hate password rules

#411

Post by iso1631 »

hannasanarion wrote: post #243
iso1631 wrote: post #207

Earlier quoted context omitted.

If you're using a random password, c29b90b0e25ece3f2dabcef496d22103 is fine for a password, 2^128 bits. It's a right pain to type in on a console though. On the other hand, "rundown skyline pluck shawl pastrami radar refueling poach prankster durable" is far easier to type and is about the same entropy

The entropy is far greater than 2^128. Pastrami, refueling, and shawl don't appear in the top 30,000 English words list, so even knowing your password generation strategy, every word adds at least 15 bits of entropy, you're up to 150 bits, probably more.

My word list contains 7227 words apparently, so 12.82 bits per word

https://github.com/redacted/XKCD-password-generator

Not sure how many bits a "good" password should be nowadays.

Re: I hate password rules

#412

Post by sharperguy »

bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

Makes you wonder if you could use a tool like GPT-3 to generate grammatically correct passphrases from randomly generated sets of words.

E.g. "correct battery horse staple" might become "Correct use of a battery supports the a horse in its staple diet".

Thereby keeping the same bits of randomness while making a memorable phrase.

Re: I hate password rules

#413

Post by BeFlatXIII »

kevincox wrote: post #57
BeFlatXIII wrote: post #32

Earlier quoted context omitted.

Frequent password rotation causes increases of passwords on post-its stuck to the monitor.

In most cases I would take a strong password stuck to the monitor than a dictionary password on an internet exposed system. But yeah, frequent password rotation is still bad.

Fair point. If your passwords are compromised because they were stuck to the monitor, that means physical security was breached and the copied passwords are now the least of your concerns.

Re: I hate password rules

#414

Post by gspencley »

bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

The funnier thing about that story is that the passphrase they gave you is not necessarily secure in the first place if we're talking about a scenario where a hash is found. While length is a factor when brute forcing randomness, any words or phrases that commonly appear together in written text are likely to come up in various types of dictionaries that can be used in more sophisticated brute forcing algorithms.

"sliding down the" and "tall building" are two parts of that password that contain words very commonly found together.

It's not the worst password but it's better to introduce randomness.

One strategy to create strong passwords that you can remember is to pick 3 or 4 truly random words from the dictionary that have no logical connection to each other, and to "glue" them together with some numbers that you can remember. I've heard that phone numbers are 7 digits because people can remember up to 7 pieces of information. If that's true then most people should be able to remember a password in the form of:

It does start to break down when you have to remember multiple passwords. So using that format as the master password to a password manager and then letting your password manager generate truly random passwords for everything else is the way to go.

Re: I hate password rules

#415

Post by latchkey »

fsflover wrote: post #397
latchkey wrote: post #304

Earlier quoted context omitted.

Impressive level of paranoia. That said, I'd declare it your 'password manager'.

Actually, it's not just paranoia, also convenience. Qubes allows very convenient separation of different parts of your digital life, like personal files/apps from working ones and from random internet surfing. Also, IMHO it's more convenient to copy-paste passwords without an actual password manager. More details: https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15

> Were you ever concerned about opening your online banking/entering your credit card in the same browser where you go to random websites?

Nope. This is from the late 90's when we started entering credit cards and people thought it would be unsafe. In reality, the credit card companies have covered these charges forever now. Otherwise, we wouldn't be using them today.

> Are you tired of remembering tens of complicated passwords?

Tens? I have hundreds and I don't know a single one, because I already use a password manger. What an odd thing to pitch.

I could keep going, but I really don't like how that pitch deck is just trying to cater to made up fears.

Re: I hate password rules

#416

Post by Arrath »

toto444 wrote: post #395
Arrath wrote: post #93

Earlier quoted context omitted.

That seems..excessive. What is your motivation for that?

I don't write down most of my passwords so every time I log in I do a password reset. It is mainly out of laziness not for a security purpose.

Wow, to each their own! For me this would be a nightmare and just lead to confusion as I would eventually find the distinction between the previous password and the latest one to be murky.

Re: I hate password rules

#417

Post by genewitch »

kazinator wrote: post #370
eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

If you require as few as 9 characters, without requiring special characters, the security is poor. The reason is that users do not choose random strings of letters, so the entropy per character is low. If we assume an entropy of 2 bits per characters (which is generous if the user uses dictionary words), then 9 characters gives us 18 bits. A 9 character password could easily be as poor as a random 18 bit integer. If…

So "fishyidea" has less or equal entropy to "262119"?

Re: I hate password rules

#418

Post by genewitch »

pbhjpbhj wrote: post #52
reaperducer wrote: post #37

Earlier quoted context omitted.

The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me Or worse, they truncate your password after you've already used it for years and years. I had a 30-character password with Bank of America. Somewhere along the line, it changed its password requirements to only allow a maximum of 20 or 25 characters (I forget), which automatically invalidated m…

So, for a bank the maximum is to allow NSA to crack it if they wish, right?

On nsa.gov for a long time the max password length was 12 characters. Last checked in 2016.

Re: I hate password rules

#419

Post by singlow »

jsmith99 wrote: post #400
singlow wrote: post #103

Earlier quoted context omitted.

I guess you assume that everyone protects their stored hashes.

So long as passwords are unique, offline cracking isn't an issue. If they have that site's hashes presumably the site is compromised already.

Not true. Offline hacking is not only a concern for passwords used on multiple sites.

There are many scenarios where an attacker might be able to grab the hashes, but still need to crack them in order to get access to other data from your account. If there is a sql injection vulnerability in the authentication service, for example, it does not mean they can necessarily overwrite the hash or access data in other parts of the application.

I once found a bug in a payment processor that let me download the user record including password hash for all users in that payment processor. But I couldn't use that to get their stored credit card numbers directly. However, if I had brute forced those hashes, I would have been able to log in as them and access their other account data and make transfers, etc. I am sure a large majority of those password would have been very easy to crack. If I was an attacker, those would have been my first targets.

Re: I hate password rules

#420

Post by logfromblammo »

Sohcahtoa82 wrote: post #151
logfromblammo wrote: post #115

Earlier quoted context omitted.

If that policy is enforceable, someone would have to be storing passwords in plaintext, or the hashing algorithm is too weak. IT shouldn't be able to tell anything about plaintext password similarity beyond equals or not-equals.

Ad-hoc, this is correct. But at the time of the password change, no, assuming password changing requires you to enter your current password as well.

The password-change form should be using a password field, and that should not be allowing any code or scripts to grab the plaintext stored in it.

If the code that compares your current password to the new password can read the plaintext of your passwords, so too could a malicious program.

Using HTML input type="password" alone is not sufficient protection. The same steps that protect password changes from malicious attackers must necessarily protect them enforcement of bad IT security policy.

Post reply on HN