Password Requirements: Myths and Madness
franzoni.eu
Password Requirements: Myths and Madness
1–10 of 257 posts
Re: Password Requirements: Myths and Madness
#2> Or maybe the keyboard layout isn't yet set when the password is entered (example: full disk encryption password at boot) and you risk that a user is entering a password at install time, but what they write at boot is actually different.
This is a very good point, which already made me struggle when setting up new computers. For instance, the Ubuntu installer runs in a Gnome environment with my keyboard layout active. The disk encryption prompt runs shortly after the BIOS screen and will likely have some US keyboard layout. If you choose anything special for your password, you'll have a hard time figuring out how to type it in a different keyboard layout.
Re: Password Requirements: Myths and Madness
#3For judging complexity I always thought large businesses should just set aside some compute to try to brute force passwords with the hash. If they get yours, you have to change it and get a talking to. If they can't get it, they give you $X where X is big enough to be a pleasant surprise.
Re: Password Requirements: Myths and Madness
#4yep, most of the discussion about passwords completely miss the point. a random word, like "dog" or "pingpong" is fine if the pqsswords are salted and hashed appropriately. how often have your accounts been hacked this way? if an adversary is really banging on the hash, and they want it, any password under around 50 characters is as good as "dog", and no "complexity" meter is gona cut it. that xkcd comic that says 550 years? no, that password its owned a lot a faster than that. all this talk of entropy and security but so obviously clueless about modern brute force techniques
Re: Password Requirements: Myths and Madness
#5> Or maybe the keyboard layout isn't yet set when the password is entered (example: full disk encryption password at boot) and you risk that a user is entering a password at install time, but what they write at boot is actually different. This is a very good point, which already made me struggle when setting up new computers. For instance, the Ubuntu installer runs in a Gnome environment with my keyboard layout activ…
It's just another thing to remember to set. The keyboard layout CAN be set at boot (I do it), but it's separate from the keyboard layout in a graphical session.
Re: Password Requirements: Myths and Madness
#6> Or maybe the keyboard layout isn't yet set when the password is entered (example: full disk encryption password at boot) and you risk that a user is entering a password at install time, but what they write at boot is actually different. This is a very good point, which already made me struggle when setting up new computers. For instance, the Ubuntu installer runs in a Gnome environment with my keyboard layout activ…
I work for a German company. You bet that I know to find most symbols on a German keyboard layout. Thankfully the base letters contain only one swap.
For extra fun, one colleague in particular likes to set excessively long passwords of like 50 characters when it is not expected that anyone will ever have to type them. The number of times I had to type one of these because this sysadmin works remotely and I'm the hands in the office when needed...
Re: Password Requirements: Myths and Madness
#7yep, most of the discussion about passwords completely miss the point. a random word, like "dog" or "pingpong" is fine if the pqsswords are salted and hashed appropriately. how often have your accounts been hacked this way? if an adversary is really banging on the hash, and they want it, any password under around 50 characters is as good as "dog", and no "complexity" meter is gona cut it. that xkcd comic that says 55…
> most of the discussion about passwords completely miss the point. [...] any password under around 50 characters is as good as "dog"
I think you've completely missed the point.
After how long do you start to get annoyed when logging in? Most people probably at 2-5 seconds, but let's say ten full seconds of waiting for the computer to do the hashing. A word like dog is among the top few thousand words, let's say ten thousand, so after 10k×10s/(3600 seconds per hour) = ~28 hours your password is cracked on a single cpu. Probably more like 28 minutes on a couple GPUs, and this is using a complexity setting that literally nobody is going to use (I bet even the NSA isn't paranoid enough to wait 10 seconds for every login). Now compare that to "any other password under around 50 characters".
If you want to use a passphrase, pick random words (at least five when using complex words; the number depends on your dictionary size). Not a single word that is also very common. That completely misses the point.
This strategy would work if literally everyone uses a random words generator and yours, against all odds, comes up with a single common word. Then attackers would have no reason to crack in order of commonness and start with a single word. But that is not the reality we live in and attackers do start with simple passwords before complex ones. (Source: one of the things we do at work is crack passwords, most commonly when we get our hands on Windows password hashes.)
Re: Password Requirements: Myths and Madness
#8> A short password is easy to bruteforce. But, a website should aim at password strength, not at password length.
Is there a standard metric for “strength” though? I built my own random password generator and considered adding a strength meter but all of the functions I could find online seemed like they had pretty arbitrary logic. Length is probably the most objective proxy for strength.
Re: Password Requirements: Myths and Madness
#9> A short password is easy to bruteforce. But, a website should aim at password strength, not at password length. Is there a standard metric for “strength” though? I built my own random password generator and considered adding a strength meter but all of the functions I could find online seemed like they had pretty arbitrary logic. Length is probably the most objective proxy for strength.
The author links to a recommended library in the blog post
Re: Password Requirements: Myths and Madness
#10Off-topic but not sure having a patronizing cookie banner is the best strategy.