My favorite is this transaction:
I forgot my password. Can you send me a link?
Sure, here you go. Pick a new password.
Okay, CorrectHorseBatteryStaple.
Sorry, you can't use an old password
Password Requirements: Myths and Madness
11–20 of 257 posts
Re: Password Requirements: Myths and Madness
#12> A short password is easy to bruteforce. But, a website should aim at password strength, not at password length. Is there a standard metric for “strength” though? I built my own random password generator and considered adding a strength meter but all of the functions I could find online seemed like they had pretty arbitrary logic. Length is probably the most objective proxy for strength.
Check out https://www.grc.com/haystack.htm
Re: Password Requirements: Myths and Madness
#13> A short password is easy to bruteforce. But, a website should aim at password strength, not at password length.
If it is "easy to bruteforce" (guess without any prior knowledge), then it is not "strong".
> If I use four unicode code points outside the [multi-language characters table], my password is probably very safe already.
Security through obscurity. This is safe until everyone does it. It's not a strong password by virtue of being short, it's strong because this is impossible to input and so nobody uses it and so it doesn't make sense to guess. But you bet that if you ever log into a compromised system, use a phishing page, or a site stores and loses your password in plain text, the gig is up and it's known that cracking u/alanfranz's passwords is a matter of trying a few random unicode characters instead of letters.
> You cannot show or copy this field [...] My verdict: Security through obscurity
Security through obscurity is it being secure by being rare. It's not about it being literally invisible. I agree with the point but this is not what obscurity means.
Most of this post makes sense (password expiry, maximum length, requiring special symbols, disallowing other symbols) but we've known these things for decades now. We keep putting it in reports and customers are slowly catching up. Recently saw the first customer who, in a retest, used a reasonably sized deny list of common passwords on an embedded device! I was definitely impressed. We're getting there, ever so slowly.
Re: Password Requirements: Myths and Madness
#14yep, most of the discussion about passwords completely miss the point. a random word, like "dog" or "pingpong" is fine if the pqsswords are salted and hashed appropriately. how often have your accounts been hacked this way? if an adversary is really banging on the hash, and they want it, any password under around 50 characters is as good as "dog", and no "complexity" meter is gona cut it. that xkcd comic that says 55…
> most of the discussion about passwords completely miss the point. [...] any password under around 50 characters is as good as "dog" I think you've completely missed the point. After how long do you start to get annoyed when logging in? Most people probably at 2-5 seconds, but let's say ten full seconds of waiting for the computer to do the hashing. A word like dog is among the top few thousand words, let's say ten…
im sorry, what point are you making?
if its that "dog" is a weak password, i thought that was evident. but many people seem confused that "horseloverwhatever" is more secure, similarly that "dog23!Wog" is more secure. my point is they are equally trash so leave the user alone
Re: Password Requirements: Myths and Madness
#15there is also a disconnect between password requirements and automatically generated passwords, where often the auto-generated password contains prohibited characters.
Re: Password Requirements: Myths and Madness
#16> A short password is easy to bruteforce. But, a website should aim at password strength, not at password length. Is there a standard metric for “strength” though? I built my own random password generator and considered adding a strength meter but all of the functions I could find online seemed like they had pretty arbitrary logic. Length is probably the most objective proxy for strength.
NIST standard suggests checking a list of leaked passwords, and setting a length requirement:
> Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric. If the CSP or verifier disallows a chosen memorized secret based on its appearance on a blacklist of compromised values, the subscriber SHALL be required to choose a different memorized secret. No other complexity requirements for memorized secrets SHOULD be imposed. A rationale for this is presented in Appendix A Strength of Memorized Secrets.
Re: Password Requirements: Myths and Madness
#17Earlier quoted context omitted.
> most of the discussion about passwords completely miss the point. [...] any password under around 50 characters is as good as "dog" I think you've completely missed the point. After how long do you start to get annoyed when logging in? Most people probably at 2-5 seconds, but let's say ten full seconds of waiting for the computer to do the hashing. A word like dog is among the top few thousand words, let's say ten…
im sorry, what point are you making? if its that "dog" is a weak password, i thought that was evident. but many people seem confused that "horseloverwhatever" is more secure, similarly that "dog23!Wog" is more secure. my point is they are equally trash so leave the user alone
short passwords are still a security weakness even when properly stored because the time necessary to brute force them is relatively low.
Re: Password Requirements: Myths and Madness
#18Password managers are "obviously" the solution - in my experience they generate good passwords that are accepted almost all the time now days.
However, I still think 3rd-party password managers are too complex for many people, and those people are the ones who need them most. OS-level password management is a bit easier but not great. Browser native password managers are a terrible idea IMO, for people who can't handle a 3rd party manager, imagine their confusion when only a specific browser knows their password, and only when they signed into their browser vendor account.
Re: Password Requirements: Myths and Madness
#19yep, most of the discussion about passwords completely miss the point. a random word, like "dog" or "pingpong" is fine if the pqsswords are salted and hashed appropriately. how often have your accounts been hacked this way? if an adversary is really banging on the hash, and they want it, any password under around 50 characters is as good as "dog", and no "complexity" meter is gona cut it. that xkcd comic that says 55…
a random word, like "dog" or "pingpong" is fine if the pqsswords are salted and hashed appropriately. how often have your accounts been hacked this way? if an adversary is really banging on the hash, and they want it, any password under around 50 characters is as good as "dog", and no "complexity" meter is gona cut it.
Re: Password Requirements: Myths and Madness
#20Earlier quoted context omitted.
> most of the discussion about passwords completely miss the point. [...] any password under around 50 characters is as good as "dog" I think you've completely missed the point. After how long do you start to get annoyed when logging in? Most people probably at 2-5 seconds, but let's say ten full seconds of waiting for the computer to do the hashing. A word like dog is among the top few thousand words, let's say ten…
im sorry, what point are you making? if its that "dog" is a weak password, i thought that was evident. but many people seem confused that "horseloverwhatever" is more secure, similarly that "dog23!Wog" is more secure. my point is they are equally trash so leave the user alone
> if its that "dog" is a weak password, i thought that was evident
You're confusing me. First you say that "dog" is just as strong as any other password, now you say that it should have been evident that it's a weak password. Which is it?
> my point is they are equally trash
This again sounds contradictory, but this time within one comment. First you say that horseloverwhatever is stronger than dog, but then that they are equally "trash".