Password Requirements: Myths and Madness
111–120 of 257 posts
Re: Password Requirements: Myths and Madness
#112The article is correct, most password policies are dumb. But it's arguing about one tree while standing in a forest. The real problem with passwords is not individual policies, but rather their shere volume. In my password manager I noticed I have got literally hundreds of the things. Clearly reusing a password on multiple systems is bad. Clearly memorizing more than a handful is impossible. Since I therefore am usin…
Honestly I'm surprised we're still using user names and passwords for authentication and identification in 2022. We have come up with many better ways to do this, and just completely failed to adopt any of them as the new normal. The closest we get is when we can use Google or Facebook to log into Joe Blow's Bullshit site instead of a bespoke account.
Re: Password Requirements: Myths and Madness
#113Earlier quoted context omitted.
Funny, sure. But you still can have the same transaction by hashing "CorrectHorseBatteryStaple" then comparing with the stored hash.
I think the OP is arguing you can guess a (possibly) current password this way.
I'm just amused by the irony of forgetting my password, going through the reset process, then realizing I did remember my password.
Except now I can't use it any more.
Re: Password Requirements: Myths and Madness
#114I often get irritated by formulaic instructions for "strong" passwords when creating an account. I use a respectable password manager, so everything is unique and at least 10-15 characters with some numbers and symbols mixed in. Occasionally I use DiceWare. God forbid I don't include a number or use upper case, lower case, one of five symbols, but not th#t one! The worst is when I cannot copy and paste in both text fields. I don't even know what the assumption is there about end user behavior, but it's quite frustrating.
I know these practices must be reduced to the lowest common denominator, but perhaps websites need to allow minimum entropy and not force rules unless the minimum entropy isn't met. I don't know much about implementing, but people are so lazy that all these different rules and schemes are turn offs from better security practices.
Re: Password Requirements: Myths and Madness
#115Earlier quoted context omitted.
I think you missed the word “similarity”. You can’t check similarity with hashes, only exact matches
Oh god! I made the same mistake. I thought you just meant password reuse. Past password similarity? That's literally impossible without plaintext passwords isn't it. That is insane.
> That's literally impossible without plaintext passwords
No, it’s not. It’s called locality-sensitive hashing. You’d store the last 10 LSH hashes in a database next to the SHA-256 hashes. Compare those LSH hashes to the LSH hash of the new password. Match? Reject the new password.
It’s also used to identify photos that are similar:
Re: Password Requirements: Myths and Madness
#116Earlier quoted context omitted.
3 //chosen by dice roll
“Your assigned password will be two random words and 2 random numbers” “Pass”, “word”, “12”, “34”
It's worth getting a list of the most common passwords and rejecting them, regardless of whether the passwords are generated by machine or by the user.
For four digit numbers there's barely any variation in what people use. Even 1234, the most common, is only twice as likely as hundreds of other PINs. Maybe block the top half a percent of most-guessed pins.
Re: Password Requirements: Myths and Madness
#117In the b2b world it's basically impossible to improve password policies. Most of the onerous examples only exist because some other entity (a customer, insurance company, parent company, etc) has demanded them. The problem is that the demand isn't being made by security professionals, it's being made by risk management people who are only interested in a simple way to mitigate risk - it's simply much easier for them…
I was in charge of password policy for a healthcare app. We tried to use phrases, often cited as more secure than character/length requirements.
The doctors hated it. They didn't understand what a phrase was, it was too different from every other system they interacted with, and it was extra cog load in their already busy days.
Re: Password Requirements: Myths and Madness
#118Earlier quoted context omitted.
Oh god! I made the same mistake. I thought you just meant password reuse. Past password similarity? That's literally impossible without plaintext passwords isn't it. That is insane.
> That's literally impossible without plaintext passwords No, it’s not. It’s called locality-sensitive hashing. You’d store the last 10 LSH hashes in a database next to the SHA-256 hashes. Compare those LSH hashes to the LSH hash of the new password. Match? Reject the new password. It’s also used to identify photos that are similar: https://en.m.wikipedia.org/wiki/Locality-sensitive_hashing
Surely even having an LSH stored is a potential compromise - e.g. if my password happens to have the same LSH as somebody else because I've used "Secret-123" and they've used "Secret123", then you've presumably got a better chance of guessing what my password is than if the LSHes weren't stored (if you can't get from me directly, you can try to get it from others who have the same LHS).
Re: Password Requirements: Myths and Madness
#119Earlier quoted context omitted.
> That's literally impossible without plaintext passwords No, it’s not. It’s called locality-sensitive hashing. You’d store the last 10 LSH hashes in a database next to the SHA-256 hashes. Compare those LSH hashes to the LSH hash of the new password. Match? Reject the new password. It’s also used to identify photos that are similar: https://en.m.wikipedia.org/wiki/Locality-sensitive_hashing
Surely even having an LSH stored is a potential compromise - e.g. if my password happens to have the same LSH as somebody else because I've used "Secret-123" and they've used "Secret123", then you've presumably got a better chance of guessing what my password is than if the LSHes weren't stored (if you can't get from me directly, you can try to get it from others who have the same LHS).
I remember Facebook doing some things like this. Such as storing the capslock-on variant of passwords as well as various typos.
Re: Password Requirements: Myths and Madness
#120I came across the most humorous password entry view blocking scenario on a firestick trying to login to netflix the other day.
You are visually moving the cursor around a graphically displayed keyboard... pressing enter when you are on the letter or number desired, at which point the hidden password entry form immediately increases by 1 in length.
Hrmmm... I wonder what that character was?!?