Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Requirements: Myths and Madness

franzoni.eu

Post reply on HN
Print view View original

131–140 of 257 posts

Re: Password Requirements: Myths and Madness

#131

Post by ahtihn »

TedDoesntTalk wrote: post #125
wizofaus wrote: post #118

Earlier quoted context omitted.

Surely even having an LSH stored is a potential compromise - e.g. if my password happens to have the same LSH as somebody else because I've used "Secret-123" and they've used "Secret123", then you've presumably got a better chance of guessing what my password is than if the LSHes weren't stored (if you can't get from me directly, you can try to get it from others who have the same LHS).

You’re assuming an attacker can access this database somehow? And that the LSH of “somebody else” is reversible? I’ve don’t understand the vulnerability you’re describing.

> You’re assuming an attacker can access this database somehow?

Well yeah. Protecting against this is the exact reason passwords aren't stored in plaintext.

Re: Password Requirements: Myths and Madness

#132

Post by wizofaus »

TedDoesntTalk wrote: post #125
wizofaus wrote: post #118

Earlier quoted context omitted.

Surely even having an LSH stored is a potential compromise - e.g. if my password happens to have the same LSH as somebody else because I've used "Secret-123" and they've used "Secret123", then you've presumably got a better chance of guessing what my password is than if the LSHes weren't stored (if you can't get from me directly, you can try to get it from others who have the same LHS).

You’re assuming an attacker can access this database somehow? And that the LSH of “somebody else” is reversible? I’ve don’t understand the vulnerability you’re describing.

Yes, obviously, I'm just saying it's a potential vulnerability that doesn't exist if you don't store the LSH. The LSH doesn't need to be reversible - I'm just saying that you now have a situation where if you can find multiple people with the same LSH, if one their passwords becomes known to an attacker for any reason (the attacker could be one of those people!), the other passwords are now much easier to guess.

Re: Password Requirements: Myths and Madness

#133

Post by quickthrower2 »

taeric wrote: post #127
nigerianbrince wrote: post #106

Earlier quoted context omitted.

Our computers should have a specific port for a physical key which we would carry around in our keychain.

And what do you do when your key is broken or lost? Because that will happen.

Backups! Copy of key at friends house.

Re: Password Requirements: Myths and Madness

#134

Post by pontilanda »

water-your-self wrote: post #74

Rotating passwords is an old idea but mathematically it does reduce the probability of bring compromised. Otherwise I can know for certain when something is not your password each time I get it wrong.

I hate that HN users downvote concepts they disagree with.

One can agree that rotation is good in theory and bad/annoying in practice (due to laziness). We can only argue about how much of an impact it makes, but it certainly does not reduce the security.

We all deal with "password rotation" in real life and it's inescapable: credit cards expire. And to be fair I'm perfectly fine with that because I know a leak from 10 years ago can no longer affect me. I almost wish they expired earlier.

Re: Password Requirements: Myths and Madness

#135

Post by quickthrower2 »

Zamicol wrote: post #73

Password strength is: Unknown entropy - known entropy = password strength Where "unknown" entropy is known only to the user and service and "known" entropy is any entropy known by a third party. Since this is an information problem, it should be treated with the tools of information theory, where security is measured by "unknown" entropy. Services have no way to know if a provided string is entropic, since it may be…

Some banks so this: you need an id (not your account number), a password you chose and a code the bank gave you when you signed up

Re: Password Requirements: Myths and Madness

#136

Post by noahtallen »

taeric wrote: post #126
AnIdiotOnTheNet wrote: post #112

Earlier quoted context omitted.

Honestly I'm surprised we're still using user names and passwords for authentication and identification in 2022. We have come up with many better ways to do this, and just completely failed to adopt any of them as the new normal. The closest we get is when we can use Google or Facebook to log into Joe Blow's Bullshit site instead of a bespoke account.

I'm afraid to ask what you think are the better ways? My assertion is that most risk of online fraud is a social, not a technical problem. As such, it will require law to make safe.

Passkeys, which are getting closer and closer to prime time. If you think about it, key-based auth is already highly recommended and utilized in many scenarios (like SSH, signing data, certificates, token authentication for use between servers, etc.)… this just makes that accessible to users.

The vast majority of people don’t even use a password manager, and use variations of the same password everywhere. That’s really unsafe. Passkeys are always unique.

Another thing is phishing. The big issue with phishing is how easy it is to make a website or popup look identical to a different service. And if it’s believable enough and the domain is hidden, you’ll put in your real password. Passkeys fix that because they only work on the site in question. No danger of leaking it to someone else!

So this will make some huge improvements in security. Basically taking care of the very basic things most people don’t do. Password managers solve many of the same problems, but are potentially less convenient in some scenarios. (Obtuse password requirements, password field not working with paste, etc. it’s just a 3rd party workaround.)

But like you said, the social aspect is still a huge problem.

Re: Password Requirements: Myths and Madness

#137

Post by josephcsible »

noahtallen wrote: post #136
taeric wrote: post #126

Earlier quoted context omitted.

I'm afraid to ask what you think are the better ways? My assertion is that most risk of online fraud is a social, not a technical problem. As such, it will require law to make safe.

Passkeys, which are getting closer and closer to prime time. If you think about it, key-based auth is already highly recommended and utilized in many scenarios (like SSH, signing data, certificates, token authentication for use between servers, etc.)… this just makes that accessible to users. The vast majority of people don’t even use a password manager, and use variations of the same password everywhere. That’s real…

> if [...] the domain is hidden

When is that?

Re: Password Requirements: Myths and Madness

#138

Post by pontilanda »

Someone1234 wrote: post #82
water-your-self wrote: post #74

Rotating passwords is an old idea but mathematically it does reduce the probability of bring compromised. Otherwise I can know for certain when something is not your password each time I get it wrong.

> Rotating passwords is an old idea but mathematically it does reduce the probability of bring compromised. Please can you show your work. Most websites limit the attempts per user per time, which should make direct request break-ins unrealistic to mathematically impossible. So now we move the needle to "Your user database has been stolen, someone is trying to break hashed + salted passwords" which is such a problema…

Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rotation.

Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services.

Side note: I despise rotation as much as the next guy, but I can see the value in it. If users used password managers, generated passwords and not reused passwords, then we wouldn't need such rules. But alas 1234567890 is a common password.

Re: Password Requirements: Myths and Madness

#139

Post by josephcsible »

pontilanda wrote: post #134
water-your-self wrote: post #74

Rotating passwords is an old idea but mathematically it does reduce the probability of bring compromised. Otherwise I can know for certain when something is not your password each time I get it wrong.

I hate that HN users downvote concepts they disagree with. One can agree that rotation is good in theory and bad/annoying in practice (due to laziness). We can only argue about how much of an impact it makes, but it certainly does not reduce the security. We all deal with "password rotation" in real life and it's inescapable: credit cards expire. And to be fair I'm perfectly fine with that because I know a leak from…

> it certainly does not reduce the security.

Yes it does. The more often you have to pick passwords, the more likely you are to pick weaker ones.

> We all deal with "password rotation" in real life and it's inescapable: credit cards expire. And to be fair I'm perfectly fine with that because I know a leak from 10 years ago can no longer affect me. I almost wish they expired earlier.

When a credit card is about to expire, doesn't the new one the bank sends you usually have the same number?

Re: Password Requirements: Myths and Madness

#140

Post by alanfranz »

bruce511 wrote: post #94

The article is correct, most password policies are dumb. But it's arguing about one tree while standing in a forest. The real problem with passwords is not individual policies, but rather their shere volume. In my password manager I noticed I have got literally hundreds of the things. Clearly reusing a password on multiple systems is bad. Clearly memorizing more than a handful is impossible. Since I therefore am usin…

Author here. As you can see in the closing lines:

> I really hope that passwordless login will make some steps forward in the next years

But, in the meantime I wouldn't despise passwords THAT much, if the policies were not stupid. Using any kind of SSO (e.g. login via Google or MS or Apple) puts multiple accounts under the umbrella of some internet giants; if at any time they revoke your account, you risk losing access to multiple other unrelated sites (not to mention the fact they'll know even more usage patterns).

Post reply on HN