Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Requirements: Myths and Madness

franzoni.eu

Post reply on HN
Print view View original

151–160 of 257 posts

Re: Password Requirements: Myths and Madness

#151

Post by leni536 »

cirrus3 wrote: post #47
halostatue wrote: post #41

Earlier quoted context omitted.

It can also be done securely if you have a flag that, when a password reset link is redeemed , the password must be reset in order to log in. There’s a couple of steps needed to make that happen cleanly (such modification should not be done on the GET of the password reset, but on a POST after the password reset link, prior to testing the passwords against old passwords and other security mechanisms).

yep, all true... this is a solved problem on how to do it right. The fact that the OP finds this interaction funny leads me to believe they don't understand how it can be done correctly, which is scary.

The point isn't that this is not secure. It's just that it isn't more secure, when it prevents setting the current, active password. An attacker could already just log in with that password.

Re: Password Requirements: Myths and Madness

#152

Post by dwaite »

nigerianbrince wrote: post #106
bruce511 wrote: post #94

The article is correct, most password policies are dumb. But it's arguing about one tree while standing in a forest. The real problem with passwords is not individual policies, but rather their shere volume. In my password manager I noticed I have got literally hundreds of the things. Clearly reusing a password on multiple systems is bad. Clearly memorizing more than a handful is impossible. Since I therefore am usin…

Our computers should have a specific port for a physical key which we would carry around in our keychain.

Something like https://www.yubico.com/product/security-key-c-nfc-by-yubico/ ?

Re: Password Requirements: Myths and Madness

#153

Post by pontilanda »

josephcsible wrote: post #139
pontilanda wrote: post #134

Earlier quoted context omitted.

I hate that HN users downvote concepts they disagree with. One can agree that rotation is good in theory and bad/annoying in practice (due to laziness). We can only argue about how much of an impact it makes, but it certainly does not reduce the security. We all deal with "password rotation" in real life and it's inescapable: credit cards expire. And to be fair I'm perfectly fine with that because I know a leak from…

> it certainly does not reduce the security. Yes it does. The more often you have to pick passwords, the more likely you are to pick weaker ones. > We all deal with "password rotation" in real life and it's inescapable: credit cards expire. And to be fair I'm perfectly fine with that because I know a leak from 10 years ago can no longer affect me. I almost wish they expired earlier. When a credit card is about to exp…

> doesn't the new one the bank sends you usually have the same number?

Never happened to me using several European banks. Either way the date and CVV change so that's part of the new password.

> Yes it does. The more often you have to pick passwords, the more likely you are to pick weaker ones.

I don’t think so. People will just change the number at the end, it's not like they will stop using aDgTGdE and start using 11111112 simply because of rotation. It's more likely that they will append a ! or change helloworld to helloworld2. It's not a downgrade by any mean.

Plus such rotation even "guarantees" that the password isn't shared across services, unless they're all rotating with the same frequency and they all start with helloworld2

Re: Password Requirements: Myths and Madness

#154

Post by Avamander »

pvorb wrote: post #2

> Or maybe the keyboard layout isn't yet set when the password is entered (example: full disk encryption password at boot) and you risk that a user is entering a password at install time, but what they write at boot is actually different. This is a very good point, which already made me struggle when setting up new computers. For instance, the Ubuntu installer runs in a Gnome environment with my keyboard layout activ…

Ubuntu and probably others set the correct keyboard layout for even GRUB itself, not to mention Linux, so it's fine.

Windows is probably worse, it doesn't even let you remove other layouts.

Re: Password Requirements: Myths and Madness

#155

Post by Avamander »

taeric wrote: post #126
AnIdiotOnTheNet wrote: post #112

Earlier quoted context omitted.

Honestly I'm surprised we're still using user names and passwords for authentication and identification in 2022. We have come up with many better ways to do this, and just completely failed to adopt any of them as the new normal. The closest we get is when we can use Google or Facebook to log into Joe Blow's Bullshit site instead of a bespoke account.

I'm afraid to ask what you think are the better ways? My assertion is that most risk of online fraud is a social, not a technical problem. As such, it will require law to make safe.

Some countries solved it with physical security keys, now large vendors are pushing Passkeys. Both work for this purpose, albeit the first one also has an identity behind it.

Re: Password Requirements: Myths and Madness

#156

Post by allarm »

> You cannot enter a password with more than X chars

And this is the most infuriating thing, especially when the lowest limit is say 8 chars and the highest is something like 12. I get the point that there should be some limit - 64 chars for instance - but limiting the password length to anything less than that is just dumb.

Re: Password Requirements: Myths and Madness

#157

Post by jpalomaki »

Slightly related (funny, for me) thing I came across recently. I was looking into why some orgs prevent you from changing the Windows domain password if it has been changed less than 24h ago.

Turns out there's a reason for this: "Setting the number of days to 0 allows immediate password changes. This setting isn't recommended. Combining immediate password changes with password history allows someone to change a password repeatedly until the password history requirement is met and re-establish the original password again." [1]

[1] https://learn.microsoft.com/en-us/windows/security/threat-pr...

Re: Password Requirements: Myths and Madness

#158

Post by NLips »

wkat4242 wrote: post #83
lelandfe wrote: post #53

Earlier quoted context omitted.

https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret They refer to it as a “Memorized Secret“. The appendix, “Strength of Memorized Secrets” is informative rather than a guideline, but I would recommend quoting it too in such discussions: > composition rules, which require the user to choose passwords constructed using a mix of character types, such as at least one digit, uppercase letter, and symbol. However, an…

I know passphrases are better. But, the problem is there's much more to type every time you want to unlock your computer. And thus also many more chances to make a typo. Of course there's TouchID and Windows hello but they don't work if your laptop is closed in a dock. Or in my case a Mac mini at home. This is why I still stick to the truly random sorry password, I have no issues remembering arbitrary strings for som…

Windows allows you to use a PIN for regular device logon - so you have a longer, more secure password for general use of the account, but an eg 8 digit numeric PIN _only_ for that device.

Re: Password Requirements: Myths and Madness

#159

Post by jjav »

MaxGabriel wrote: post #46
_dan wrote: post #32

In the b2b world it's basically impossible to improve password policies. Most of the onerous examples only exist because some other entity (a customer, insurance company, parent company, etc) has demanded them. The problem is that the demand isn't being made by security professionals, it's being made by risk management people who are only interested in a simple way to mitigate risk - it's simply much easier for them…

You might be able to appeal to NIST standards, which now recommend against some of the bad practices like special characters.

> You might be able to appeal to NIST standards,

Agreed, huge thanks to NIST for the sane password policy recommendations. While it is still an uphill fight to bring sanity into this mess, being able to quote NIST and say we're following their recommendation has been very helpful.

Re: Password Requirements: Myths and Madness

#160

Post by zargon »

joezydeco wrote: post #113
the_af wrote: post #34

Earlier quoted context omitted.

I think the OP is arguing you can guess a (possibly) current password this way.

I'm just amused by the irony of forgetting my password, going through the reset process, then realizing I did remember my password. Except now I can't use it any more.

Does it not let you log in with your old password after requesting a password change? That seems even more problematic, since anyone can request you password be changed.
Post reply on HN