Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Requirements: Myths and Madness

franzoni.eu

Post reply on HN
Print view View original

211–220 of 257 posts

Re: Password Requirements: Myths and Madness

#211

Post by e12e »

I recall a talk at passwordcon by Per Thorsheim where he pointed out that not only does the password: "Password2022" meet most "strict" criteria (three different character classes, longer than eight characters) - and -it's amenable to yearly demands for changing (increase the year) - but in large organizations you're actually very likely to find a user or two with this password (as seen in audits that ran simple brute force against the user directory).

PS: in the rare case it's not "secure" enough, add an exclamation point: "Password2022!"

Re: Password Requirements: Myths and Madness

#212

Post by unnah »

koolba wrote: post #78
csydas wrote: post #52

Earlier quoted context omitted.

> The problem is that the demand isn't being made by security professionals, it's being made by risk management people I'm actually not sure how true this is. There is a huge "security checklist" industry backed by persons with some fancy Security title that provide security analysis checklists for companies to follow, often citing very interesting interpretations of best practices from actual security orgs. These ch…

> Past password similarity checking (I'm actually not even sure how they do this unless they somehow have access to the plaintext version of user passwords; if there's a benign/secure way of doing this I'd be very curious) Most systems that allow you to change your password require the current password as a verification. This means the software performing the validation of the new password also has access to your old…

If the system asks for the old password before allowing the user to enter a new password, it could then simply save the old password in plaintext, so that the saved password can be used for similarity checks in the future. In the same way, the system could easily store e.g. 10 previous passwords in plaintext.

Re: Password Requirements: Myths and Madness

#213

Post by Someone1234 »

pontilanda wrote: post #138
Someone1234 wrote: post #82

Earlier quoted context omitted.

> Rotating passwords is an old idea but mathematically it does reduce the probability of bring compromised. Please can you show your work. Most websites limit the attempts per user per time, which should make direct request break-ins unrealistic to mathematically impossible. So now we move the needle to "Your user database has been stolen, someone is trying to break hashed + salted passwords" which is such a problema…

Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rotation. Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services. Side note: I despise rotation as much as the next guy, but I can see the value in it. If users used password managers, gene…

> Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rotation.

Nope, that wasn't my assumption. What I said above applies there equally.

> Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services.

No it doesn't, in fact it increases password reuse and results in pattern-style passwords.

Re: Password Requirements: Myths and Madness

#214

Post by taeric »

AnIdiotOnTheNet wrote: post #204
taeric wrote: post #126

Earlier quoted context omitted.

I'm afraid to ask what you think are the better ways? My assertion is that most risk of online fraud is a social, not a technical problem. As such, it will require law to make safe.

For example, asymmetric key pairs. Give sites a public key and auth by signing something with your private key. You can use the same key on as many sites as you want, but you can also use different keys for different sites. No need for a third party even.

This is, essentially, harder to remember passwords.

Probably more secure, provided you don't make a mistake. But also easier to mistake and then lock yourself out. Auditing is also harder, now

Re: Password Requirements: Myths and Madness

#215

Post by wohfab »

dspillett wrote: post #170

> You cannot enter a password with more than X chars I've seen this from banks , for access to my money & credit... Both FirstDirect and HSBC used to have a 9 character password for their "digital secure key"s (basically their apps on my phone, in the direct use use-case). 9. Just 9. Though at least alpha-numeric & case-sensitive, so some room for reasonable entropy. Worse: for some reason HSBC recently changed their…

Sky (Germany) has 4 digit codes for their accounts. Ridiculous.

Re: Password Requirements: Myths and Madness

#217

Post by taeric »

upofadown wrote: post #199
mr_mitm wrote: post #171

Earlier quoted context omitted.

So that the friend, or someone who steals from the friend can impersonate me? Proving your identity when you lost your proof of identity is still an unsolved problem if you ask me. At least in general, it seems that there is no one solution that works for everyone.

Put a PIN on it... You can remove the PIN later. The hardware key can be set up to wipe the device after, say, 10 incorrect guesses.

If it can be wiped on incorrect pin usage, you can be maliciously locked out of accounts relatively easily.

Re: Password Requirements: Myths and Madness

#218

Post by alanfranz »

davedx wrote: post #175

I stopped reading at the password length isn’t password strength part. This goes against NIST guidelines and is opinion. Just follow NIST password guidelines guys.

This is an explanation and reasoning. It’s designed to make people think about policies and scenarios, and not to blindly apply random suggestions.

What is against NIST guidelines?

The length argument works both ways: just as a purely lowercase alphabetic password, if long enough, is safe, a very short (in term of code points) password with full unicode spectrum can be safe as well.

Re: Password Requirements: Myths and Madness

#219

Post by AnIdiotOnTheNet »

taeric wrote: post #214
AnIdiotOnTheNet wrote: post #204

Earlier quoted context omitted.

For example, asymmetric key pairs. Give sites a public key and auth by signing something with your private key. You can use the same key on as many sites as you want, but you can also use different keys for different sites. No need for a third party even.

This is, essentially, harder to remember passwords. Probably more secure, provided you don't make a mistake. But also easier to mistake and then lock yourself out. Auditing is also harder, now

No it isn't, because unlike passwords you can reuse a key pair indefinitely without suffering any greater risk.

If we only ever had to remember a handful of passwords you would be right about them being easier, but we have hundreds of them which necessitates a password manager anyway which has all the same manageability problems of the asymmetric key pair without any of the benefits.

> Auditing is also harder, now

Care to elaborate?

Re: Password Requirements: Myths and Madness

#220

Post by throwawaaarrgh »

alanfranz wrote: post #208
gtirloni wrote: post #202

>You waste a lot of time at generating a "strong password" that complies with a website's policy I let my password manager do it and don't bother with it any time soon.

But your generated password contains "-", and that's not accepted by the website. How can you not bother?

Password manager password generators have a simple UI you can click to select the password format required by the form. Or just click 'generate' again and try each until one works.
Post reply on HN