Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Requirements: Myths and Madness

franzoni.eu

Post reply on HN
Print view View original

241–250 of 257 posts

Re: Password Requirements: Myths and Madness

#241

Post by AnIdiotOnTheNet »

taeric wrote: post #238
AnIdiotOnTheNet wrote: post #219

Earlier quoted context omitted.

No it isn't, because unlike passwords you can reuse a key pair indefinitely without suffering any greater risk. If we only ever had to remember a handful of passwords you would be right about them being easier, but we have hundreds of them which necessitates a password manager anyway which has all the same manageability problems of the asymmetric key pair without any of the benefits. > Auditing is also harder, now Ca…

You still have to remember what it is that you signed. Unless you are saying it is a challenge/response thing. In which case you have to know what public key they have. And if it is challenge/response, you need to have different public keys, or a compromised private key is complete game over, just like a shared password. Thinking on it more, I'm not sure why I think auditing is harder. Is hard regardless, but I don't…

> You still have to remember what it is that you signed. Unless you are saying it is a challenge/response thing. In which case you have to know what public key they have.

You say that like it is a problem? Like I said, you could easily and securely get away with a single private key, so there isn't really any guesswork here. Certainly remembering usernames for hundreds of sites would be worse.

And if you want a different key pair for your porn, you can do that and it is on you to remember which one to use, same as usernames and passwords.

> a compromised private key is complete game over

Yeah, just like a compromised password manager is. Can't really do much about that.

Re: Password Requirements: Myths and Madness

#242

Post by throwoutway »

alanfranz wrote: post #228
e12e wrote: post #211

I recall a talk at passwordcon by Per Thorsheim where he pointed out that not only does the password: "Password2022" meet most "strict" criteria (three different character classes, longer than eight characters) - and -it's amenable to yearly demands for changing (increase the year) - but in large organizations you're actually very likely to find a user or two with this password (as seen in audits that ran simple brut…

One good complexity check would be “contains a single dictionary word as the main content.” I don’t know if library does it, though.

Why is this a good complexity check?

Re: Password Requirements: Myths and Madness

#243

Post by alanfranz »

throwoutway wrote: post #242
alanfranz wrote: post #228

Earlier quoted context omitted.

One good complexity check would be “contains a single dictionary word as the main content.” I don’t know if library does it, though.

Why is this a good complexity check?

Because dictionary attacks are easy on single words + small mutations, like some capitalizations and adding 1-2 digits.

Re: Password Requirements: Myths and Madness

#244

Post by puffoflogic »

lttg wrote: post #117
_dan wrote: post #32

In the b2b world it's basically impossible to improve password policies. Most of the onerous examples only exist because some other entity (a customer, insurance company, parent company, etc) has demanded them. The problem is that the demand isn't being made by security professionals, it's being made by risk management people who are only interested in a simple way to mitigate risk - it's simply much easier for them…

I was in charge of password policy for a healthcare app. We tried to use phrases, often cited as more secure than character/length requirements. The doctors hated it. They didn't understand what a phrase was, it was too different from every other system they interacted with, and it was extra cog load in their already busy days.

> it was too different from every other system they interacted with

Translation: they couldn't use the same standard password they use for their banking, their email (also used for 2fa), Facebook, and this porn site they found by clicking on a pop-up ad.

Re: Password Requirements: Myths and Madness

#245

Post by upofadown »

taeric wrote: post #217
upofadown wrote: post #199

Earlier quoted context omitted.

Put a PIN on it... You can remove the PIN later. The hardware key can be set up to wipe the device after, say, 10 incorrect guesses.

If it can be wiped on incorrect pin usage, you can be maliciously locked out of accounts relatively easily.

Then you are going to know that the friend was messing with your hardware key. Better that than finding out they are willing to betray you by stealing from you.

Re: Password Requirements: Myths and Madness

#246

Post by makach »

alanfranz wrote: post #209
makach wrote: post #161

Your passwords are safe as long as you have done your part, i.e. followed best practice on how to set up your passphrase for accessing your information. LastPass implemented a system that is durable, as long as your HW is not compromised or you are somehow duped into giving away your password you should expect your passwords to be safe. If you are worried, change your passphrase in accordance with best practice and y…

Did you just comment on the wrong article?

Yes! My addiction so visible , how embarrasing!

Re: Password Requirements: Myths and Madness

#247

Post by ddejohn »

midasuni wrote: post #180
ddejohn wrote: post #96

Earlier quoted context omitted.

Typing a passphrase is so much easier. You already have muscle memory for typing English (or whatever your first language) words. I can type probably type a 60 character passphrase consisting of real words at least as quickly as than I can type a 15 character password with special characters, if not faster.

I type my arbitrary 12 character password for my laptop as quickly as I’d type two 6 letter common words, due to muscle memory, as I don’t have to change it every few months.

> 12 character password

Those are rookie numbers!

In all serious, my point is roughly that typing Sp3c1al_(h4racTer_p@ssw0rd$ is like O(n) whereas typing passphrases is like O(log n). Once you hit a certain length, pass phrases start pulling ahead in ease-of-use.

We're already constantly maintaining muscle memory just by typing normal words every day. With muscle memory for special character passwords, you have to start over from scratch every time you have to change one.

In other words, imagine I flipped over a flashcard with a new passphrase on it consisting of lowercase English words, and asked you to type it. Now imagine I flip over a flashcard with a new, special character password. How many more times do you think you'd have to reference the flashcard with the special character password while typing it out and developing the muscle memory over the flashcard with the passphrase?

Re: Password Requirements: Myths and Madness

#248

Post by simpss »

Jenk wrote: post #203
yourapostasy wrote: post #194

Earlier quoted context omitted.

> After pointing to the NIST standards (and two other references) saying that that reduced security and saying "we're not prepared to reduce our security"... Tip for those in settings with compliance reviews and cybersecurity insurance: get your PCI DSS, SOX, and other auditors, and cybersecurity insurance underwriter on board with these standards as well, with written statements. Then if Big Customer Co. pushes back…

It's actually PCI DSS that has propagated some of these bad practices.

4.0 will remove the expiration requirement finally.

Re: Password Requirements: Myths and Madness

#249

Post by joezydeco »

zargon wrote: post #160
joezydeco wrote: post #113

Earlier quoted context omitted.

I'm just amused by the irony of forgetting my password, going through the reset process, then realizing I did remember my password. Except now I can't use it any more.

Does it not let you log in with your old password after requesting a password change? That seems even more problematic, since anyone can request you password be changed.

Sometimes it does, sometimes it doesn't. More annoyances.

Re: Password Requirements: Myths and Madness

#250

Post by joezydeco »

boring_twenties wrote: post #57
ar_turnbull wrote: post #45

Earlier quoted context omitted.

would be a nicer UX if instead of "sorry" it was "great, your password hasn't changed as this was your old password. ps. you're now logged in, go do whatever you were hoping to do you rascal!"

It's not preventing you from changing it to the current password, it's preventing you from changing it to any of the previous N passwords where N is usually 3-10.

But sometimes N=0.
Post reply on HN