71–80 of 93 posts
I absolutely love the concept behind the site. I'd like to submit all the sites that disable copy/paste on their password entry, especially if they have stringent password content policy. My randomly generated 10 word passphrase is more secure than your password policy, but I don't want to type it in by hand, you donkey.
The French Family allowance is an interesting case. https://dumbpasswordrules.com/sites/caf-french-family-allowa... It looks crazy but actually I think they were trying to solve an insolvable issue. The population that will want to use this website is basically anyone who has children in France. That will include some very computer-illiterate people using god knows what public devices, some of them, very likely infec…
These types of character input screens do help against some forms of shoulder surfing or maybe even phishing, but only if your password is random and long enough for it not to be brute-forcible. The problem with this method is that most people will keep their passwords short if you make them more difficult to enter. It's easy to watch someone unlock their phone with a PIN or gesture, steal the phone and open it later…
Good idea. Hope the companies listed take notes. One of the dumbest I've seen is when the username has password-like requirements, like insisting capital letters and numbers.
I'll continue to try though and am evaluate ways that the site can actually help companies update their rules.
ME Bank is the best: - Must be all numerals. - Be 7 to 20 digits. - Cannot have the same number three times in a row. - Cannot have four ascending or descending numbers. - Cannot have the same number appear more than five times. - Cannot have pairs next to each other if the second pair is one number higher. - Cannot be the same as 8 previous ones. It would be fun to work out mathematically how much they're limiting t…
Alright, you nerd sniped me, but I'm lazy so I just simulated it, this cuts down the password space by ~35%. I didn't take into account passwords with leading 0s in my sampling, but this shouldn't change the result by much.
from collections import Counter
from random import randint
def is_valid(password: str) -> bool:
# cannot have the same number 3 times in a row
if any(password[i] == password[i + 1] == password[i + 2] for i in range(len(password) - 2)):
return False
# cannot have 4 ascending numbers
if any(all(password[i] == str(int(password[i + j]) - j) for j in range(4)) for i in range(len(password) - 3)):
return False
# cannot have 4 descending numbers
if any(all(password[i] == str(int(password[i + j]) + j) for j in range(4)) for i in range(len(password) - 3)):
return False
# cannot have the same number appear more than 5 times
if max(Counter(password).values()) > 5:
return False
# cannot have pairs next to each other if the second pair is one number higher
if any(int(password[i:i+2]) == int(password[i+2:i+4]) - 1 for i in range(len(password) - 3)):
return False
return True
total_valid = 0
samples = 10**5
for i in range(samples):
password = str(randint(10**6, 10**20 - 1))
if is_valid(password):
total_valid += 1
print(f"valid passwords: {total_valid}")
print(f"valid percentage: {total_valid / samples * 100:.2f}%")
valid percentage: 65.05%
Earlier quoted context omitted.
Disabling paste anywhere is a cardinal sin. “We want to make sure the user gets this right. So instead of letting them just hit Ctrl+V let’s make them type the whole thing, introducing all sorts of possibilities for errors!”
I wonder, what is the rationale for this "security feature"?
So one dump rule creates another
Earlier quoted context omitted.
Wouldn't this be easily solved by giving bcrypt the sha512 of the password? Though 72 or 36 characters max really isn't so bad.
If you check out the Bcrypt section of OWASP[1] this is exactly what they suggest. [1] https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor... .
- bcrypt implementations that assume zero-terminated strings, which leads to easy attacks if you feed them raw hashes (1/256 chance that the first byte is 0, so on average every 256th user has a password that has a hash collision with with one in every 256 passwords)
- password shucking, which is where the attacker has hash(password) from other breaches (where hash is sha256 or similar), and you use bcrypt(hash(password)) (with the same hash function), which allows the attacker to bcrypt the hashes he has, compare them, and if any match can attack the much weaker hash(password).
Which is probably why their version uses `bcrypt(base64(hmac-sha256(data:$password, key:$pepper)), $salt, $cost)`. That seems complicated, bu the base64 encoding avoids the first issue, and the pepper the second. I guess that shows how easy it is to get these things wrong, even if it seems trivial.
The French Family allowance is an interesting case. https://dumbpasswordrules.com/sites/caf-french-family-allowa... It looks crazy but actually I think they were trying to solve an insolvable issue. The population that will want to use this website is basically anyone who has children in France. That will include some very computer-illiterate people using god knows what public devices, some of them, very likely infec…
These types of character input screens do help against some forms of shoulder surfing or maybe even phishing, but only if your password is random and long enough for it not to be brute-forcible. The problem with this method is that most people will keep their passwords short if you make them more difficult to enter. It's easy to watch someone unlock their phone with a PIN or gesture, steal the phone and open it later…
Earlier quoted context omitted.
Oh, and if you have a maximum password length, I don't trust you with my data.
Only surpassed by _having_ a password length then truncating it to fit rather than throwing an error at registration. That one is a fun one to find out.
ME Bank is the best: - Must be all numerals. - Be 7 to 20 digits. - Cannot have the same number three times in a row. - Cannot have four ascending or descending numbers. - Cannot have the same number appear more than five times. - Cannot have pairs next to each other if the second pair is one number higher. - Cannot be the same as 8 previous ones. It would be fun to work out mathematically how much they're limiting t…
> It would be fun to work out mathematically how much they're limiting the password space with these rules. Alright, you nerd sniped me, but I'm lazy so I just simulated it, this cuts down the password space by ~35%. I didn't take into account passwords with leading 0s in my sampling, but this shouldn't change the result by much. from collections import Counter from random import randint def is_valid(password: str) -…
I still question the interpretation of:
> cannot have pairs next to each other if the second pair is one number higher
But I think the outcome would be the same either way.
In the late 90s I remember signing into my bank account and being sure I mistyped my password. So I logged out and back in and discovered that capitalization didn’t matter… neither did the any characters after the first six characters. It was a large national US consumer bank. I sent them an email. They actually updated their system about 3 months later.