Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why even let users set their own passwords?

devever.net

Post reply on HN
Print view View original

371–380 of 392 posts

Re: Why even let users set their own passwords?

#371

Post by Terretta »

justsomeadvice0 wrote: post #105
croes wrote: post #84

Earlier quoted context omitted.

A password can be stored offline without any electronic device or even be memorized only. Passkey depends on your device.

While you can't memorize it (memorizing a fair amount of entropy would take an intelligent human quite some time), you can of course store them offline (it's just a key). Today's initial implementation on macOS restricts exporting, but that is supposed to be added according to reliable Apple devs: https://hachyderm.io/@rmondello/110329118270492669

> memorizing a fair amount of entropy would take an intelligent human quite some time

Everyone who has seen it remembers correct horse battery staple and intelligent humans find it relative straightforward to reroll diceware until they can imagine a story for the words they see.

Permute case, use symbols and digits as word dividers, and most HN readers can remember 'uncrackable' amounts of entropy.

Re: Why even let users set their own passwords?

#372

Post by orev »

chickenWing wrote: post #360
orev wrote: post #158

Earlier quoted context omitted.

Please pay attention to the use of pass-PHRASE. Pass-phrases are well understood at this point as far as what they are and how to generate them securely. A key point is that they’re much longer so have plenty of entropy to resist cracking attempts.

Sadly you still have many sites that have stupid password rules like requiring numbers and "special characters" -- but no spaces, and no, periods don't count as special characters, and blah blah blah. Point being, the ideal of a simple phrase that's easy to remember gets thrown out the window when you have to deal with all the different rules.

I’m getting very confused about the comments here that are trivially refuted. So make a passphrase like: Correct6$Horse7&Battery and be done with it. That’s still easy to write down and remember while transcribing.

Nobody’s arguing that passwords/phrases should only be remembered and never written down or stored in a password manager. That ship sailed a long time ago.

Re: Why even let users set their own passwords?

#373

Post by KnobbleMcKnees »

dredmorbius wrote: post #345
KnobbleMcKnees wrote: post #150

The company I work for currently gave me my password, comprised of four space-separated words, on my first day. It has no expiry and can only be changed at request or if compromised. My only gripe with this approach is that my specific password is a bit awkward to type. I tend to pick passwords at least partly based on "keyboard feel" and it's annoying that there's one word that has a lot of repetition of colocated l…

NB, the EFF's "diceware" passphrase generator method recommends six words for effective security: https://www.eff.org/dice > Note that if your attacker knows the dictionary used , the effective strength of a passphrase isn't based on its string length but on the number of individual words within the phrase. Six words gives an effective key strength of 2^77 bits.

We use six for anything related to an external system or third party (with multi factor where available), and these are password managed behind the same four word pass, plus multifactor.

I'm assuming they stuck with four to make them memorable by actually humans. Even then I have my moments where I type in an adjective form instead of a noun for a particular word/variant.

Re: Why even let users set their own passwords?

#374

Post by KnobbleMcKnees »

felipeccastro wrote: post #276
KnobbleMcKnees wrote: post #150

The company I work for currently gave me my password, comprised of four space-separated words, on my first day. It has no expiry and can only be changed at request or if compromised. My only gripe with this approach is that my specific password is a bit awkward to type. I tend to pick passwords at least partly based on "keyboard feel" and it's annoying that there's one word that has a lot of repetition of colocated l…

This seems an interesting approach, if sufficiently safe for most cases. What if, when creating an account and choosing a password, the app enforced very long passwords but suggested a default, random one like in your example? This would have most of the benefits of the suggestion in the article (high entropy) while still not removing the choice of the user to pick their own preferred password. Does your company also…

Yes, 2/3FA with a hardware key and push for login and access to anything security critical, and 2FA via push for everything else.

Re: Why even let users set their own passwords?

#375

Post by dredmorbius »

KnobbleMcKnees wrote: post #373
dredmorbius wrote: post #345

Earlier quoted context omitted.

NB, the EFF's "diceware" passphrase generator method recommends six words for effective security: https://www.eff.org/dice > Note that if your attacker knows the dictionary used , the effective strength of a passphrase isn't based on its string length but on the number of individual words within the phrase. Six words gives an effective key strength of 2^77 bits.

We use six for anything related to an external system or third party (with multi factor where available), and these are password managed behind the same four word pass, plus multifactor. I'm assuming they stuck with four to make them memorable by actually humans. Even then I have my moments where I type in an adjective form instead of a noun for a particular word/variant.

It's also possible to change effective strength by tweaking the dictionary size --- the total universe of words changes the effective strength of some combination, though lengthening the phrase has a bigger effect.

Coming up with grammatical combinations (adjective noun verb adverb preposition article noun, say: "brown dog ran quickly past the barn") might create more memorisable patterns, though at a cost of key strength.

Taking this to its logical conclusion, we'd have poetic stanzas of epic sagas randomly generated for mnemonic power utilising rhyme and meter....

Re: Why even let users set their own passwords?

#376

Post by xormapmap »

JCharante wrote: post #348
jdthedisciple wrote: post #107

Earlier quoted context omitted.

Sure, you could even reduce phishing attack success rates to nearly 0% by having users authenticate with a sample of their DNA. Does that mean it's a great idea? What about losing the yubikey? In any case it's a different matter when it comes to high stake scenarios, in which case I don't mind something slightly more sophisticated. But not as the default for everything.

> What about losing the yubikey? I have 5 yubikeys on multiple continents. If I lose one I can log in with the others and remove login access with the compromised yubikey.

> I have 5 yubikeys on multiple continents

Are you actually retarded or just disingenuous? This is hardly a workable solution even for security nuts, let alone the average person.

Re: Why even let users set their own passwords?

#377

Post by [deleted] »

lcnPylGDnU4H9OF wrote: post #368
xcxcx wrote: post #354

Earlier quoted context omitted.

That's your opinion. As a New Yorker my personal opinion is that people are, if anything, too sensitive in interpersonal communication. Yet akin to the article, because of the overly sensitive, everyone's expressive creativity must be dulled down. Who's the intolerant one? Reminds me of this classic https://medium.com/incerto/the-most-intolerant-wins-the-dict...

Ah, that’s fair. My comment is phrased as though I’m presenting a fact. Perhaps “the things which are seen as insensitive” is better phrasing. I can agree that people are often over-sensitive but I wouldn’t expect that calling a person deadweight is likely to garner their thoughtful attention, precisely because it is disrespectful. Indeed, it would be foolish of me to expect them to start (or continue) listening to m…

[deleted]

Re: Why even let users set their own passwords?

#378

Post by xcxcx »

lcnPylGDnU4H9OF wrote: post #368
xcxcx wrote: post #354

Earlier quoted context omitted.

That's your opinion. As a New Yorker my personal opinion is that people are, if anything, too sensitive in interpersonal communication. Yet akin to the article, because of the overly sensitive, everyone's expressive creativity must be dulled down. Who's the intolerant one? Reminds me of this classic https://medium.com/incerto/the-most-intolerant-wins-the-dict...

Ah, that’s fair. My comment is phrased as though I’m presenting a fact. Perhaps “the things which are seen as insensitive” is better phrasing. I can agree that people are often over-sensitive but I wouldn’t expect that calling a person deadweight is likely to garner their thoughtful attention, precisely because it is disrespectful. Indeed, it would be foolish of me to expect them to start (or continue) listening to m…

Take it or leave it, I do this on my dime

Re: Why even let users set their own passwords?

#379

Post by naikrovek »

Pesthuf wrote: post #318
rjh29 wrote: post #278

Earlier quoted context omitted.

Thank you for teaching me the word hair-shirt. These kind of blog posts come up often on HN and it's good to have a word to describe them.

Imagine if these people made posts like "I edited user32.dll to dummy out random functions I deem unnecessary like RegisterClass or CreateWindowEx and now nothing works! This is proof that Windows is broken!" It will forever be a mystery for me why people deliberately make their browsers work in ways that contradict the standards the web is built on and then manage to find blame in others when stuff doesn't work. It'…

this happens a lot. A LOT. not this exactly, but I know a lot of people who keep .reg files for "fixing Windows bullshit" on a new system, which they built up when Windows XP or Windows 2000 was new.

Of course, a lot of those "fixes" now break things, because the underlying workings of windows changes a lot, but every last person I know who uses these has very odd problems with Windows that I have never once seen myself.

a lot of these things that only experts knew how to do 20 years ago are now the causes of very odd problems, because these folks don't bother to verify that these registry settings are still the correct way to make the intended changes.

Re: Why even let users set their own passwords?

#380

Post by naikrovek »

xp84 wrote: post #335
j1elo wrote: post #329

Earlier quoted context omitted.

That might be a very misleading statistic. What if more than 0.2% of people wanted to disable JavaScript, but in the end surrended to the fact that those pesky web devs never test their creations with JS disabled? I know I am one of those who would like to disable JS, but it's just not practical. So stats really are a dangerous tool, they sometimes can end up telling you just what you want to hear...

> people...who would like to disable JS, but it's just not practical As I tell my kid when he "wants" something, I want a pony, and a million dollars. I don't see why the fact that some people might like that matters. I mean, given the choice for free sure I'd "like" it too. But it will never remotely be worth it to build two entirely separate web applications for every website to make that dream a reality, nor do I…

why do you want a pony? they don't grow into full-size horses and they eat a lot and poop a lot.
Post reply on HN