Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Limiting passwords to 12 characters is "secure enough"

forums.stardock.com

Post reply on HN
Print view View original

31–40 of 111 posts

Re: Limiting passwords to 12 characters is "secure enough"

#31

Post by rogerbinns »

Natsu wrote: post #23
rogerbinns wrote: post #17

Earlier quoted context omitted.

You are missing the same point they are. A hash doesn't care about the input length and produces a fixed size output. Consequently if Stardock are claiming there is a need for a limited input length then it is a very good "smell" they are not using hashing at all. The lack of hashing is the problem and debating acceptable length limits is avoiding the topic.

I've long used this smell to identify companies not to trust with security. It's rare that I would be willing to create an account somewhere just to buy something, but a policy like this is always a deal-breaker for me, because I would expect them to get hacked.

Another smell is bizarre rules. Rank amateurs are quickly spotted by requirements not to use various characters related to SQL injection and XSS. The other week I encountered a site that whined about consecutive letters, case and numbers. (My password was randomly generated by a password manager.)

Re: Limiting passwords to 12 characters is "secure enough"

#32

Post by eru »

eksith wrote: post #16

Get a whole heap of passwords from random.org. Create a text file with the sites you use with the usernames/passwords. PGP Encrypt the whole ensamble with a good strong password. The only one you really need to remember. Forget your password? Once you reset via email, as soon as you get access to that encrypted file, get a new random password and reset it again. Save the new password in the encrypted file. Password m…

> Get a whole heap of passwords from random.org.

I suggest /dev/random or /dev/urandom, as it doesn't involve a third-party. You can xor with data from random.org, if that makes you feel better.

> Forget the password to the encrypted text file? Throw your life away and start a new identity.

Just print out the plaintext of your password text file, and store the piece of paper somewhere reasonably secure. I say `reasonably' because if someone were to gain physical access to your computer, they could install a keyboard logger anyway.

Re: Limiting passwords to 12 characters is "secure enough"

#33

Post by mnutt »

eksith wrote: post #16

Get a whole heap of passwords from random.org. Create a text file with the sites you use with the usernames/passwords. PGP Encrypt the whole ensamble with a good strong password. The only one you really need to remember. Forget your password? Once you reset via email, as soon as you get access to that encrypted file, get a new random password and reset it again. Save the new password in the encrypted file. Password m…

Using PGP sounds fine, but why trust a random (ha) website more than you trust a browser plugin?

Even though you generated a bunch (up to 100), what is to stop random.org from storing every one of those? Much better to just use pwgen or similar.

1Password allows you to sync the encrypted file via dropbox, so if you lose your access you'll still have the encrypted file, you just won't have any updates. And if you can't trust the browser plugin, you can't trust your browser either and no password scheme will help.

Re: Limiting passwords to 12 characters is "secure enough"

#34

Post by stopcyring »

Any user input needs to be filtered, sanitized, validated and limited. Please be my guest and pass any user input to your magic hashing function, don't cry about it later because due to some special circumstances / framework bug / language bug / buffer overflow / extra hidden utf char, your magic function opens a huge security hole. oh oops.

Re: Limiting passwords to 12 characters is "secure enough"

#35

Post by Jayschwa »

yarianluis wrote: post #13

This is far from the worst offender. Banks are typically the worst. All sorts of gimmicky password requirements. 8-12 characters. Must have one capital letter. Must have one number. No special symbols. So "I can't believe it's not butter!" won't work, yet that would probably be a pretty secure password, and be entirely rememberable. In fact I could come up with a silly pun-filled sentence for each site I visit and ma…

The poor state of bank passwords is fresh in my head from working on taxes tonight. It's kinda sad that the message boards I use for non-sense are probably more secure than my banks with respect to password handling.

That said, I don't think Stardock gets a free pass just because a lot of banks suck at it.

Re: Limiting passwords to 12 characters is "secure enough"

#36

Post by krallja »

adrr wrote: post #28
peeters wrote: post #20

Earlier quoted context omitted.

Again, the point isn't about whether 12 is enough. It could have been 64 and the point would still stand. The OP's point is that limiting password length (to anything less than 1000 or so) is usually done to be able to set a maximum length on the password column of a database. Password hashes, on the other hand (including bcrypt), produce fixed-length hashes, regardless of the input size.

bcrypt has a 50 char limit. You could always prehash(sha256) the password before passing it to bcrypt.

That is not something I would have guessed about bcrypt. I learned something new today.

Re: Limiting passwords to 12 characters is "secure enough"

#37

Post by [deleted] »

Cogito wrote: post #22
jimrandomh wrote: post #5

As I see it, character limits aren't so much about security, as just a dumb way to be hostile to the user. All of my passwords are site-specific unique passwords generated by a password manager. I don't care if you store plain-text passwords, because if someone steals passwords out of your database then they already have all the access that my password to your site would've given. But if a site rejects the password t…

> if someone steals passwords out of your database then they already have all the access that my password to your site would've given I see where you are coming from, however this premise is fatally flawed. If my password is stored in plain text then an attacker needs only to read just my password and they have access to my account. If the site is susceptible to SQL injection attacks it is perfectly reasonable that t…

[deleted]

Re: Limiting passwords to 12 characters is "secure enough"

#38

Post by idupree »

eksith wrote: post #16

Get a whole heap of passwords from random.org. Create a text file with the sites you use with the usernames/passwords. PGP Encrypt the whole ensamble with a good strong password. The only one you really need to remember. Forget your password? Once you reset via email, as soon as you get access to that encrypted file, get a new random password and reset it again. Save the new password in the encrypted file. Password m…

(my tinfoil hat mode: I don't even have any important secrets but I believe in knowing how to protect them)

Use /dev/urandom, not a website. Make sure you have configured your text editor not to automatically save any backup files, cut buffers, or the like, and never write it to disk in unencrypted form. (I use vim >= 7.3 and its blowfish encryption; see encryptedvimrc and random_alnum in my scripts https://github.com/idupree/scripts ) If you copy/paste passwords, make sure you don't have a clipboard manager that persists recent history to disk. Also, encrypt your filesystem in case you screw up on any of the above. If you have swap, make sure that's encrypted with a generated-per-boot-from-urandom key generated after loading last boot's stored entropy from the disk. (A dedicated password-managing program might do some of these things for you. I haven't looked into their security methods yet; have you?)

If you can, use an email provider for your acct-registrations that uses decent security practices; use a high-entropy password for it; use different email addresses for every site, to make it harder for social engineering attacks (someone calling, say, Amazon or Apple's call center pretending to be you). The latter is probably hard unless you use your own domain or think '+' addresses are sufficient. If you use your own domain, you're vulnerable to your registrar or your account with them or your DNS being compromised, but you should have rigorous passwords and good registrars here because losing your domain name stinks. If malware gets on your computer, it can watch you and steal your passwords, so keep your system and browser up-to-date with security updates, disable riskier parts of your system that you can live without, prefer OSes/systems that are more on top of their security, and don't make enemies.

I don't understand why password managers like OnePass store passwords online; everything else they're doing as browser plugins is fighting the good fight. (True, there are risks of giving the browser the ability to access your passwords at all; but they're probably less than the risks of password reuse and low password entropy, and greater convenience means more people will use the system for more sites. Firefox Sync is the only consumer-friendly online storage that I've seen and consider well-engineered-&-documented enough to consider trusting. Tarsnap and Tahoe-LAFS also meet everything but the "consumer-friendly" bit there, and have a somewhat different focus. It may be worth considering encrypted online mirrors legitimate (online mirrors, not sole copies) for the sake of people who don't do backups, have multiple devices, and/or have their disk fail or device stolen.).

Re: Limiting passwords to 12 characters is "secure enough"

#39

Post by pyre »

mnutt wrote: post #33
eksith wrote: post #16

Get a whole heap of passwords from random.org. Create a text file with the sites you use with the usernames/passwords. PGP Encrypt the whole ensamble with a good strong password. The only one you really need to remember. Forget your password? Once you reset via email, as soon as you get access to that encrypted file, get a new random password and reset it again. Save the new password in the encrypted file. Password m…

Using PGP sounds fine, but why trust a random (ha) website more than you trust a browser plugin? Even though you generated a bunch (up to 100), what is to stop random.org from storing every one of those? Much better to just use pwgen or similar. 1Password allows you to sync the encrypted file via dropbox, so if you lose your access you'll still have the encrypted file, you just won't have any updates. And if you can'…

  | And if you can't trust the browser plugin, you
  | can't trust your browser either
Depends. Adding plugins extends the attack surface area. Also, the plugin author(s) may not be as diligent at stamping out bugs/security holes as the browser developer(s).

Re: Limiting passwords to 12 characters is "secure enough"

#40

Post by eksith »

eru wrote: post #32
eksith wrote: post #16

Get a whole heap of passwords from random.org. Create a text file with the sites you use with the usernames/passwords. PGP Encrypt the whole ensamble with a good strong password. The only one you really need to remember. Forget your password? Once you reset via email, as soon as you get access to that encrypted file, get a new random password and reset it again. Save the new password in the encrypted file. Password m…

> Get a whole heap of passwords from random.org. I suggest /dev/random or /dev/urandom, as it doesn't involve a third-party. You can xor with data from random.org, if that makes you feel better. > Forget the password to the encrypted text file? Throw your life away and start a new identity. Just print out the plaintext of your password text file, and store the piece of paper somewhere reasonably secure. I say `reason…

I'm not too fond of printing out passwords. If I forget, and I'm extremely forgetful, that's just a disaster waiting to happen. I know my brain and I know it can't be trusted with physical security. Also, I'd rather use /dev/urandom instead of simply /dev/random.

Considering my aversion to using a stranger's computer to login to my accounts and the fact that I never use an open WiFi connection for anything without Tor, I'm much happier using a local copy of the encrypted file or at the very least a secure offline mirror(s) to download a copy of the encrypted file if I don't have it handy.

Post reply on HN