Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Evernote hacked

blog.evernote.com

Post reply on HN
Print view View original

161–170 of 220 posts

Re: Evernote hacked

#161

Post by entropic »

fiatpandas wrote: post #124
Terretta wrote: post #109

Earlier quoted context omitted.

Your blog post says: > "Avoid using simple passwords based on dictionary words" And yet your password algorithm rejects highly secure pass phrases: > "New passwords can contain letters, numbers and punctuation." Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation dem…

>Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation demand. I just don't understand the logic behind some of these password rules. Wouldn't it require more effort to explicitly disallow certain characters? Like, they wrote code somewhere that is specifically making…

Some banks have IVR systems that allow users to log in to their account via telephone, so they only allow characters that can be entered via the touch-pad.

When you first create your password they translate the characters to the numerals on the phone and then hash it.

In my experience that is the most common reason why you'll see password for policies like: "Your password must be between 6 and 20 characters and only contain upper and lower case letters."

Re: Evernote hacked

#162

Post by Niten »

Terretta wrote: post #145
Niten wrote: post #122

Earlier quoted context omitted.

Anyone using this comic to imply that a passphrase is more secure than a short random password hasn't done the math. This is comparing a passphrase drawn from four of the 2048 most common words against not a random password, but one based on a mutated version of one of the 65536 most common words. The example passphrase does have the equivalent of 44 bits of entropy: log_2 (2048^4) = 4 * 11 = 44 However, if we take a…

> to imply that a passphrase is more secure than a short random password I noted to internalize the idea , the entropy idea versus human "random" passwords which aren't random at all. "Normals" are using their name with a 3 instead of an E, or some word with a 1 on the end. This tends to put them in rainbow tables or easy attacks. See my link #1 in GP comment for reference. That's why I said "pass-phrases are stronge…

Respectfully, you are flat out wrong. This "entropy check" doesn't prove what you think it does.

This password strength test is attempting to estimate the entropy of given passwords under the assumption that it is a word roughly obeying the character distributions of English text, using Shannon's approximation. It does not apply to randomly generated passwords, which violate these assumptions, as described in Appendex A of the NIST plublication linked on that very site.[1] As that document describes, the entropy of a randomly (not user!) selected password is not estimated in this manner, but calculated according to the same formula I provided: H = log_2 (b^L), where b is the number of letters in the alphabet (95) and L is the length of the password. (If the password had any less entropy than that, then by definition it would not have been pseudorandomly generated!)

Additionally, the algorithm employed by this site does not take into account that an intelligent password cracker is capable of exploiting the construction of passphrases.

In other words, you've taken an algorithm designed to approximate the entropy of a user-selected password and misapplied it to both randomly-generated passwords and user-selected passphrases. The fact that the algorithm is able to give you a number for these inputs does not mean it is any valid indication of how difficult such a password or passphrase would be to crack.

[1] http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1...

EDIT: But you're right that passphrases can be easier to use by people. I personally think a password manager like keepass / lastpass / etc. is a better choice than trying to select a memorable password, though.

Re: Evernote hacked

#163

Post by gcr »

tobyjsullivan wrote: post #104
UnoriginalGuy wrote: post #65

Earlier quoted context omitted.

In theory, yes, in practice it is fairly obvious how something is hashed just by eye. Different hash algorithms produce different output (lengths, starting character, and spread). So with some experience you can often tell (or guess and test) what something is hashed with.

I would say that's not really true. The output hash will look the same if I apply a simple salted SHA-1 with a salt or if I apply 500 MD5's followed up followed up with 200 SHA-1's, each salted differently. I'm not a security expert, but I think this is closer to best practice these days. That said, revealing the exact algorithm would basically be throwing people with weak passwords to the wolves while really only su…

For practice, see if you can't identify the hashing algorithm for the following stored passwords:

    $6$AhHvI8ay$I0ED2wWVU9eheJKvCxzcbc/ZYRoN60q5XNHruYp8yFlQvEOjJ1WtIHUwjG6L4ZGntf3ei8osB7s2GYdkN01gx1
    dGhpcyBpcyBzdHVwaWQKCg==
    286755fad04869ca523320acce0dc6a4
    some_salt:ac01346ad1553221506dd091800a1974
    c8fed00eb2e87f1cee8e90ebbe870c190ac3848c
    6b3a55e0261b0304143f805a24924d0c1c44524821305f31d9277843b8a10f4e
    /5L0cR/wpFqSA
Note how they don't look the same, so it's quite easy for an attacker to tell the difference.

Want to see how you did? Here's the answer key, in base64:

    MTogTW9kZXJuIGNyeXB0LCBsaWtlIHRoZSBraW5kIHlvdSdkIGZpbmQgaW4gL2V0Yy9zaGFkb3cK
    MjogSnVzdCBiYXNlNjRpbmcgdGhlIHJhdyBwYXNzd29yZCAoc3R1cGlkKQozOiBVbnNhbHRlZCBt
    ZDVzdW0KNDogbWQ1c3VtLCB3aXRoIHNhbHQgcHJlcGVuZGVkCjU6IFVuc2FsdGVkIHNoYTFzdW0K
    NjogVW5zYWx0ZWQgc2hhMjU2c3VtCjc6IE9sZCBVTklYIGNyeXB0KCk=

Re: Evernote hacked

#164

Post by georgemcbay »

sdevlin wrote: post #127
fiatpandas wrote: post #124

Earlier quoted context omitted.

>Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation demand. I just don't understand the logic behind some of these password rules. Wouldn't it require more effort to explicitly disallow certain characters? Like, they wrote code somewhere that is specifically making…

Since you're only going to store the hashed value, there's no practical reason to limit the maximum length of the password.

"Since you're only going to store the hashed value"...

Look fellas, we've got an optimist over here!

Re: Evernote hacked

#165

Post by Terretta »

vikstrous4 wrote: post #160
Terretta wrote: post #145

Earlier quoted context omitted.

> to imply that a passphrase is more secure than a short random password I noted to internalize the idea , the entropy idea versus human "random" passwords which aren't random at all. "Normals" are using their name with a 3 instead of an E, or some word with a 1 on the end. This tends to put them in rainbow tables or easy attacks. See my link #1 in GP comment for reference. That's why I said "pass-phrases are stronge…

When cracking passwords attackers don't just use brute force. The most effective attacks are ones that exploit human patterns such as leet replacements, capital first letter, punctuation at the end, etc. Concatenated words in all lowercase with no spaces is another pattern that can easily be added to their list and probably already is there, so yes, you can assume that that they will be looking at the space of 2048^4…

> The most effective attacks are ones that exploit human patterns such as leet replacements...

I think you missed my first paragraph, where I made that point:

"Normals" are using their name with a 3 instead of an E, or some word with a 1 on the end. This tends to put them in rainbow tables _or_easy_attacks_.

Also, my example passphrase that I was annoyed Evernote wouldn't let me us isn't log2(2048^4), but ~ log2(5000^8) even assuming you know it is words.

This thread is getting of on the tangent of debating XKCD's particular formula. XKCD is not the point.

My original post asked Evernote Team to please grok the idea of that cartoon, which it's obvious they had not given their clearly wrong tips and rejection of a very strong password and acceptance of one of the weakest.

Re: Evernote hacked

#166

Post by miles »

Niten wrote: post #122
Terretta wrote: post #109

Earlier quoted context omitted.

Your blog post says: > "Avoid using simple passwords based on dictionary words" And yet your password algorithm rejects highly secure pass phrases: > "New passwords can contain letters, numbers and punctuation." Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation dem…

Anyone using this comic to imply that a passphrase is more secure than a short random password hasn't done the math. This is comparing a passphrase drawn from four of the 2048 most common words against not a random password, but one based on a mutated version of one of the 65536 most common words. The example passphrase does have the equivalent of 44 bits of entropy: log_2 (2048^4) = 4 * 11 = 44 However, if we take a…

Thanks for igniting this discussion, Niten. While digging around, I stumbled onto this tool which others might find helpful:

https://github.com/lowe/zxcvbn

zxcvbn, named after a crappy password, is a JavaScript password strength estimation library. Use it to implement a custom strength bar on a signup form near you!

zxcvbn attempts to give sound password advice through pattern matching and conservative entropy calculations. It finds 10k common passwords, common American names and surnames, common English words, and common patterns like dates, repeats (aaa), sequences (abcd), and QWERTY patterns.

Sample results (including Tr0ub4dour&3 and correcthorsebatterystaple) and a demo can be found here:

http://dl.dropbox.com/u/209/zxcvbn/test/index.html

Re: Evernote hacked

#167

Post by mieubrisse »

In the post, they say:

"The investigation has shown, however, that the individual(s) responsible were able to gain access to Evernote user information, which includes usernames, email addresses associated with Evernote accounts and encrypted passwords. Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salted.)

While our password encryption measures are robust, we are taking additional steps to ensure that your personal data remains secure. This means that, in an abundance of caution, we are requiring all users to reset their Evernote account passwords. Please create a new password by signing into your account on evernote.com."

What it doesn't say is how the passwords were dumped in the first place, or what they're going to do to ensure it doesn't happen again (outside of taking "additional steps"). I understand that not all users of Evernote are technical, but I'd like some peace of mind that a similar thing is less likely to happen in the future.

Re: Evernote hacked

#168

Post by bproctor »

fiatpandas wrote: post #124
Terretta wrote: post #109

Earlier quoted context omitted.

Your blog post says: > "Avoid using simple passwords based on dictionary words" And yet your password algorithm rejects highly secure pass phrases: > "New passwords can contain letters, numbers and punctuation." Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation dem…

>Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation demand. I just don't understand the logic behind some of these password rules. Wouldn't it require more effort to explicitly disallow certain characters? Like, they wrote code somewhere that is specifically making…

netteller (I think was the name?), an online banking system used by many smaller banks, including the bank I used to bank at in Tennessee, used to require passwords be exactly 6 alphanumeric characters. This didn't change until just a year or two ago. Scary.

Re: Evernote hacked

#169

Post by luser001 »

miles wrote: post #166
Niten wrote: post #122

Earlier quoted context omitted.

Anyone using this comic to imply that a passphrase is more secure than a short random password hasn't done the math. This is comparing a passphrase drawn from four of the 2048 most common words against not a random password, but one based on a mutated version of one of the 65536 most common words. The example passphrase does have the equivalent of 44 bits of entropy: log_2 (2048^4) = 4 * 11 = 44 However, if we take a…

Thanks for igniting this discussion, Niten. While digging around, I stumbled onto this tool which others might find helpful: https://github.com/lowe/zxcvbn zxcvbn, named after a crappy password, is a JavaScript password strength estimation library. Use it to implement a custom strength bar on a signup form near you! zxcvbn attempts to give sound password advice through pattern matching and conservative entropy calcul…

Pretty cool tool! My passphrases (omitting spaces between words) get a score of 2. But if I drop the vowels, the score goes to 4 and crack time to 'centuries'.

I wonder if this is a good way to create passphrases. Anybody want to chime in?

Re: Evernote hacked

#170

Post by Terretta »

Niten wrote: post #162
Terretta wrote: post #145

Earlier quoted context omitted.

> to imply that a passphrase is more secure than a short random password I noted to internalize the idea , the entropy idea versus human "random" passwords which aren't random at all. "Normals" are using their name with a 3 instead of an E, or some word with a 1 on the end. This tends to put them in rainbow tables or easy attacks. See my link #1 in GP comment for reference. That's why I said "pass-phrases are stronge…

Respectfully, you are flat out wrong. This "entropy check" doesn't prove what you think it does. This password strength test is attempting to estimate the entropy of given passwords under the assumption that it is a word roughly obeying the character distributions of English text, using Shannon's approximation. It does not apply to randomly generated passwords, which violate these assumptions, as described in Appende…

First, all this is beside the point. Evernote hasn't understood the concepts of either entropy or human chosen passwords. Rejecting my passphrase and accepting "abc123" is wrong. That's my original post, and that's what you objected to. Computer generated random passwords that nobody's going to use on their mobile phone Evernote client, simply don't figure into normal human use.

Our job is to recommend things that can help real people use tech more safely.

> "the entropy of a randomly (not user!) selected password is not estimated in this manner, but calculated according to the same formula I provided: H = log_2 (b^L), where b is the number of letters in the alphabet (95) and L is the length of the password"

Yes, I'm aware of that. Using that site's check, "correct horse battery staple" comes out weaker at 104.2 bits, so I listed that weaker "lower bound"[1] for that phrase. I'm happy to use whatever formula comes up with less entropy for reasons discussed in [1].

I also don't care when sharing with less technical users if it's exact. I care if I can point them to a URL that gives a reasonable approximation, which that "quick check" does. For users who want to do math, I listed both approaches:

> 1. Quick entropy check: http://rumkin.com/tools/password/passchk.php

> 2. Manual entropy check: http://www.wolframalpha.com/input/?i=log_2%282048%5E4%29

The "manual" check is pre-filled with your suggested formula. It's interesting to compare the entropy check to http://www.passwordmeter.com which I think users will "solve" as if it were a password meter puzzle, in very predictable ways.

Meanwhile, to an attacker trying the whole character space, "correct horse battery staple" is log2(27^28) or 133.1 bits of entropy. And if you use H = log_2 (b^L) on the passphrase that Evernote wouldn't accept, it comes in at 188 bits of entropy.

In any case, the approximation is a more conservative "lower bound" than the formula you're suggesting as applied to character set ^ length.

> I personally think a password manager like keepass / lastpass / etc. is a better choice than trying to select a memorable password, though.

I agree. And I use 1Password and generate random passwords.

Btw, the two truly random passwords from 1Password (equivalent of keepass, lastpass, etc), if working with the H = log_2 (b^L) formula, give only 98 bits and 101 bits. Again in their case, the "quick entropy check" URL gives lower numbers, meaning it's a remains a reasonable "lower bound" check for casual users who don't grok formulas.

I tell non-technical family members and friends who can't be bothered with password minders to use sentences meaningful to them and unlikely to be in a book.

    This phrase is definitely not in the dictionary! : 227 bits or 286 bits
That's a pretty good password that my Mom can remember.

--

1. lower bounds: http://subrabbit.wordpress.com/2011/08/26/how-much-entropy-i...

Post reply on HN