Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UK government's password checker sends plaintext password in the URL over HTTP

getsafeonline.org

Post reply on HN
Print view View original

101–110 of 117 posts

Re: UK government's password checker sends plaintext password in the URL over HTTP

#101

Post by OscarCunningham »

sejje wrote: post #82
hawkharris wrote: post #81

Earlier quoted context omitted.

Well, let's say you have a 5-digit password made up of letters and numbers. That's 60466176 combinations. Now let's say you have a 4-word passphrase. There are about 120,000 words in English. There may be more if you include derivatives of words. That includes 2.0736e+20 combinations, not considering the entropy introduced by spaces between words or punctuation marks. That's just to demonstrate the power of passphras…

It's pretty unfair to compare against a 5-digit password.

Not really. The question was whether words are more or less secure for a given level of ease of memorisation. I'd say 5 random characters are about as easy to memorise as 4 random words.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#102

Post by rikkus »

JTxt wrote: post #93
tnorthcutt wrote: post #89

Earlier quoted context omitted.

Using a password manager

Yes, even better. Can you recommend a password manager that works on all browsers/devices that you trust? I have not found that yet, so I use passphrases customized to the site. Edit: Also fundamentally it means that to access a single site from a compromised device, I'm potentially giving a nice list of all of my credentials.

Google Sheets

Re: UK government's password checker sends plaintext password in the URL over HTTP

#103

Post by Terr_ »

hawkharris wrote: post #81
unfamiliar wrote: post #70

Earlier quoted context omitted.

> but that concern is moot if you use unique words You could say the same thing about passwords using random characters. The problem isn't getting people to remember them, it's getting people to use random passwords/unique words in the first place. Telling people to "use a long sentence" will just result in them picking common sentences most of the time like "To be or not to be" or "Live long and prosper".

Well, let's say you have a 5-digit password made up of letters and numbers. That's 60466176 combinations. Now let's say you have a 4-word passphrase. There are about 120,000 words in English. There may be more if you include derivatives of words. That includes 2.0736e+20 combinations, not considering the entropy introduced by spaces between words or punctuation marks. That's just to demonstrate the power of passphras…

> There are about 120,000 words in English [...] That includes 2.0736e+20 combinations

You forgot using common sense: The number of words most people will actually choose to use is far fewer.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#104

Post by KMag »

pdpi wrote: post #65
Anderkent wrote: post #40

Earlier quoted context omitted.

That's not quite right. Assuming you were picking passwords randomly discarding ones that have repeat letters etc makes for a smaller password space, certainly. However that's not how most passwords are generated, especially among the people that need this advice most. If your password generation algorithm is 'think out a random string' and produces 'aabbbbdccdc' then your password space is tiny. Those practices are…

For each rule in isolation, that's true enough. But the point stands: once you add together all those good practices (repetitions, consecutive letters, multiple character sets), how much does that actually reduce the password space? I'm not saying that the space becomes tiny, I'm saying that it becomes smaller, and I'm not sure whether "smaller" is still acceptably large, and it's an assumption that's worth checking.

The cost in entropy for these restrictions isn't zero, but it's tiny and measurable.

As a conservative estimate, let's assume passwords are only chosen from a set of 84 printable ASCII characters and users never choose passwords longer than 10 characters. (If users are using characters outside this set or longer passwords, they'll have more choices than we're estimating.)

All combinations, including the null password yield 17700847248605297701 combinations, or 63.94 bits of entropy if a password is chosen truly randomly from this set.

Restrict them to passwords at least 7 characters long, and that drops to 17700846893074759680, about 1.9e-9 bits less, still above 63.94 bits.

Further add the restriction that no two adjacent characters are the same and that drops to 15894480881247564960, or 63.78 bits.

Further force the user to use one digit and that drops to 11477476711812418840, or 63.32 bits.

For the sake of my time, I'm going to get a bit sloppy and start over-estimating the cost of restrictions. Further force the user to have at least one upper-case and one lower-case letter and that drops to (more than) 10727550596265784840 passwords, or 63.22 bits.

So, all of these restrictions together cost less than 0.72 bits of entropy. That an easy price to pay for eliminating large classes of trivial passwords.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#105

Post by tombrossman »

JTxt wrote: post #93
tnorthcutt wrote: post #89

Earlier quoted context omitted.

Using a password manager

Yes, even better. Can you recommend a password manager that works on all browsers/devices that you trust? I have not found that yet, so I use passphrases customized to the site. Edit: Also fundamentally it means that to access a single site from a compromised device, I'm potentially giving a nice list of all of my credentials.

I can recommend KeePassX.

It's in the Debian & Ubuntu repositories. It is also in the F-Droid repository for Android mobiles, so you can install and update easily from an AOSP ROM. All of the above are free and open-source which helps quite a bit with establishing trust. If you are among the majority using Windows or Mac it works there, too.

Sync it between devices by storing its (by default encrypted) database in a service like ownCloud or Dropbox.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#106

Post by LeoPanthera »

Pxtl wrote: post #87
maaarghk wrote: post #10

Hahahahaha. This is a total embarrassment and it is why we can't have nice things. There is always this for a decent alternative: https://howsecureismypassword.net/

Password1234567890 It would take a desktop PC about A quadrillion years to crack your password [Tweet Result]

OK, but if you keep reading:

"Your password looks like it might just be a word and a few digits. This is a very common pattern and would be cracked very quickly."

Re: UK government's password checker sends plaintext password in the URL over HTTP

#108

Post by tombrossman »

hawkharris wrote: post #71
RussianCow wrote: post #62

Earlier quoted context omitted.

I completely agree, but too many websites put upper limits on the password length (which is completely idiotic) to be able to do this in practice.

I agree. It is frustrating when websites place arbitrary limits on characters in a passphrase. It's even more frustrating when they add specific rules (e.g. must use at least one number) that actually lower the number of possible combos in the string.

The worst annoyance for me is when they accept my 32+ character password - which I generate and paste from a password manager - and then they silently truncate it to a shorter length! No error, nothing. I remember hearing about some services that did this but the longer passwords still worked, which gave users a false sense of security.

What I run into more frequently is that I have to click the 'Forgot password' link and reset it. Then I cross my fingers and wait to see if they email it back in plain text (this is unforgivable) so I can count the characters and learn what the max length is that way.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#109

Post by gtirloni »

madaxe_again wrote: post #20
opendais wrote: post #4

Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/ It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and sho…

It IS "UK Government" - it's a QUANGO, so they can keep it at arms length and wash their hands of it, but be under no illusions, this is a government led initiative for which they ultimately, if not in practice, bear responsibility. The cynic in me says that this is a deliberate effort to grab as many passwords as possible. It sounds outlandish, but what actions of our rogue agencies haven't been?

That would be a waste of resources given the chances of a real criminal testing his/her password strength on a government-operated website are very remote. Even then, they would have to invest in marketing to get people to actually use it when, we all know now, the GHCQ/NSA can simply collect everything at critical infrastructure points.

This looks like a good idea, poorly executed.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#110

Post by KMag » 

  password123; DROP TABLE PASSWORDS --
My password score is 502 Error: Bad Gateway. What did everyone else score?

In all seriousness, among the http, the GET param, and the laughable entropy estimates, I wouldn't be surprised if they threw in an SQL injection vuln, a buffer overflow, and a couple of XSS vulns as Easter eggs.

Post reply on HN