No password rules...please. • Hacker News Board

Re: No password rules...please.

#11

Post by rdl » Mon, Jun 04, 2012, 2:47 PM UTC

This guy has no idea what a dictionary attack is, or entropy in various forms of password or pass phrase. Probably not a great source of security policy advice.

A pass phrase with 4 words chosen from a large alphabet, assuming the words are randomly selected, gets a lot of entropy really fast compared to similarly memorable numeric PIN (6-8 digits, tops). "leetspeak" passwords derived using common rules from rules aren't a lot better than just words themselves, and are hard to remember (I've had to brute force a bunch of variations on my own or for other people when keyboard layouts changed, or when exact punctuation was not remembered).

20000 words in vocabulary, take 4, is 1.6e17 combinations. Dictionary attack that?

Re: No password rules...please.

#12

Post by batista » Mon, Jun 04, 2012, 3:59 PM UTC

Peaker wrote: post #7

jrs235 wrote: post #6

Displaying password rules inform a hacker what rules to obey and follow, reducing the number of combinations they have to try. Rather than have rules, after a user creates/enters their password just let them know if it sucks or not, perhaps give some "stats" as to how long it would probably take to crack. Scare them into something stronger, but don't force them into "post-it noting their password".

For home use, I'm not sure what's wrong with a post-it... (Not talking about a bank password here).

Yes, so next time your cleaning lady can use it. Or your babysitter --or her boyfriend. Or any random burglar...

Re: No password rules...please.

#13

Post by gte910h » Mon, Jun 04, 2012, 5:31 PM UTC

rdl wrote: post #10

jasonkester wrote: post #4

Complex password requirements lead to post-its on monitors in cubicles with passwords written on them. That's a much worse result than a weak password for pretty much any system that relies on passwords to stop bad things from happening. For regular websites, generating monitor post-its is inexcusable. Let your users choose the letter "a" as their password if they want, but warn them about the implications. The only…

This is horrible advice given the threat model for either normal home users (at risk due to mass attacks/brute force, or MAYBE losing a wallet/unlocked phone/laptop with keys saved locally) or most corporate environments. The solution in both cases is a move toward single sign on, using a password manager or a key or 2fa or federated login system (Kerberos, FB connect). Enforcing minimum complexity requirements (and…

Then measure actual entropy. Don't make me make a password that fits some weird ass hard to remember standard you dug up. Let me use "This rabbit killed the horse in cold blood, then drank all the pies" as a password if I want, it has more entropy than C@tV0m!t does.

Re: No password rules...please.

#14

Post by rdl » Mon, Jun 04, 2012, 6:15 PM UTC

gte910h wrote: post #13

rdl wrote: post #10

Earlier quoted context omitted.

This is horrible advice given the threat model for either normal home users (at risk due to mass attacks/brute force, or MAYBE losing a wallet/unlocked phone/laptop with keys saved locally) or most corporate environments. The solution in both cases is a move toward single sign on, using a password manager or a key or 2fa or federated login system (Kerberos, FB connect). Enforcing minimum complexity requirements (and…

Then measure actual entropy. Don't make me make a password that fits some weird ass hard to remember standard you dug up. Let me use "This rabbit killed the horse in cold blood, then drank all the pies" as a password if I want, it has more entropy than C@tV0m!t does.

The problem is it's hard to measure actual entropy. You can make a reasonable approximation (vs. a dictionary, and looking at the total character set) -- then, if you can, display the strength in some graphical way (ideally with a list of suggested rules which get checkmarked as the passphrase satisfies them). Still. "one TWO 3 +our" has less entropy than this would suggest.

I generally set an absolute minimum of 6-8 characters, not equal to username, site name, or a set of common passwords (including "password"). Sometimes require one (or two or three) of uppercase, number, or symbol for short passwords (i.e. stop requiring it if it is longer than 12 characters).

However, when a standard (or company policy) requires something like DIACAP, I'll enforce it in the pw creator. The absolute worst thing is when policy changes, and an allowed password becomes disallowed -- if it just expires and needs to be changed, that's one thing, but I've had sites where my long, special-case-laden passphrase worked in some login routines but didn't work in things like the password update routine (!!!).

For anything internal, I consider passwords basically unacceptable as an authentication mechanism alone; there must be PK or some kind of two factor auth.

Re: No password rules...please.

#15

Post by Peaker » Mon, Jun 04, 2012, 7:02 PM UTC

batista wrote: post #12

Peaker wrote: post #7

Earlier quoted context omitted.

For home use, I'm not sure what's wrong with a post-it... (Not talking about a bank password here).

Yes, so next time your cleaning lady can use it. Or your babysitter --or her boyfriend. Or any random burglar...

And make Hacker News comments on my name? :-)