Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Myths of Password Security

stormpath.com

Post reply on HN
Print view View original

11–20 of 52 posts

Re: Myths of Password Security

#11

Post by jere »

corresation wrote: post #9
jere wrote: post #7

Earlier quoted context omitted.

>Having said that, does any cracker even try for something like jjjjjjjjjjjjjjjjjjjjjjjjjjj? If I were trying to brute force password, I would think that such a password would be relatively safe simply because it's such an irregular pattern. Here's my response to that: https://news.ycombinator.com/item?id=5546741 tldr: I could try all repeating characters so fricking fast it would be worth it to build into a cracker.

tldr: I could try all repeating characters so fricking fast it would be worth it to build into a cracker. In the context of this discussion, of course we'll all say that. Does any actual cracker program try for that, though? Not to my knowledge.

Sorry for the back of forth here, but I'll try to make this the last comment:

Some people are using all repeating characters if they can get away with it. ESPECIALLY because articles like this keep hinting that they are decent.

It doesn't matter how small this percentage of people is. The time it takes to check against it is infinitesimal and the reward is nonzero. If I were building a cracker, I would do it and not just because it's the topic of discussion.

Re: Myths of Password Security

#12

Post by DanBC »

corresation wrote: post #4
pandog wrote: post #3

I like how Myth 1 tells us long passwords are better than complex passwords then Myth 3 complains that Microsoft rate the long but non-complex password "jjjjjjjjjjjjjjjjjjjjjjjjjjj" highly

They aren't contradictory. While this is, as someone else stated, a "fluff piece", neither b4#L or aaaaaaaaaaaaaaaaaaaaaaaaaaa are necessarily secure passwords. It's a gradient. Having said that, does any cracker even try for something like jjjjjjjjjjjjjjjjjjjjjjjjjjj? If I were trying to brute force password, I would think that such a password would be relatively safe simply because it's such an irregular pattern.

> If I were trying to brute force password

People tend not to bruteforce passwords. People tend to use dictionary attacks. I don't know if any current wordlists include 'jjjjjjjjjjjjjjjjjjjjjjjjjjj', but it'd be easy enough to create a wordlist that is just repeated characters.

Re: Myths of Password Security

#13

Post by geal »

Saying that using random words is better than using a string of unrelated characters assumes that password crackers don't know how to combine words.

There are about 180000 words in English (but don't assume everybody knows 180000 words). That means that for three words, you have at most 5.810^15 options.

For a password with mixed case and numbers, you have 62 different characters. With, 9 characters, you have 1.310^16 options.

I can understand that people would prefer common words to remember them, but they are not that much stronger.

The best password is the password I don't need to remember: generate long random passwords, and store them in your browser, in Keepass, LastPass or whatever system of your choice.

Re: Myths of Password Security

#15

Post by eterm »

jere wrote: post #5

>Simply put, adding length increases entropy more efficiently than replacing letters with symbols. I don't like this meme. Because it's not necessarily "more efficient." Like most things, it depends. If I have a password made of 10 lowercase characters, it's much better to replace with an upper case character rather than add another lower case one. Option 1) Add a lower case character. Password is 26 times stronger.…

But don't do what someone I know did and replace every single e with 3, every single a with 4, every single o with 0.

Identical entropy, extra theatre.

Re: Myths of Password Security

#16

Post by [deleted] »

eterm wrote: post #15
jere wrote: post #5

>Simply put, adding length increases entropy more efficiently than replacing letters with symbols. I don't like this meme. Because it's not necessarily "more efficient." Like most things, it depends. If I have a password made of 10 lowercase characters, it's much better to replace with an upper case character rather than add another lower case one. Option 1) Add a lower case character. Password is 26 times stronger.…

But don't do what someone I know did and replace every single e with 3, every single a with 4, every single o with 0. Identical entropy, extra theatre.

[deleted]

Re: Myths of Password Security

#17

Post by pornel »

A myth I'd like to dispel is that when login fails not telling whether username or password was wrong improves anything.

Please do tell clearly when username was wrong. It won't disclose anything new, because you're already disclosing this information by validating registration form (and reg form will even disclose existence of registered e-mails by forbidding duplicate registration), existence of profile URLs, all kind of "add a friend" APIs, etc.

If you're really concerned about somebody compiling list of usernames by brute force (and you've patched all other places where you disclose it) then put rate limiting on the login form (you should have it anyway to prevent brute forcing of passwords).

Re: Myths of Password Security

#18

Post by corresation »

jere wrote: post #11
corresation wrote: post #9

Earlier quoted context omitted.

tldr: I could try all repeating characters so fricking fast it would be worth it to build into a cracker. In the context of this discussion, of course we'll all say that. Does any actual cracker program try for that, though? Not to my knowledge.

Sorry for the back of forth here, but I'll try to make this the last comment: Some people are using all repeating characters if they can get away with it. ESPECIALLY because articles like this keep hinting that they are decent. It doesn't matter how small this percentage of people is. The time it takes to check against it is infinitesimal and the reward is nonzero. If I were building a cracker, I would do it and not…

Clearly I'm not making the argument that jjjjjjjjjjjjjjjjjjjjjjjjjjj is a recommended password. Of course it isn't.

Use a long, complex password. Period.

However practically we know the history of password crackers, and while it's easy to look at specific examples given and say "Oh I would totally crack for that", in most general cases they wouldn't be cracked. On the flip side, passwords that are dictionary words following by numbers and or punctuation are cracked because they are exactly what people migrated to once complexity rules were implemented.

Re: Myths of Password Security

#19

Post by kyrra »

With the recent flaw (though very small flaw) in 1Password, I decided to do a little research into the tools that password crackers use today. The first big tool is the cracker itself. John The Ripper and HashCat are 2 popular ones today, but I've focused my reading on hashcat.

Hashcat is a tool who's goal is to do various hashing functions as fast as possible in both CPU and GPU (depending on what the user has available). Where the tool gets interesting is the attack modes[1] it has. Each of the attack methods has different use cases, but I would say Rule-based and table-lookup are both fairly interesting (allow for smart generating of test passwords so things it's not a full character set brute-force).

Now, you have other groups that are going out and doing analysis on database password leaks[2]. This site tries to crack as many passwords as it can from publically leaked password databases (such as Gawker ane EHarmony), then do an analysis of the passwords they have cracked thus far. People can then use this data to write rules for Hashcat or other tools to possibly crack passwords a lot faster.

As rules for passwords change and people change their password habits, the crackers will adjust their methods. While this article does bring out some interesting points about passwords, it can still be good to know what tools the crackers have at their disposal so you can think about how to craft a password that won't be easily cracked.

[1] http://hashcat.net/wiki/#attack_modes

[2] http://www.adeptus-mechanicus.com/codex/hashpass/hashpass.ph...

Re: Myths of Password Security

#20

Post by darkchasma »

pornel wrote: post #17

A myth I'd like to dispel is that when login fails not telling whether username or password was wrong improves anything. Please do tell clearly when username was wrong. It won't disclose anything new, because you're already disclosing this information by validating registration form (and reg form will even disclose existence of registered e-mails by forbidding duplicate registration), existence of profile URLs, all k…

This comes from the days when you would have to call the IT desk, and have them reset your password.
Post reply on HN