Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Limiting passwords to 12 characters is "secure enough"

forums.stardock.com

Post reply on HN
Print view View original

101–110 of 111 posts

Re: Limiting passwords to 12 characters is "secure enough"

#101

Post by KMag »

TheNewAndy wrote: post #52
eksith wrote: post #40

Earlier quoted context omitted.

I'm not too fond of printing out passwords. If I forget, and I'm extremely forgetful, that's just a disaster waiting to happen. I know my brain and I know it can't be trusted with physical security. Also, I'd rather use /dev/urandom instead of simply /dev/random. Considering my aversion to using a stranger's computer to login to my accounts and the fact that I never use an open WiFi connection for anything without To…

Not really the issue, but /dev/urandom is weaker than /dev/random, it is urandom which never blocks (try "hd /dev/random" and note that it blocks, then jiggle your mouse a bit and it will come back to life)

This is true on some systems, but not others. On FreeBSD (and OSX, as I remember) /dev/random and /dev/urandom act identically. The underlying CSPRNG, Yarrow, is designed to recover from a compromised state vector. Unfortunately, Yarrow relies on entropy estimates to time its re-seeding.

I've said it before: entropy estimates are a fiction. Ideally, /dev/random and /dev/urandom would both offer non-blocking access to an underlying Fortuna implementation (using a cryptographic hash function instead of a cipher, to avoid export/import restrictions).

Re: Limiting passwords to 12 characters is "secure enough"

#102

Post by KMag »

eksith wrote: post #16

Get a whole heap of passwords from random.org. Create a text file with the sites you use with the usernames/passwords. PGP Encrypt the whole ensamble with a good strong password. The only one you really need to remember. Forget your password? Once you reset via email, as soon as you get access to that encrypted file, get a new random password and reset it again. Save the new password in the encrypted file. Password m…

I've been using a 50-ish line Python script for a bit more than a decade. It generates a password from /dev/urandom on Linux/OSX and the system crypto random source on Windows. It pipes the output to gpg, so the password doesn't go through the clipboard and isn't visible in ps output.

Here's the version I updated to Python 3 a year or three ago: http://pastebin.com/RusCWm5Q

Usage: create_pass []

Example: create_pass kmag kmag@example.com news.ycombinator.com

    gpg -d ~/Crypto/Passwords/news.ycombinator.com.gpg
Edit: part of me hopes that someone is still grinding away at my 80-bit stolen Linkedin password hash. I of course generated a new 80-bit password.

Re: Limiting passwords to 12 characters is "secure enough"

#104

Post by yarianluis »

Jayschwa wrote: post #35
yarianluis wrote: post #13

This is far from the worst offender. Banks are typically the worst. All sorts of gimmicky password requirements. 8-12 characters. Must have one capital letter. Must have one number. No special symbols. So "I can't believe it's not butter!" won't work, yet that would probably be a pretty secure password, and be entirely rememberable. In fact I could come up with a silly pun-filled sentence for each site I visit and ma…

The poor state of bank passwords is fresh in my head from working on taxes tonight. It's kinda sad that the message boards I use for non-sense are probably more secure than my banks with respect to password handling. That said, I don't think Stardock gets a free pass just because a lot of banks suck at it.

Nobody gets a free pass. Didn't mean to imply that. They all suck, it's just a matter of venting :)

Re: Limiting passwords to 12 characters is "secure enough"

#106

Post by newman314 »

KMag wrote: post #100
newman314 wrote: post #84

Earlier quoted context omitted.

I think you mean LastPass or 1Password. Startup idea: the email equivalent of 1Password. You give each site a completely unique, distinct yet valid email address. They forward to your real email address and vice versa. This way if one email is compromised you know where the spam is coming from plus it reduces email tracking and correlation.

At least the last time I used it, Google Checkout had an opt-in feature that would create a unique unguessable email address the first time you purchased something from a shop, and this email address would be proxied to your GMail account.

While that is nice, I was thinking of a more distributed model (not necessarily hosted by Google)

Re: Limiting passwords to 12 characters is "secure enough"

#108

Post by dlitz »

izend wrote: post #14
jimrandomh wrote: post #5

As I see it, character limits aren't so much about security, as just a dumb way to be hostile to the user. All of my passwords are site-specific unique passwords generated by a password manager. I don't care if you store plain-text passwords, because if someone steals passwords out of your database then they already have all the access that my password to your site would've given. But if a site rejects the password t…

Isn't there research out there that proves long sentences and phrases are better than any random alpha numeric password

If you read 128 bits of data from /dev/urandom, and then map the result to a space of 2128 possible passwords, then it doesn't actually matter what the possible passwords are, as long as it's a one-to-one mapping.

Re: Limiting passwords to 12 characters is "secure enough"

#110

Post by pjbrunet »

oxide wrote: post #69
pjbrunet wrote: post #56

If your password is 100,000,000 characters long, that's simply a waste of bandwidth, CPU time, space on the disk * millions of users * 1000s of iterations = money flushed down the toilet. And remember web servers have timeout parameters spread across half a dozen config files. You're just asking for trouble. Not worth it. To protect one self-important nitwit's video game password? Even your million character password…

that isn't the point. the point is if there is a limit on character length, its a clear indication that the passwords aren't being properly handled.

Let's see you implement it then smartypants. So you can learn the hard way why there is a limit. You think you're smarter than the biggest technology companies on the planet? It's a clear indication of nothing but your own little vendetta driving you crazy.
Post reply on HN