Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let them paste passwords

ncsc.gov.uk

Post reply on HN
Print view View original

111–120 of 376 posts

Re: Let them paste passwords

#111

Post by epistasis »

dragonwriter wrote: post #53

If you are pasting passwords, you are really using an ad hoc third-party SSO authentication provider (which may or may not also use the equivalent of 2FA) via a manual token-exhange mechanism. Better than allowing pasting passwords, just support OpenID or some similar federated authentication solution, which does the same thing without manual token exchange and the attendant opportunities for errors. You might want t…

>ad hoc third-party SSO authentication provider (which may or may not also use the equivalent of 2FA) via a manual token-exhange mechanism

This is a huge step up from a memorized password. Go ahead and implement OpenID too, but don't force people down to the level of memorized passwords needlessly. Expending effort to prevent pasting is a stupid move.

Re: Let them paste passwords

#112

Post by acdha »

diggernet wrote: post #52
Santosh83 wrote: post #36

Earlier quoted context omitted.

Passwords were already almost universal even before ANY encryption, during the early days of the WWW and before that too.

Encryption has been around longer than computers.

That's technically true but irrelevant: on the web, SSL came well after the initial wave of adoption and U.S. companies were restricted by law[1] from exporting strong encryption to people outside of the United States. It took awhile to get programs updated and for years it was common to see separate versions (or even third-party patch trees) on download pages.

All of that meant that someone launching a service couldn't assume that their users’ software supported encryption at all or securely for years. Coupled with the previously mentioned horrible user experience and cost of certificates, that really killed the idea since the password experience was both easier and far more familiar.

1. https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...

Re: Let them paste passwords

#113

Post by Crespyl »

jameshart wrote: post #84
joshvm wrote: post #78

Earlier quoted context omitted.

We had a gem at my last university (UCL): you must rotate your password every few months, your password can't be anything like any of the previous ones (i.e. previous ones are stored, and they're not hashed), your password must contain special characters etc. Except.. it can only be 8 characters long. Anything else gets truncated (they explicitly said so). The mind boggles. I have no idea where this limitation comes…

> your password can't be anything like any of the previous ones (i.e. they're not stored hashed) That's... not necessarily the case. You can implement that check by only storing hashes of previous passwords, or of patterns derived form them that are also forbidden (e.g. store a bcrypt of every previous password converted to all lowercase and with numbers and symbols removed).

Though I'm pretty sure I've seen "Your password is too similar to a previous password" before, which suggests some kind of plaintext Levenshtein distance check.

"Is the same as" can be fine with a hash, but "Is too similar" is definitely a red flag.

Re: Let them paste passwords

#114

Post by epistasis »

liveoneggs wrote: post #69

I see passwords pasted into chatrooms constantly and they are often of randomly-generated form. Password manages are also, apparently, not immune to their own security issues.

The nice thing about that is it's just one site's security token to change! Compromising that single password doesn't compromise all logins, just the one.

Whereas if you reuse a password on multiple sites, and one of those sites is compromised, all of the rest of your logins are compromised.

Re: Let them paste passwords

#115

Post by badosu »

reacweb wrote: post #68
thesuitonym wrote: post #58

Earlier quoted context omitted.

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

I agree with all your points except slideshows. Why so much hate against slideshows ?

I don't have a problem with slideshows, but a reason is that, in the UX perspective, elements that animate recurringly with previously hidden content (and possibly links) is confusing and not actually used, and then when you find something you want to check you have to use the slideshow pagination, which is cumbersome. Better to properly display the points of interest.

Re: Let them paste passwords

#116

Post by zeveb »

dfox wrote: post #41
sowbug wrote: post #17

Slightly off-topic: why didn't client-side certificates ever become a thing?

There are two main reasons: 1) In the beginning the whole X.509/PKCS PKI mechanism was seen as something that came out of X.500 and other telco stuff, is centralized, complex and expensive (all of these things are in fact true for the originally envisioned usage) and thus irrelevant for decentralized internet. (for example, the L for "Lightweight" in "LDAP" essentially means that it uses passwords instead of client s…

What's really sad to me is that SPKI (RFCs 2692 & 2693) addressed centralisation, complexity and cost, and was more-or-less completely ignored. If the browser and server vendors had just supported it, I really think that it could have had a chance.

It was even backwards-compatible with X.509!

Re: Let them paste passwords

#117

Post by acdha »

maxxxxx wrote: post #38

This whole discussion is a good example for everything that's​ wrong with computer security. Instead of coming up with solutions that make it easy for people to follow good practices the "experts" make it even more cumbersome. Most people just want to use the computer and not think about security.

You're cherry-picking pretty heavily: there's a lot of cargo-culted password advice but the current push for user-friendlier password management practices and fundamental model changes (e.g. two-factor with U2F) has been lead by security experts who have, for many years, been loudly reminding everyone that usability is a security requirement rather than an inherent conflict.

Re: Let them paste passwords

#118

Post by joshvm »

jameshart wrote: post #84
joshvm wrote: post #78

Earlier quoted context omitted.

We had a gem at my last university (UCL): you must rotate your password every few months, your password can't be anything like any of the previous ones (i.e. previous ones are stored, and they're not hashed), your password must contain special characters etc. Except.. it can only be 8 characters long. Anything else gets truncated (they explicitly said so). The mind boggles. I have no idea where this limitation comes…

> your password can't be anything like any of the previous ones (i.e. they're not stored hashed) That's... not necessarily the case. You can implement that check by only storing hashes of previous passwords, or of patterns derived form them that are also forbidden (e.g. store a bcrypt of every previous password converted to all lowercase and with numbers and symbols removed).

Yeah, they probably stored old hashes, but I find it hard to believe they stored variations of old ones as well. Maybe they did though!

Re: Let them paste passwords

#119

Post by jermaustin1 »

jmkni wrote: post #83
artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

I use a password manager to generate long, complex passwords for every service I use (as complex as the service will allow). For sites that disable pasting, I have developed quite a skill at copying the password character by character from my PM into the password field. I'm even starting to remember a couple of them. Incredibly frustrating.

If you can remember it that means you need to change it! I refuse to look at any of my generated passwords. For the services that wont let me paste in, I have a macro that will type whats on my clipboard. Just a simple auto IT script with a WAIT (so I can make sure I focus on the input box) and SEND.

My password manager also clears the clipboard if it is equal to the last password copied after a wile (I've never timed it).

Re: Let them paste passwords

#120

Post by aianus »

blakesterz wrote: post #86
mrob wrote: post #29

Earlier quoted context omitted.

>if you can remember your password, its probably too weak As XKCD famously pointed out[0], Diceware[1]-style pass phrases can be both secure and memorable. XKCD's four word example isn't secure when fast brute-force attacks are feasible, but eight words is still easily memorable and secure enough for anything. The important point here is that "random words" really does mean "random", i.e. not picked by a human. [0] h…

I thought password cracking machines now guess words as well as characters? Like they will guess all 8 character passwords and will also guess all 6 word passwords using common words like they guess characters? Therefore using just a few common words stuck together with nothing else is no longer secure? (This is a genuine question because I could be totally wrong on that, I can't even remember where I heard it)

The xkcd comic has all the math right there in it. They are already assuming word by word guesses not character by character guesses.
Post reply on HN