Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When it comes to composition and length, passwords mostly don't matter

techcommunity.microsoft.com

Post reply on HN
Print view View original

121–130 of 160 posts

Re: When it comes to composition and length, passwords mostly don't matter

#121

Post by gnopgnip »

Someone1234 wrote: post #17

The number one reason I don't turn on MFA has nothing to do with the effort in entering the MFA code/pressing a confirm button. The lifecycle of MFA is the problem. The backup/recovery options are just terrible. You either print out a sheet of "one time codes" (which I need to not lose forever), my phone simply needs to never break, or I need to configure an insecure recovery account (creating a whole chicken/egg pro…

>The backup/recovery options are just terrible

This is not the case if you are using a corporate controlled account

Re: When it comes to composition and length, passwords mostly don't matter

#122

Post by 188201 »

dillutedfixer wrote: post #20

In my opinion, Microsoft's implementation of MFA on Office 365 (at least our instance) is broken. SMS MFA is inadequate and should not be used, the SS7 network is apparently trivially hackable in some circles and text messages can be rerouted. So they want us to use MS Authenticator, great. However the 365 login screen always has the "Sign in another way" option in which I can just bypass the Authenticator app and us…

I don't think SMS is real 2FA, because many site can reset password by SMS, meaning having the phone number = controlling the account = 1FA. So, it is not better but worse to have SMS "2FA" since it depends on competence of mobile provider, which may be absurdly weak at preventing social engineering.

Re: When it comes to composition and length, passwords mostly don't matter

#123

Post by Thorrez »

The article seems to contradict itself. The table says password strength doesn't matter for brute force unless you're using an unusable password. But then in the conclusion it recommends you use a 9+ character password because that protects you from brute force.

Re: When it comes to composition and length, passwords mostly don't matter

#124

Post by mikekchar »

H8crilA wrote: post #120
mikekchar wrote: post #53

Earlier quoted context omitted.

That would be a shocking statement to make. However, I don't see anything like that in the original article. Did I miss it somewhere?

Yes for example in password spray - attackers often try just < 20 passwords. If your account is high value they could try a lot more.

But the original article literally never says that. It doesn't talk about the "value" of different kinds of accounts at all (and I just reread the "Spray" section to make sure I didn't miss it).

It would be incredibly naive to think that one account has significantly more value than another because once you are in the system, your ability to compromise it skyrockets -- no matter what kind of account you have. Sure, you're probably trying to work your way up to administrative account level, but there are so many more local attacks than remote attacks that it isn't even funny.

I'm not sure there is an accusation that the article is being naive in this way or not (there seems to be some confusion). It would be really shocking to see a blog post from Microsoft talking about security that would say something so naive. But as far as I can tell, they didn't.

Re: When it comes to composition and length, passwords mostly don't matter

#125

Post by Falkon1313 »

danShumway wrote: post #7

> Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA. An important thing to remember here is that MFA works with a password. Otherwise, that 99% goes down dramatically because I can just steal your phone/Yubikey/whatever. This article isn't suggesting that we get rid of passwords. It's suggesting that the energy we spend making sure that passwords are good would be bett…

'Better' if you consider dramatically increasing the chances of getting locked out of your own account to be 'better'.

If you're logging in from your phone anyway, then it's not really a second factor, so it's meaningless.

If you're not, then your phone might be unavailable or charging or something, so you're locked out.

And if someone else gets hold of your phone, they can now easily log in, so it increases the attack area.

MFA is a bad idea. Biometrics are a bad idea (for similar reasons). Unique passwords (handled with a password manager) are still by far the best solution that we have. Adding epicycles is not the answer. Improving the UX and handling of passwords is the way forward.

Re: When it comes to composition and length, passwords mostly don't matter

#126

Post by Falkon1313 »

TimTheTinker wrote: post #6

Note this is from the perspective of a security decision maker, like an IT administrator. Policy-wise, users can't be forced or trusted to create excellent passwords on their own. But as an individual, your passwords do matter. It makes a world of a difference to use a password manager and long, completely random passwords - such passwords are immune to all sorts of cracking attempts, and using them can often make MF…

>using MFA always reduces your personal attack surface

Actually it increases it. In theory it makes attacks more difficult even with the increased attack surface, but in practice, it may make it easier.

Some places let you reset a password if you have the MFA. And if the MFA was on a phone, which also has your email, which is how you'd normally reset your password, then of course it's equally vulnerable.

Re: When it comes to composition and length, passwords mostly don't matter

#128

Post by willvarfar »

Thorrez wrote: post #123

The article seems to contradict itself. The table says password strength doesn't matter for brute force unless you're using an unusable password. But then in the conclusion it recommends you use a 9+ character password because that protects you from brute force.

yeah. What the table needs is a column of how to mitigate each risk. Besides MFA, there's also all the things that the very first para says aren't important, e.g. avoiding password reuse (HIBP is now a Microsoft thing)

Re: When it comes to composition and length, passwords mostly don't matter

#129

Post by TimTheTinker »

Falkon1313 wrote: post #126
TimTheTinker wrote: post #6

Note this is from the perspective of a security decision maker, like an IT administrator. Policy-wise, users can't be forced or trusted to create excellent passwords on their own. But as an individual, your passwords do matter. It makes a world of a difference to use a password manager and long, completely random passwords - such passwords are immune to all sorts of cracking attempts, and using them can often make MF…

>using MFA always reduces your personal attack surface Actually it increases it. In theory it makes attacks more difficult even with the increased attack surface, but in practice, it may make it easier. Some places let you reset a password if you have the MFA. And if the MFA was on a phone, which also has your email, which is how you'd normally reset your password, then of course it's equally vulnerable.

> Some places let you reset a password if you have the MFA.

I wasn’t aware of that - that’s horrifying but not surprising. Well, in that case, disable/remove MFA!

On that note, if an account requires “security questions”, consider using 1Password’s password generator, but set to 4 random words separated by spaces. That can help reduce the increased attack surface from fraudulent account recovery - use words to avoid someone saying “oh it’s just a bunch of gibberish” over the phone.

Re: When it comes to composition and length, passwords mostly don't matter

#130

Post by mnm1 »

This kind of shit coming from Microsoft is fucking rich. Then why do I have to change my password constantly on outlook and get routed to at least two different types of password change servers, one with rules stupider than another? Especially when I'm trying to use a password manager with a strong, long, random password and they are preventing me from doing so with their shitty UX and their limitation on characters? They should take their own fucking advice because you know what else reduces security? The stupid bullshit I described above. Now I just use a base password (that's probably been compromised) and increase the last digit by one each time. Insecure? You betcha. But it's for work and it was work's decision to use outlook so not my problem. Microsoft should either shut the fuck up about this shit or fix their own fucking systems. Of course it doesn't matter what password you use in such a shit system (outside of a password manager generated one). And they have intentionally created a situation that makes the passwords even less secure.
Post reply on HN