Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let them paste passwords

ncsc.gov.uk

Post reply on HN
Print view View original

141–150 of 376 posts

Re: Let them paste passwords

#141

Post by qb45 »

joshvm wrote: post #78
thesuitonym wrote: post #58

Earlier quoted context omitted.

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

We had a gem at my last university (UCL): you must rotate your password every few months, your password can't be anything like any of the previous ones (i.e. previous ones are stored, and they're not hashed), your password must contain special characters etc. Except.. it can only be 8 characters long. Anything else gets truncated (they explicitly said so). The mind boggles. I have no idea where this limitation comes…

I once had similar problem in some ancient LDAP installation and it turned out that adding random 9th character was enough to pass the check while keeping the password effectively the same :)

Re: Let them paste passwords

#142

Post by maxxxxx »

acdha wrote: post #117
maxxxxx wrote: post #38

This whole discussion is a good example for everything that's​ wrong with computer security. Instead of coming up with solutions that make it easy for people to follow good practices the "experts" make it even more cumbersome. Most people just want to use the computer and not think about security.

You're cherry-picking pretty heavily: there's a lot of cargo-culted password advice but the current push for user-friendlier password management practices and fundamental model changes (e.g. two-factor with U2F) has been lead by security experts who have, for many years, been loudly reminding everyone that usability is a security requirement rather than an inherent conflict.

You are probably right about cherry picking. I know a lot of experts are aware of the problems but from an end user perspective security usability is still horrible and inconsistent.

Re: Let them paste passwords

#143

Post by jeffhuys »

jomkr wrote: post #121

There is a subtle valid use-case. On "change your password" screens, you don't want the second "confirm password" field to be pastle-able to stop this scenario. 1) User tries to type "mypassword" but enters "mypasswor" instead. 2) User copy-pastes "mypasswor" into "confirm password field" 3) User hits "submit". Now when the user tries to login with "mypassword" it fails.

I thought it's not possible to COPY from a password field?

Re: Let them paste passwords

#144

Post by SamBam »

makmanalp wrote: post #101
jameshart wrote: post #84

Earlier quoted context omitted.

> your password can't be anything like any of the previous ones (i.e. they're not stored hashed) That's... not necessarily the case. You can implement that check by only storing hashes of previous passwords, or of patterns derived form them that are also forbidden (e.g. store a bcrypt of every previous password converted to all lowercase and with numbers and symbols removed).

Doesn't that decrease the benefit of storing a hash? You probably know the process through which the derivative hashes are generated, which is not known-plaintext but seems kinda iffy still.

I think it would decrease the benefit, yes.

If you store the hash of the password, plus the hash of a hundred "similar" passwords, then the hacker only has to brute-force one to find that they are on the right track, and then brute-force "similar" combinations.

Re: Let them paste passwords

#145

Post by SAI_Peregrinus »

jmkni wrote: post #83
artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

I use a password manager to generate long, complex passwords for every service I use (as complex as the service will allow). For sites that disable pasting, I have developed quite a skill at copying the password character by character from my PM into the password field. I'm even starting to remember a couple of them. Incredibly frustrating.

Use KeePass's auto-type feature. I'm not familiar with other password managers, but for KeePass it emulates a keyboard, and works on sites that disable pasting.

Re: Let them paste passwords

#146

Post by SamBam »

jermaustin1 wrote: post #119
jmkni wrote: post #83

Earlier quoted context omitted.

I use a password manager to generate long, complex passwords for every service I use (as complex as the service will allow). For sites that disable pasting, I have developed quite a skill at copying the password character by character from my PM into the password field. I'm even starting to remember a couple of them. Incredibly frustrating.

If you can remember it that means you need to change it! I refuse to look at any of my generated passwords. For the services that wont let me paste in, I have a macro that will type whats on my clipboard. Just a simple auto IT script with a WAIT (so I can make sure I focus on the input box) and SEND. My password manager also clears the clipboard if it is equal to the last password copied after a wile (I've never time…

> If you can remember it that means you need to change it! I refuse to look at any of my generated passwords.

I'm trying to understand the reasoning for this. Are you dealing with very sensitive information that you have a real reason to fear the rubber-hose cryptanalysis method?

Re: Let them paste passwords

#147

Post by MikeTV »

SamBam wrote: post #144
makmanalp wrote: post #101

Earlier quoted context omitted.

Doesn't that decrease the benefit of storing a hash? You probably know the process through which the derivative hashes are generated, which is not known-plaintext but seems kinda iffy still.

I think it would decrease the benefit, yes. If you store the hash of the password, plus the hash of a hundred "similar" passwords, then the hacker only has to brute-force one to find that they are on the right track, and then brute-force "similar" combinations.

Unless you do it the other way around: Generate a list of all passwords similar to the one the user just entered and see if that matches any previous hashes. This is how Facebook's password check works [0]

[0] https://security.stackexchange.com/a/53483

Re: Let them paste passwords

#149

Post by mark-r »

stanmancan wrote: post #94
criddell wrote: post #76

Earlier quoted context omitted.

How about case insensitive passwords? That one always bugs me because it suggests that maybe they are storing the password.

Not true, they most likely convert all characters to a certain case before they hash it, so even if you entered PASSworD123 they convert to password123 and then hash. I believe I read that Facebook stores a few commonly mistyped versions of everyone's password. Actual password, typed as if caps lock was on, things like that.

Sure, it's possible to do it that way. But if I were taking bets, I know where I'd put my money.

Re: Let them paste passwords

#150

Post by [deleted] »

jmkni wrote: post #83
artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

I use a password manager to generate long, complex passwords for every service I use (as complex as the service will allow). For sites that disable pasting, I have developed quite a skill at copying the password character by character from my PM into the password field. I'm even starting to remember a couple of them. Incredibly frustrating.

[deleted]
Post reply on HN