Stop forcing arbitrary password rules • Hacker News Board

Re: Stop forcing arbitrary password rules

#171

Post by armabiz » Sat, Oct 24, 2015, 3:51 PM UTC

I would also add to this statement that this shouldn't be user's problem, but service problem. By forcing setting strange passwords services transfer their problem to secure passwords to user's shoulders.

Instead of following shitty password rules in forms, it's better to make it very hard or expensive to brute-force these passwords. So any heuristics to identify ubnormal/dangerous activity and take an action by decreasing attacker chances like rate limiting/captchas and so on.

  * If you see one IP trying to login with incorrect creds with really high rate - then it's probably attack.
  * If you see really lots of IPs trying to crack specific user account at the same time - then it's probably attack.

Instead of that I can see the opposite practice: service set draconian password politics, but just allow requests with incorrect credentials without any limits: "30req/sec? You're welcome, buddy! Need an API maybe?"

I can suspect something like this happened before:

"It looks like a lot of work with rate limiting and all the stuff, let's just force our users to set 10+ character passwords with one+ capital letter, one+ number, one+ special character". Oh, and in these examples there is usually cherry on cake like:

  - Dev1: "Let's not allow 2 same characters or 3 characters of same type"
  - Dev2: "Let's also force our users to change their passwords every 3 months"
  - CEO: "Brilliant ideas! We're secure now!"

These surprises are up to every developer's/another genius infosec imagination :)

So, my conclusion is that best security systems should be almost invisible to normal users and let attackers screaming.

Re: Stop forcing arbitrary password rules

#172

Post by pmoriarty » Sat, Oct 24, 2015, 4:00 PM UTC

nsmalch wrote: post #51

DanBC wrote: post #28

Earlier quoted context omitted.

I'm not sure I understand how an infinite monkey attack would work against diceware. Let's assume a word list of 7776 words. All words are lower case alpha. The attacker has pur wordlist. And the attacker knows there are seven words in the passphrase. That's still 7776^7. Even if we prune the wordlist ("I'm not using 'zerg' in my phrase", "I rolled 11111, that's not random so I'll roll again") it's still not an attac…

As a rule of thumb, I would go after natural language phrases first, because it is impossible to tell if the phrase was machine-generated. It's nearly impossible to arrange dots randomly on a page with a pencil because there is always some structure or engrained rigidity in human guesswork. There is also the possibility that the dots were done by 'inception', and certain biases were programmed in via subliminal messa…

Randomness is not a property of the procedure used to generate a given set of numbers, but is rather a potential property of a set of numbers itself.

Re: Stop forcing arbitrary password rules

#173

Post by armabiz » Sat, Oct 24, 2015, 4:24 PM UTC

ckaygusu wrote: post #125

One startup I was working for were enforcing different rules depending on where you were setting the password e.g. 4 characters when you follow the forgotten password procedure, 8 characters when registering, 12 characters when changing password normally. Another thing, a visa broker in Turkey had a so ridiculous password rule and gibberish error message, I had to read the source code and parse the regex by hand. Onl…

Your password has expired :)

Re: Stop forcing arbitrary password rules

#174

Post by mdpopescu » Sat, Oct 24, 2015, 4:30 PM UTC

nsmalch wrote: post #7

I see this a lot now, with the proliferation of libraries that allow for arbitrary passwords. Possibly some form of systemic trickling down of bad practices into software with horrible consequences "Your password must contain the seventh circle of hell, and a Taco Emoji"

I liked the message saying something like "your password must contain three characters from Game of Thrones" :)

Re: Stop forcing arbitrary password rules

#175

Post by mikeash » Sat, Oct 24, 2015, 4:35 PM UTC

Retric wrote: post #139

mikeash wrote: post #121

Earlier quoted context omitted.

There is a bank which shall remain nameless ( Schwab ) which not only silently truncates passwords to 8 characters, but also performs a case insensitive match. They say they're working on fixing it but it's taking an awfully long time.

As long as you throttle login attempts short passwords are fine. EX: 6 digit pin on a debit card might seem useless, but if you only get 3 tries per day that's just not an issue. ~10-20 failed attempts per day per IP + some rules to check for multiple IP's per account and 8 lowercase letters - most common passwords is actually reasonable.

I can buy that argument in general. But silently truncating is indefensible. What if I had a long password which started with my name or something, but which I believed to be secure because it had secret stuff at the end?

Re: Stop forcing arbitrary password rules

#176

Post by sfilipov » Sat, Oct 24, 2015, 4:47 PM UTC

0x49 wrote: post #168

proactivesvcs wrote: post #92

Earlier quoted context omitted.

You might be interesting in Plain Text Offenders' browser add-on. It warns when you're browsing a site that is known to store or send passwords in plain text: http://plaintextoffenders.com/

This site, while clever, is spreading potentially bad information. For instance, ive worked for plenty of companies that send out site-generated passwords. The password is stored encrypted and sent out once to the user. While not the most secure, an attacker still wont be able to get to all of the plaintext passwords if they cracked into the database.

If they can crack the database, what's preventing them from getting the key used to encrypt the database?

Re: Stop forcing arbitrary password rules

#177

Post by jstoiko » Sat, Oct 24, 2015, 4:55 PM UTC

Combination of words are the way to go. Often, when I tell people that, they seem to get stuck probably because that's not what they've been used to doing. I would be inclined to give some kind of hint to the user: "a good password, easy to remember: pick at least 4 random words and separate them by a character of your choice."

Re: Stop forcing arbitrary password rules

#178

Post by 0x49 » Sat, Oct 24, 2015, 5:21 PM UTC

sfilipov wrote: post #176

0x49 wrote: post #168

Earlier quoted context omitted.

This site, while clever, is spreading potentially bad information. For instance, ive worked for plenty of companies that send out site-generated passwords. The password is stored encrypted and sent out once to the user. While not the most secure, an attacker still wont be able to get to all of the plaintext passwords if they cracked into the database.

If they can crack the database, what's preventing them from getting the key used to encrypt the database?

When i say encryption, i mean 1-way encryption like bcrypt. So they could get the hashes, but would still have to somehow brute-force it.

Re: Stop forcing arbitrary password rules

#179

Post by gambiting » Sat, Oct 24, 2015, 5:54 PM UTC

Natanael_L wrote: post #169

gambiting wrote: post #146

Earlier quoted context omitted.

By people who knew to look for obscure african poems? I mean sure, you could guess a Polish sentence if you used a Polish dictionary, but how likely is that?

Very, because password crackers are literally including everything they can come over.

If they include "literally everything", then such humongous dictionary attack would literally take longer than a simple brute force one.

Re: Stop forcing arbitrary password rules

#180

Post by therein » Sat, Oct 24, 2015, 7:00 PM UTC

1ris wrote: post #29

Out of all, my bank forces to have my password to have exactly 5 chars. This is madness. Fortunately to actually do anything I need a second authentication factor.

My bank does the same, and they limit everyone to 8 characters. It is Schwab.