Let them paste passwords • Hacker News Board

Re: Let them paste passwords

#181

Post by nippoo » Thu, May 18, 2017, 3:54 PM UTC

joshvm wrote: post #78

thesuitonym wrote: post #58

Earlier quoted context omitted.

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

We had a gem at my last university (UCL): you must rotate your password every few months, your password can't be anything like any of the previous ones (i.e. previous ones are stored, and they're not hashed), your password must contain special characters etc. Except.. it can only be 8 characters long. Anything else gets truncated (they explicitly said so). The mind boggles. I have no idea where this limitation comes…

The most odd bit about that UCL password policy is that it said "your password change has been submitted and may take up to 24 hours to take effect." To this day I'm not sure if they were just displayed in cleartext and someone just typed them in by hand

Re: Let them paste passwords

#182

Post by jcoffland » Thu, May 18, 2017, 3:55 PM UTC

The Wells Fargo CEO portal makes me change my password every 90 days, won't let me paste and accepts some special characters but not others. How is it that a bank can get it so wrong?

Re: Let them paste passwords

#183

Post by SamBam » Thu, May 18, 2017, 3:55 PM UTC

mark-r wrote: post #177

SamBam wrote: post #146

Earlier quoted context omitted.

> If you can remember it that means you need to change it! I refuse to look at any of my generated passwords. I'm trying to understand the reasoning for this. Are you dealing with very sensitive information that you have a real reason to fear the rubber-hose cryptanalysis method?

For those not familiar with the rubber-hose method: https://xkcd.com/538/

Personally, I always thought the phrase ought to be "brutish-force cracking," like "brute force", but that's just me...

Re: Let them paste passwords

#184

Post by dkonofalski » Thu, May 18, 2017, 3:57 PM UTC

jschwartzi wrote: post #56

mrob wrote: post #29

Earlier quoted context omitted.

>if you can remember your password, its probably too weak As XKCD famously pointed out[0], Diceware[1]-style pass phrases can be both secure and memorable. XKCD's four word example isn't secure when fast brute-force attacks are feasible, but eight words is still easily memorable and secure enough for anything. The important point here is that "random words" really does mean "random", i.e. not picked by a human. [0] h…

Some of my best passwords were phrases copied from discarded cartons on my desk. For example, I could choose a password, > Distributed_By: WalgreenCo. 200 Wilmont Rd. And it would both be very strong, and be difficult for someone at my desk to guess by looking at things on my desk.

And how do you remember which item on your desk is for which site/password?

Re: Let them paste passwords

#185

Post by moosingin3space » Thu, May 18, 2017, 3:59 PM UTC

syncsynchalt wrote: post #153

SamBam wrote: post #146

Earlier quoted context omitted.

> If you can remember it that means you need to change it! I refuse to look at any of my generated passwords. I'm trying to understand the reasoning for this. Are you dealing with very sensitive information that you have a real reason to fear the rubber-hose cryptanalysis method?

More because you'll develop a resistance to changing the password, since you'll have to start over on memorizing the new one.

This is a good point, and part of the problem with the way the average computer user (and far too many above-average users) treat their passwords.

Re: Let them paste passwords

#186

Post by jermaustin1 » Thu, May 18, 2017, 4:00 PM UTC

SamBam wrote: post #178

jermaustin1 wrote: post #167

Earlier quoted context omitted.

As a consultant, I have been given access to a lot of passwords for clients. From corporate bank accounts to production servers at government agencies. So they are very sensitive, and when my contract is up, I delete the password folder for that client. I started doing that with clients, then eventually ended up continuing it to my personal passwords as well.

You talked about not even looking at generated passwords, which is different from client's passwords. That's the part I didn't understand. Although, honestly, the other part seems more bizarre. Gov't agencies and other clients are just giving you their sensitive passwords, and trusting you to delete them after the project, at your leisure? How is that not terrible security? Revoking a consultant's security needs to b…

I'm pretty sure the passwords I'm given are generated. I wouldn't really know as they shared the passwords in a file with me that I never looked at them. I'm sure they cleaned up accounts on their end, but I would rather do some due diligence on my end as well. I don't know their processes and procedures.

But why even know your own passwords, what is the point? If I can double click from my manager and paste it into my password field and never have to worry about knowing anything, I'm much happier and safer.

Re: Let them paste passwords

#187

Post by nathancahill » Thu, May 18, 2017, 4:02 PM UTC

If you use Quicksilver on Mac, you can virtually type the text to get around the paste limitation. [text input] -> [Type Text]

Re: Let them paste passwords

#188

Post by hfsktr » Thu, May 18, 2017, 4:03 PM UTC

nradov wrote: post #163

marksomnian wrote: post #110

Earlier quoted context omitted.

.+@.+\..+

That regex is defective. See benchaney's reply above.

.+@.+(\..+)?

should satisfy you both right? I use the original or a form of usually when I had to check emails.

Re: Let them paste passwords

#189

Post by roywiggins » Thu, May 18, 2017, 4:04 PM UTC

nippoo wrote: post #181

joshvm wrote: post #78

Earlier quoted context omitted.

We had a gem at my last university (UCL): you must rotate your password every few months, your password can't be anything like any of the previous ones (i.e. previous ones are stored, and they're not hashed), your password must contain special characters etc. Except.. it can only be 8 characters long. Anything else gets truncated (they explicitly said so). The mind boggles. I have no idea where this limitation comes…

The most odd bit about that UCL password policy is that it said "your password change has been submitted and may take up to 24 hours to take effect." To this day I'm not sure if they were just displayed in cleartext and someone just typed them in by hand

I think some SSO systems actually have to sync the password up with all the crappy computer systems that use it (rather than using actual SSO) and that syncing is done on a cron job at 3am.

Re: Let them paste passwords

#190

Post by moosingin3space » Thu, May 18, 2017, 4:04 PM UTC

rkeene2 wrote: post #124

simias wrote: post #15

Earlier quoted context omitted.

So by definition your password manager master key is weak? That's an interesting paradox!

I don't even have the ability to read my password manager's master key, since all passwords are encrypted with different AES keys, which is then encrypted with a private key I have no ability to read (only ask my smartcard to perform RSA on, if I can authenticate to it). hunter2 is the password manager I wrote for this: https://chiselapp.com/user/rkeene/repository/hunter2/

This is an interesting concept for storing keys. I may end up using something similar in a proof-of-concept I've been thinking about.