Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lessons from a Professional Password Cracker

themarkup.org

Post reply on HN
Print view View original

21–30 of 138 posts

Re: Lessons from a Professional Password Cracker

#21

Post by bluedino »

hn_throwaway_99 wrote: post #18

> Instead of passwords, we should use something like FIDO, which allows users to log in using a security key or biometric information. The problem "in the real world" is that people will lose these keys all the time . I mean, I agree, passwords need to die, and hopefully some of the work that is being done by Apple and others will help bring on an end to passwords, but you can't really talk about replacing passwords…

We have the following:

Authenticator app, HID card, or FIDO key. Biometric is coming but the goal is to not have to give people yet another reader/device.

In theory we wouldn't have to worry about someone losing their card or key but they don't always setup all three in their account.

Re: Lessons from a Professional Password Cracker

#22

Post by Scion9066 »

hn_throwaway_99 wrote: post #18

> Instead of passwords, we should use something like FIDO, which allows users to log in using a security key or biometric information. The problem "in the real world" is that people will lose these keys all the time . I mean, I agree, passwords need to die, and hopefully some of the work that is being done by Apple and others will help bring on an end to passwords, but you can't really talk about replacing passwords…

I hope that the availability of using device-based (using the built-in hardware in a device they're less likely to lose like a phone/laptop) or account based (like the passkeys synced to iCloud/Google/Microsoft) will help mitigate the issue of people losing them. Regardless of which option they use though, they should treat them like home/car keys and have backups in place.

As for the biometrics, when people talk about biometrics for authentication, they are usually talking about using the biometrics to unlock something stored securely on a device. Without the device that has the actual credential being used, the biometric that has been copied doesn't do attackers much good.

Re: Lessons from a Professional Password Cracker

#23

Post by dijonman2 »

jiggawatts wrote: post #7

Some rules of thumb: All Windows passwords shorter than about 10 characters shouldn't be considered secure, as the NT Hash at this point is so easily reversible that it's basically a "light obfuscation" at best. A single GPU can crack all 8-character passwords in minutes. The single best security setting on a Windows network is to increase the minimum password length to something like 14 characters. Use 20+ for privi…

> The third thing is to match against specific leaks. E.g.: if you have john.smith@foo.com and there is a leak of his email and password where the password matches your records, force a password change immediately.

I’ve wanted to do something similar but how would you do this without direct access to HIBP’s data?

I don’t want to send customer email addresses to a third party, at least not without a contract.

Re: Lessons from a Professional Password Cracker

#24

Post by Scion9066 »

gmane wrote: post #17

Hey, I keep seeing people claim biometrics somehow fix the password problem, but I feel like this is just a password you can't change? I can't change my fingerprints nor my retina, but if that data ever gets leaked, then that's vulnerable forever? In my mind, there's no world where one could make a biometric scanner that couldn't be spoofed (presumably with an arduino USB interface) and then when all these corporatio…

Generally, you're not logging in directly with the biometric data. The biometric data never leaves your device, it is just used to protect some kind of secret key on the local device that it actually uses for the authentication when logging in. If you need to log in another device, you would use an existing device to confirm the new login or you would need to use some other authentication method.

Re: Lessons from a Professional Password Cracker

#25

Post by Scion9066 »

dijonman2 wrote: post #23
jiggawatts wrote: post #7

Some rules of thumb: All Windows passwords shorter than about 10 characters shouldn't be considered secure, as the NT Hash at this point is so easily reversible that it's basically a "light obfuscation" at best. A single GPU can crack all 8-character passwords in minutes. The single best security setting on a Windows network is to increase the minimum password length to something like 14 characters. Use 20+ for privi…

> The third thing is to match against specific leaks. E.g.: if you have john.smith@foo.com and there is a leak of his email and password where the password matches your records, force a password change immediately. I’ve wanted to do something similar but how would you do this without direct access to HIBP’s data? I don’t want to send customer email addresses to a third party, at least not without a contract.

If you don't want to send stuff to others, then you would generally need to either get the email address data another way (e.g. collecting the data from breaches yourself on behalf of your org) or download the Pwned Passwords data and setup a system to check against compromised passwords locally.

Re: Lessons from a Professional Password Cracker

#26

Post by kadoban »

nimbius wrote: post #15

shameless plug: the EFF sells a dice set and fun sticker for use with their wordlist. https://www.eff.org/dice

Nice. Seems to be a real improvement over diceware.

> We manually checked and attempted to remove as many profane, insulting, sensitive, or emotionally-charged words as possible, and also filtered based on several public lists of vulgar English words

I kind of wish they had a list _without_ this step though. Vulgar and emotionally charged words are easy to work into stories and easy to remember.

Re: Lessons from a Professional Password Cracker

#27

Post by [deleted] »

gmane wrote: post #17

Hey, I keep seeing people claim biometrics somehow fix the password problem, but I feel like this is just a password you can't change? I can't change my fingerprints nor my retina, but if that data ever gets leaked, then that's vulnerable forever? In my mind, there's no world where one could make a biometric scanner that couldn't be spoofed (presumably with an arduino USB interface) and then when all these corporatio…

[deleted]

Re: Lessons from a Professional Password Cracker

#28

Post by maxbond »

gmane wrote: post #17

Hey, I keep seeing people claim biometrics somehow fix the password problem, but I feel like this is just a password you can't change? I can't change my fingerprints nor my retina, but if that data ever gets leaked, then that's vulnerable forever? In my mind, there's no world where one could make a biometric scanner that couldn't be spoofed (presumably with an arduino USB interface) and then when all these corporatio…

I can't remember who to credit for this quote, "fingerprints are usernames, not passwords."

Re: Lessons from a Professional Password Cracker

#29

Post by gruez »

paulryanrogers wrote: post #9
jiggawatts wrote: post #7

Some rules of thumb: All Windows passwords shorter than about 10 characters shouldn't be considered secure, as the NT Hash at this point is so easily reversible that it's basically a "light obfuscation" at best. A single GPU can crack all 8-character passwords in minutes. The single best security setting on a Windows network is to increase the minimum password length to something like 14 characters. Use 20+ for privi…

Is this still true now that LM hash v1 support has been dropped?

NTLM v2 isn't much better https://twitter.com/TerahashCorp/status/1155128018156892160/...

Re: Lessons from a Professional Password Cracker

#30

Post by pmontra »

gmane wrote: post #17

Hey, I keep seeing people claim biometrics somehow fix the password problem, but I feel like this is just a password you can't change? I can't change my fingerprints nor my retina, but if that data ever gets leaked, then that's vulnerable forever? In my mind, there's no world where one could make a biometric scanner that couldn't be spoofed (presumably with an arduino USB interface) and then when all these corporatio…

My country has my fingerprints because I have an id document like everybody else.

A number of states around the world have my fingerprints too because I entered those countries as tourist and I had to put at least one finger on a reader.

Maybe some country included mine also have my retina scan, I had to look into some cameras sometimes.

All those biometric information could be leaked, sold by corrupt civil servants or exchanged with other countries so random passwords generated by a password manager protects me more than biometric information. Am I wrong?

Of course some site could store and share with whoever they want my cleartext password before hashing it but I use one different password per site.

Post reply on HN