In the article they talk about the 500 worst passwords of all time. Here is a gist listing those passwords. https://gist.github.com/4033452 Might be useful for some of you.
As an X-Files fanboy, I was pleased to see "trustno1" on that list!
The definitive guide to forms based website authentication
21–30 of 74 posts
Re: The definitive guide to forms based website authentication
#22Regarding website authentication, I've been looking for some feedback on a new auth scheme. Instead of using a standard password (all characters are allowed, min 5 characters, common passwords not allowed), you're able to login with a 4 digit passcode. I know someone just cringed at that thought, but the idea centralizes around improving user experience on the website. First, all normal precautions would be taken (no…
How is this any better than passwords? 1/10000 chance of guessing correctly is huge.
Why would I want to remember a different passcode every month?
If after two failed login attempts, I must respond to an SMS before I log in, it's really easy to DOS.
Users will be confused by this new scheme. Stick with what has already been vetted in the industry.
Re: The definitive guide to forms based website authentication
#23> if an attacker got his hands on your database, he could use the [persistent login cookie] tokens to log in to any account
If an attacker gets his hands on your database, it's kind of game-over already.
Re: The definitive guide to forms based website authentication
#24> I see multiple, severe problems with this old question from 2008 and I am tempted to delete it outright -- primarily because the most highly voted answers read more like blog rants than actual "answers".
http://meta.stackoverflow.com/questions/95172/old-problemati...
Re: The definitive guide to forms based website authentication
#25Quick note about CAPTCHAs... A more accurate rate is $1.50 per 1000, and that's even a tad expensive.
If you buy in bulk, it's much cheaper.
Source: Security researcher.
Re: The definitive guide to forms based website authentication
#26Regarding website authentication, I've been looking for some feedback on a new auth scheme. Instead of using a standard password (all characters are allowed, min 5 characters, common passwords not allowed), you're able to login with a 4 digit passcode. I know someone just cringed at that thought, but the idea centralizes around improving user experience on the website. First, all normal precautions would be taken (no…
> First, all normal precautions would be taken (no common digit patterns - 1234, 1111, 2222, etc).
Why? All you are doing is further reducing an already limited key space.
This authentication scheme is bad, and you should feel bad. :)
Re: The definitive guide to forms based website authentication
#27Regarding website authentication, I've been looking for some feedback on a new auth scheme. Instead of using a standard password (all characters are allowed, min 5 characters, common passwords not allowed), you're able to login with a 4 digit passcode. I know someone just cringed at that thought, but the idea centralizes around improving user experience on the website. First, all normal precautions would be taken (no…
Sorry, nothing personal.
But this 'new' approach feels like last decade online banking - and it wasn't a good idea at that point.
In addition: Limiting user input and forcing password resets is, in my world, directly acting against your idea of 'improving user experience'.
If I am allowed to use a password of my choosing, I'll probably come up with something that is memorable and reasonably secure (depending on the context, I admit). If you force me to follow random, voodoo rules (just digits, at least one digit and one upper-case letter, more than x but LESS THAN y chars) I'm going to sigh, come up with something like 'YeahRight123' and I'm going to add a mental note to never trust this service fully. If I'm not leaving right away, that is. Resetting a password regularly (oh.. I hate everything noticeable SOX forces upon us)? Cool, you just motivate me to make my passwort 'cool123' - 'cool234' etc. (with variations for 'clever' password checks. If I cannot keep a prefix, I'll juggle different parts and keep the same, crappy, useless, insecure password, because .. I cannot be bothered to follow arbitrary idiot rules)
Your idea follows the worst practices in terms of restricting the keyspace and auto-resetting the password at arbitrary times, starting out weak already (4 digits..).
I wouldn't sign up with some 'security' in place that follows your suggestion.
Re: The definitive guide to forms based website authentication
#28Why do maximum security sites always disable auto-complete for username and password? That seems less secure to me. If I always have to type in my password, chances are that I'll choose a password that can be easily remembered or I'll be forced to write it down somewhere. (Personally, I use plugins to get around this anyway. My computer, my rules.)
Agreed that a lack of autocomplete is annoying. A savvy user can also circumvent this by using a browser plugin such as GreaseMonkey to force-fill whatever fields they want. I guess the assumption is that such a user will also be savvy enough to safe-guard their password.
Re: The definitive guide to forms based website authentication
#29Regarding website authentication, I've been looking for some feedback on a new auth scheme. Instead of using a standard password (all characters are allowed, min 5 characters, common passwords not allowed), you're able to login with a 4 digit passcode. I know someone just cringed at that thought, but the idea centralizes around improving user experience on the website. First, all normal precautions would be taken (no…
> First, all normal precautions would be taken (no common digit patterns - 1234, 1111, 2222, etc). Why? All you are doing is further reducing an already limited key space. This authentication scheme is bad, and you should feel bad. :)
Agreed, I'm just toying with the idea of finding the simplest way for a user to access a website securely. Haha, that's why I posted here before implementing it ;)
We'll be focusing on mobile, and the login process could be something like PayPal's mobile app where they let you login with your phone number and PIN (min 4 digits). I'm just looking for a secure way to translate that to a web app.
Something that could help - sessions could persist for an infinite amount of time, so upon first login we send them 4 random digits via SMS and if they enter it correctly they're authenticated. Basically two factor auth without the initial password.
Re: The definitive guide to forms based website authentication
#30Regarding website authentication, I've been looking for some feedback on a new auth scheme. Instead of using a standard password (all characters are allowed, min 5 characters, common passwords not allowed), you're able to login with a 4 digit passcode. I know someone just cringed at that thought, but the idea centralizes around improving user experience on the website. First, all normal precautions would be taken (no…
How is this any better than passwords? 1/10000 chance of guessing correctly is huge. Why would I want to remember a different passcode every month? If after two failed login attempts, I must respond to an SMS before I log in, it's really easy to DOS. Users will be confused by this new scheme. Stick with what has already been vetted in the industry.
Yeah that's true, thinking about it further a way to solve this could be allowing infinite sessions with the initial passcode being sent to you via SMS.
This way you wouldn't need to remember a different passcode each month and the login attempt issue wouldn't exist because passcodes are generated when you need to login.