Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Myths of Password Security

stormpath.com

Post reply on HN
Print view View original

21–30 of 52 posts

Re: Myths of Password Security

#21

Post by eddiemunster666 »

pornel wrote: post #17

A myth I'd like to dispel is that when login fails not telling whether username or password was wrong improves anything. Please do tell clearly when username was wrong. It won't disclose anything new, because you're already disclosing this information by validating registration form (and reg form will even disclose existence of registered e-mails by forbidding duplicate registration), existence of profile URLs, all k…

I humbly disagree, if you say to the user that the username was correct but the password was wrong then you have leaked information to the user that they should not have access to. i.e. If email is used as a username and I go to a porn site and type in my wifes email address and a random email and it comes back 'username right, password wrong' then I now know she has an account there which she was trying to kepp secret.

It's not only bad from that point of view, but also the attacker now knows you have a account there and so could try social engineering techniques to gain access to your account, it basically provides a attack opportunity that it doesn't have to.

Re: Myths of Password Security

#22

Post by pandog »

pornel wrote: post #17

A myth I'd like to dispel is that when login fails not telling whether username or password was wrong improves anything. Please do tell clearly when username was wrong. It won't disclose anything new, because you're already disclosing this information by validating registration form (and reg form will even disclose existence of registered e-mails by forbidding duplicate registration), existence of profile URLs, all k…

This is true for some cases but not all. For example if you have a CAPTCHA on your registration form but not your login form.

Re: Myths of Password Security

#23

Post by mnarayan01 »

eterm wrote: post #15
jere wrote: post #5

>Simply put, adding length increases entropy more efficiently than replacing letters with symbols. I don't like this meme. Because it's not necessarily "more efficient." Like most things, it depends. If I have a password made of 10 lowercase characters, it's much better to replace with an upper case character rather than add another lower case one. Option 1) Add a lower case character. Password is 26 times stronger.…

But don't do what someone I know did and replace every single e with 3, every single a with 4, every single o with 0. Identical entropy, extra theatre.

Not to imply that what you describe is a great strategy, but I wouldn't describe it as pointless. The password "12345" has the same entropy as "b0g4p" but it would be a mistake to think they are equally secure.

Re: Myths of Password Security

#24

Post by kijin »

geal wrote: post #13

Saying that using random words is better than using a string of unrelated characters assumes that password crackers don't know how to combine words. There are about 180000 words in English (but don't assume everybody knows 180000 words). That means that for three words, you have at most 5.8 10^15 options. For a password with mixed case and numbers, you have 62 different characters. With, 9 characters, you have 1.3 10…

It depends on how many words you have in a string.

XKCD's oft-quoted comic uses 4 words. That would be 100000 times stronger than using just 3 words, and vastly superior to your example of a random 9-char password. The article's own example, "golf kangaroo crispy halitosis", also uses 4 words.

I agree with you that long random passwords are the way to go, but even in that case you need to remember at least one password: the master password to your password manager. It would be a good idea to make that a string of 4 or more words. My LastPass master password consists of 5 words with a bunch of symbols sprinkled in between, and my banking password is 4 words in a foreign language.

Re: Myths of Password Security

#25

Post by venomsnake »

Fist myth is that passwords provide security. The human brain is crappy rng so it cannot create proper high entropy passwords. No way getting around that - whatever your password is if it is "derived" from something - someone else is using it too.

The only viable security I can think of is if we have distributed public key infrastructure. Bitcoin style wallets. And securing the "PK wallets" is up to the end user. Persona is close I think - so if the app fad/insanity finally dies we will be on a good track.

Re: Myths of Password Security

#26

Post by mistercow »

venomsnake wrote: post #25

Fist myth is that passwords provide security. The human brain is crappy rng so it cannot create proper high entropy passwords. No way getting around that - whatever your password is if it is "derived" from something - someone else is using it too. The only viable security I can think of is if we have distributed public key infrastructure. Bitcoin style wallets. And securing the "PK wallets" is up to the end user. Per…

>The human brain is crappy rng so it cannot create proper high entropy passwords. No way getting around that...

Yes there is: you use a real RNG to generate your password. A good option is http://passphra.se. Just remember that you can't go clicking "Generate Another!" until you find something particularly memorable, or you'll be sacrificing an unknown amount of entropy by narrowing the space to memorable passwords. Better to keep the phrase somewhere safe (encrypted) until you have managed to drill it into your head. I like to fit the phrase into a sentence, which adds both memorability and entropy.

For example, it just gave me: "song surprise calm task", which I might turn into "Sing a song of surprise, and resume your calm task.", which Dropbox's zxcvbn tool estimates at 141 bits of entropy. If a password form has a character limit, you can initialize the sentence, yielding "Sasos&ryct", which zxcvbn rates at a not-too-shabby 52 bits.

Re: Myths of Password Security

#27

Post by mistercow »

eddiemunster666 wrote: post #21
pornel wrote: post #17

A myth I'd like to dispel is that when login fails not telling whether username or password was wrong improves anything. Please do tell clearly when username was wrong. It won't disclose anything new, because you're already disclosing this information by validating registration form (and reg form will even disclose existence of registered e-mails by forbidding duplicate registration), existence of profile URLs, all k…

I humbly disagree, if you say to the user that the username was correct but the password was wrong then you have leaked information to the user that they should not have access to. i.e. If email is used as a username and I go to a porn site and type in my wifes email address and a random email and it comes back 'username right, password wrong' then I now know she has an account there which she was trying to kepp secr…

I think you're missing the point, which is that that information is already unavoidably leaked by the signup form. So leaking it from the log in form doesn't change anything.

Re: Myths of Password Security

#28

Post by HeyImAlex »

mistercow wrote: post #27
eddiemunster666 wrote: post #21

Earlier quoted context omitted.

I humbly disagree, if you say to the user that the username was correct but the password was wrong then you have leaked information to the user that they should not have access to. i.e. If email is used as a username and I go to a porn site and type in my wifes email address and a random email and it comes back 'username right, password wrong' then I now know she has an account there which she was trying to kepp secr…

I think you're missing the point, which is that that information is already unavoidably leaked by the signup form. So leaking it from the log in form doesn't change anything.

Yep, the only way to really leak no information is to just always say that the action (sign up, forgot password) was sucessful, which is awful from a ux perspective. Don't forget to go through the motions of registration/recovery to stave off timing attacks as well.

Re: Myths of Password Security

#29

Post by mistercow »

mnarayan01 wrote: post #23
eterm wrote: post #15

Earlier quoted context omitted.

But don't do what someone I know did and replace every single e with 3, every single a with 4, every single o with 0. Identical entropy, extra theatre.

Not to imply that what you describe is a great strategy, but I wouldn't describe it as pointless. The password "12345" has the same entropy as "b0g4p" but it would be a mistake to think they are equally secure.

>The password "12345" has the same entropy as "b0g4p" but it would be a mistake to think they are equally secure.

Those do not have remotely equal entropy.

Re: Myths of Password Security

#30

Post by mbesto »

Complexity Trumps Length

Question for the smarter people out there. If everyone started using passwords like "donkey computer watch" would this mean that this format would then be much easier to crack as opposed to xy7*hdkSD

Security is a bit of game theory right?

Post reply on HN