Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

49% of workers, forced to change passwords, reuse same one with minor change

grahamcluley.com

Post reply on HN
Print view View original

241–250 of 316 posts

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#241

Post by ec109685 »

tomp wrote: post #182
fragmede wrote: post #112

Earlier quoted context omitted.

Which, to be fair, is close to how it works inside Apple's walled garden. Logging into iCloud on a new computer will cause the iPhone attached to that account to pop-up a "confirm login" dialog, so the second factor for login is as unobtrusive as possible.

No you still need a password, which also makes it insecure on a public computer (where keyloggers might be installed). Instead, the better solution would be, you point your phone to a QR code on the computer screen, press “confirm”, the computer is magically logged in, until you then press “log out” on your phone and the computer is logged out.

If an attacker has root on a public computer, a QR code is easily hackable as well: just man in the middle the scan process.

So while you are logged in, the attacker can do anything they want.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#242

Post by nicky0 »

iudqnolq wrote: post #215
tomp wrote: post #182

Earlier quoted context omitted.

No you still need a password, which also makes it insecure on a public computer (where keyloggers might be installed). Instead, the better solution would be, you point your phone to a QR code on the computer screen, press “confirm”, the computer is magically logged in, until you then press “log out” on your phone and the computer is logged out.

Google does that without needing a QR code if you have a recent Android and haven't enabled 2FA

How does the communication from the computer to the phone work?

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#243

Post by iudqnolq »

nicky0 wrote: post #242
iudqnolq wrote: post #215

Earlier quoted context omitted.

Google does that without needing a QR code if you have a recent Android and haven't enabled 2FA

How does the communication from the computer to the phone work?

No idea. Presumably a push notification. Within less than a second providing your email (on fast US data) you get a prompt on your phone that shows the browser model and approx location and asks you to approve or disapprove the login.

They initially rolled it out as a 2FA option, then as an optional for 1FA.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#244

Post by ativzzz »

mtzet wrote: post #236
ativzzz wrote: post #222

Earlier quoted context omitted.

I like to also purposefully misspell words, or use some kind of alternative representation of letters, like use 'keeb0rd' instead of 'keyboard'.

Such common variations are accounted for by dictionary attackers.

Realistically, which of my passwords are accessible by such? The vast majority of my passwords are on the web. I don't think any web server is capable of receiving that many password requests to brute force the creds there.

Otherwise to get access to my PC? Let's just say that if that ever happens, having a more randomized password (and one that I can actually use) that takes a bit longer to crack won't make much of a difference, considering they already have my PC.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#245

Post by Dylan16807 »

mtzet wrote: post #240
Dylan16807 wrote: post #148

Earlier quoted context omitted.

There's absolutely no way a five word password is better than 32 random characters. Two plain old random words, the entropy of that is less than 16 bits each, but we'll round up. One of the biggest cities in the US is probably even less useful, but let's credit it for 16 bits. And let's rate Zaphod Beeblebrox as one-in-a-million for entropy purposes. That's 68 bits. It's somewhere between 11 and 12 random alphanumeri…

> a single consumer GPU can test about 2^48 - 2^52 hashes per day Surely that depends on the hashing function. Moreover, these passwords are usually used for authentication rather than encryption, making the speed of the GPU irrelevant. Even for encryption, you should probably store a strong key on a hardware TPM and only using the weaker key to authenticate towards the TPM.

It matters for authentication. Databases are regularly leaked with password hashes in them.

You can use a bad password if the hash is good enough, or if you assume the hash can never be leaked. But you can't usually assume the hash will be good. It's safer to store a high quality password than to memorize a low quality password.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#246

Post by [deleted] »

cgriswald wrote: post #192
_ah wrote: post #142

Earlier quoted context omitted.

You could take the first N characters of the password and store that as a secure hash. That would catch people choosing password1, password2, etc (but wouldn't help much with 1password, 2password...)

Strip all the non-letter characters and hash that.

[deleted]

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#247

Post by Dylan16807 »

ativzzz wrote: post #244
mtzet wrote: post #236

Earlier quoted context omitted.

Such common variations are accounted for by dictionary attackers.

Realistically, which of my passwords are accessible by such? The vast majority of my passwords are on the web. I don't think any web server is capable of receiving that many password requests to brute force the creds there. Otherwise to get access to my PC? Let's just say that if that ever happens, having a more randomized password (and one that I can actually use) that takes a bit longer to crack won't make much of…

If you're only worried about people trying to log in via the web, you can get away with a really bad password and you don't need any fancy tricks.

If they get the drive from your PC, the difference between a medium password and a good password is not "takes a bit longer to crack". A better password is impossible to crack using current or near-future technology. The difference between 12 and 20 characters is that it takes ten million billion times longer to crack.

(Assuming you encrypt your data. If you don't then all your effort on making a half-secure password is wasted from the start.)

If you want real convenience for logging in to your PC, without compromising your security, then use a PIN that unlocks a key stored in the TPM.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#249

Post by jiggawatts »

octorian wrote: post #113
petercooper wrote: post #36

There was an entertaining tale about this in Henry Marsh's Do No Harm: Stories of Life, Death and Brain Surgery (he's a very significant figure in brain surgery in the UK). There's a lot to it, but it came down to running around the hospital getting mad with the new digital system for looking at X-ray pictures rather than having them in physical format. Given one of the admin's passwords to try (it was something quit…

Somehow this reminds me of a problem my father (who is a doctor) has often complained about. Basically IT shitheads enforcing their policies on ALL computers in the hospital, including those used in operating rooms. So that means things like a screen (displaying important information) locking from X minutes of inactivity, on a computer that the surgical team is physically unable to "bump" periodically or type a passw…

Conversely, computers outside the surgery are all on one big network in a public space with random unsupervised people walking around at all hours. It's very easy for someone to utilise this in a way that violates the privacy of a patient in the worst possible way. Think nosy reporter looking for HIV status of a celebrity, or abusive parents looking for their kids to stop them having an abortion, that kind of thing.

I've been involved in the design of hospital computer networks, and I tell you: meeting all the requirements at once is hard!

The system we designed used contactless smart cards and Citrix. The idea was that as the attending doctors moved from bed to bed and ward to ward, their desktop session would move with them.

The instant they logged on somewhere else, the previous terminal would lock and the session would transfer to the new terminal without a full Windows logon cycle. It was basically equivalent to disconnecting a monitor and connecting a different one. No passwords were needed, they just had to tap their id card once.

My challenge was that this has to occur in under a second, including the smart card cryptographic authentication step, which was limited by the throughput of the NFC chip on the card. From memory, it was woefully slow, and we had to use the smallest compatible elliptic curve cipher available to make it acceptable.

Similarly, it was difficult finding a thin terminal device that was both fast enough to do this, and fanless so that it could be sealed against dust. This was needed to prevent their warm insides becoming the perfect breeding ground for antibiotic resistant superbugs.

Re: 49% of workers, forced to change passwords, reuse same one with minor change

#250

Post by _trampeltier »

First, we also have to change our password all 4 months or so.

But keep in mind, you can't use a password manager for logon. There are also some special accounts multiple people use. The password in this account is just something like "june.2019".

I guess the best solution would be a card (we anyway have one for the working hours and pay coffee and snacks) AND a password.

Post reply on HN