Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password expiration is dead, long live passwords

techcrunch.com

Post reply on HN
Print view View original

271–280 of 316 posts

Re: Password expiration is dead, long live passwords

#271

Post by altendo »

thameera wrote: post #226
karrotwaltz wrote: post #193

Earlier quoted context omitted.

Not so long ago I had to register to a website allowing a comma (or was it a semicolon?) in a password during registration but refusing to login using said password. Fun times.

I once spent 15 minutes trying to register in a local Domino's website which kept bugging me about lack of a special character - even though I had one in it. Turned out to be that the app truncates the entered password after the first 20 characters and only considers the first part. Thankfully the special character was after the 20th position so I noticed the error and fixed it, but if it wasn't I'd be wondering the…

I've had the same problem with Verizon, in the past the password would only store the first 20 characters. Took me an hour or two to figure it out and fix the problem. I'm not sure if that's still the case, hopefully not.

Re: Password expiration is dead, long live passwords

#272

Post by SketchySeaBeast »

panopticon wrote: post #111
manigandham wrote: post #106

Earlier quoted context omitted.

I use fake answers. Treat them as basically secondary passwords. I do keep them as real words though since sometimes they need to be answered over the phone and you don't want to read a long random string of characters.

Yeah, I used to use randomly generated strings until a customer service rep asked me to recite my security question answer to them... Now I use something like Diceware for real words.

That's excellent, I had no idea that existed, I'll have to start using that. Though it is fun to do a game of security question chicken - how much letters are they going to listen to me say until they go "ok, that's good enough"?

Re: Password expiration is dead, long live passwords

#273

Post by tolien »

testvox wrote: post #250
tolien wrote: post #239

Earlier quoted context omitted.

That argument surely holds if you’ve got Google Authenticator and 1Password installed on the same device? If someone gets your vault password and can unlock your phone, you’re toast, but SMS as a second factor is then also compromised so what usable (since this thread started as trying to sell MFA to lay people) options do you have (other than maybe a Yubikey)?

I thought Yubikeys and other hardware keys were best practice?

They might be a preference but I don’t see how they can be best practice when they’re barely supported on a lot of platforms - Firefox has some support (but doesn’t work with, for example, Github), no/limited support in Safari, no/limited support in mobile devices.

Re: Password expiration is dead, long live passwords

#274

Post by Firadeoclus »

Veen wrote: post #225
kebman wrote: post #198

Earlier quoted context omitted.

You will usually get far better entropy by simply stitching together a random array of everyday words. Example: stitching better everyday words array entropy level. Anyway, as for the too-long problem, then I guess we're back to square one. :)

Strings of everyday words are better than the passwords most people choose, they're memorable, and they're often good enough from a practical perspective. But if you're using a password manager and don't have to remember passwords, you might as well use truly random passwords, which have more entropy.

... for the same length. But length doesn't really matter unless you're manually typing it in, in which case many people will be faster at typing words than random characters.

Re: Password expiration is dead, long live passwords

#275

Post by DalekBaldwin »

sriku wrote: post #123
paulryanrogers wrote: post #43

Earlier quoted context omitted.

Some never memorize their passwords at all. Instead relying on 'forgot' emails and "Remember Me" features entirely.

It is one way to go "passwordless" .. though you're piggy backing on the security that your email system already has. Shameless plug of old post that describes how to restrict login to only the initiator even if login is initiated via an email link - http://sriku.org/blog/2017/04/29/forget-password/

This breaks my workflow -- I almost never open the forgot-password email on the same machine I used to initiate the request. Usually I need to briefly access a personal account from somebody else's computer or my work computer, and when I'm told I need to check my personal email, I only want to open that on my phone.

Re: Password expiration is dead, long live passwords

#276

Post by bluGill »

SketchySeaBeast wrote: post #270
bluGill wrote: post #263

Earlier quoted context omitted.

Banks are probably still running on the old mainframe (old as in upgraded in 1998 when y2k forced it), with password storage that was state of the art in 1960 (plain text, but the file is actually protected well so hackers can't get it). That isn't to say better password cannot be used, just that they have never enabled it.

I don't understand that - I get that the system that holds the data is old, but when creating an online banking system shouldn't the piece that holds the data be a good half dozen steps removed from the website and authentication?

Not if you want a single sign on. Of course customers only use the web login, but internal people have to deal with all these different logins.

Re: Password expiration is dead, long live passwords

#277

Post by OskarS »

Veen wrote: post #225
kebman wrote: post #198

Earlier quoted context omitted.

You will usually get far better entropy by simply stitching together a random array of everyday words. Example: stitching better everyday words array entropy level. Anyway, as for the too-long problem, then I guess we're back to square one. :)

Strings of everyday words are better than the passwords most people choose, they're memorable, and they're often good enough from a practical perspective. But if you're using a password manager and don't have to remember passwords, you might as well use truly random passwords, which have more entropy.

I disagree. I use a 1Password, and I used to do the "totally random string of letters, symbols and digits", but I've dropped it for the "four or five random english words" alternative for all new passwords.

There are a couple of situations where having these symbol strings is really inconvenient. For instance, reading a password out loud to another person, or when logging in on a device where you can't (or don't want to) install your password manager on (e.g. a PS4 or an Apple TV). In those cases, "puncture-foible-irish-ducat-rejoice" is a lot easier to handle than "jh&6dQ#F]9.Z>u^t]6u+".

The "symbol" password has more entropy for sure, but the actual security benefit is essentially non-existent. No one's going to guess either password, and I'm never using the same password in two different places anyway. The extra convenience is totally worth it.

EDIT: as other people have pointed out in the thread, another example would be badly behaving sites that prevent "paste" or use other techniques to block password managers. Much easier to type in those words then.

Re: Password expiration is dead, long live passwords

#278

Post by ltc5505 »

SketchySeaBeast wrote: post #272
panopticon wrote: post #111

Earlier quoted context omitted.

Yeah, I used to use randomly generated strings until a customer service rep asked me to recite my security question answer to them... Now I use something like Diceware for real words.

That's excellent, I had no idea that existed, I'll have to start using that. Though it is fun to do a game of security question chicken - how much letters are they going to listen to me say until they go "ok, that's good enough"?

Customer Rep.: "What is your mother's maiden name?"

Scammer: "I just entered a bunch of garbage."

Customer Rep.: "Yup! Thanks for verifying that Mr. Smith!"

Re: Password expiration is dead, long live passwords

#279

Post by Shaddox »

enriquto wrote: post #172

Can't we say good riddance to all passwords yet? I yearn for the day where I can log-in everywhere using public key cryptography.

Not yet, I'm afraid. Passwords are the best of the bad solutions people came up with. For public key cryptography, the problem remains, as always, key exchange. How can one be sure you are who you say you are?

Re: Password expiration is dead, long live passwords

#280

Post by SketchySeaBeast »

ltc5505 wrote: post #278
SketchySeaBeast wrote: post #272

Earlier quoted context omitted.

That's excellent, I had no idea that existed, I'll have to start using that. Though it is fun to do a game of security question chicken - how much letters are they going to listen to me say until they go "ok, that's good enough"?

Customer Rep.: "What is your mother's maiden name?" Scammer: "I just entered a bunch of garbage." Customer Rep.: "Yup! Thanks for verifying that Mr. Smith!"

"A bunch of garbage" is actually kind of a fun answer in itself. "Who was your childhood best friend?" "A bunch of garbage."
Post reply on HN