Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Security: Why the horse battery staple is not correct

diogomonica.com

Post reply on HN
Print view View original

31–40 of 92 posts

Re: Password Security: Why the horse battery staple is not correct

#31

Post by Retric »

diogomonicapt wrote: post #23
wpietri wrote: post #16

Earlier quoted context omitted.

Yeah, I get why he was trying to tie his point to something well-known. But I found the title maddening. If he had said, say, "Why horse battery staple is solving the wrong problem," I would have read his article with interest. But my increasing irritation as I waited for him to deliver on the promise in the title kept me from properly appreciating his point.

I agree that the title is more link-baity than it should. For what it's worth, part of it was just a witty title.

Reading that you come off as an idiot who has no idea what there talking about. Password managers are banned from high security applications, because their not secure.

That said, the random part of randomly generating a password is an issue, but combining that with something you have is reasonably secure.

PS: Some places require a 20+ character password and will fire you on the spot if it's ever written down or stored on a device of any kind. 99% of the time it's overkill but real security is rarely convenient.

Re: Password Security: Why the horse battery staple is not correct

#33

Post by MarkMc »

paulrr wrote: post #18

So I've got a question. Isn't using a password manager with unique, big, long, randomly generated passwords per site essentially the same as two-factor authentication? Something I know (the master password) and something I have (the encrypted password list). The password list lives on my laptop, on my phone, etc. Furthermore, when I use 2 factor auth, I end up storing the lose-your-phone recovery password in the pass…

No. Here are two differences between a password manager and 2FA:

1. A password manager will prevent someone from hacking into a website you use, stealing your password, then logging into another website as you. 2FA won't prevent this because someone who hacks into to a website can get access to the unique random seed that is used to generate the 2FA sequence, and can then use brute-force to determine your password.

2. 2FA will prevent someone from infecting your computer with a virus, stealing your password as you type it in, then using that password to log in as you in future. A password manager wont prevent this because the virus will gain access to both your main password and the list of encrypted randomly-generated passwords.

Re: Password Security: Why the horse battery staple is not correct

#34

Post by aftbit »

dllthomas wrote: post #20
bronbron wrote: post #19

It seems like the major gripe is against passwords like "p@assword", not against passwords like "correcthorsebatterystaple". If you truly choose 4 words randomly, the number of possibilities is > 1e24 (at least 1 million words in english language, likely not including slang or names).

You want the spaces. Leaving them out leads to collisions, which burn entropy.

You could also use _ or CamelCase to be a bit more friendly towards stupid password inputs.

My biggest problem with the passphrase system is how hard it is to use with lots of services. Plenty of places still enforce stupid requirements like maximum lengths, one of each type of character, or no spaces.

Re: Password Security: Why the horse battery staple is not correct

#35

Post by zanny »

Two factor is not a good solution either. Having to lug around your phone pulling up randomly generated strings from an RNG on both ends... defeats the point. Instead of an RNG seed, have a shared secret.

Of course, you need a trusted party for that, but that is how oauth and friends work. And how Persona should have worked. Logging in to anything should be clicking login and everything happening behind the scenes, because you are already trusted and authenticated by a dozen other services that whomever you are trying to access should defer to to identify you.

At least that is what Persona was supposed to do, and then fell flat due to slow adoption. But it was a chicken and egg problem through and through - nobody would use an immature Persona, and Mozilla abandoned it before it had time to shine.

Oauth is the maimed cripple of what should solve all of this, but at least it gets the correct UX to end users most of the time, even it if means wading through a half a dozen login buttons from various services selling your identity.

Considering modern browsers all support synced data stores, why the hell is there not some standards pushing api a la webrtc (in scope and adoption) to get randomly generated unique id keys made browser side for each service you use, that you can then sync between devices and across your browser "account"? Persona was meant to become that, but it died. Where is the successor?

Re: Password Security: Why the horse battery staple is not correct

#36

Post by LocalPCGuy »

I'm watching the work done by Steve Gibson with interest into a password replacement called SQRL. It's just a spec and he is developing the proof of concept software, but as far as I know it is not a commercial venture at all.

https://www.grc.com/sqrl/sqrl.htm

Abstract: The SQRL system (pronounced “squirrel”) revolutionizes web site login and authentication. It eliminates many problems inherent in traditional login techniques.

Re: Password Security: Why the horse battery staple is not correct

#37

Post by coldtea »

dllthomas wrote: post #14

This article includes some good points, but puts them together into something inane. It's true that silly constraints lead to trivial changes that lead to crackable passwords. It's also true that assuming brute force over all character classes included in a password is wrong. Those are precisely what the "correct horse battery staple" comic was getting at. Picking words at random (that is, based on a PRNG - not "rand…

>The other odd point is that we shouldn't be advocating stronger methods of choosing passwords because we should be using multifactor authentication. I don't dispute that we should be using multifactor authentication in more places, but even in that case weak passwords are a problem!

Only he never says that weak passwords are OK. Instead he says that we should not let people decide them, and instead use a uniformly random distribution of passwords (i.e. generated automatically).

Re: Password Security: Why the horse battery staple is not correct

#39

Post by icelancer »

zanny wrote: post #35

Two factor is not a good solution either. Having to lug around your phone pulling up randomly generated strings from an RNG on both ends... defeats the point. Instead of an RNG seed, have a shared secret. Of course, you need a trusted party for that, but that is how oauth and friends work. And how Persona should have worked. Logging in to anything should be clicking login and everything happening behind the scenes, b…

>Two factor is not a good solution either. Having to lug around your phone pulling up randomly generated strings from an RNG on both ends... defeats the point. Instead of an RNG seed, have a shared secret.

Google Authenticator has TWICE gotten out of sync with my Authenticator apps, including Google's own accounts and my WordPress installs. I've had to turn it off and just resort to single-factor auth, or using stuff like Mailchimp's own app.

2FA is great in theory but it's failed twice for me and it's been a huge hassle.

Post reply on HN