Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let them paste passwords

ncsc.gov.uk

Post reply on HN
Print view View original

311–320 of 376 posts

Re: Let them paste passwords

#311

Post by thewhitetulip »

thesuitonym wrote: post #58
artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

So fb and Twitter are either built by incompetent devs or they have too high a mgmt interference? (Since they auto play videos)

Re: Let them paste passwords

#312

Post by thewhitetulip »

Johnny555 wrote: post #173
Crespyl wrote: post #113

Earlier quoted context omitted.

Though I'm pretty sure I've seen "Your password is too similar to a previous password" before, which suggests some kind of plaintext Levenshtein distance check. "Is the same as" can be fine with a hash, but "Is too similar" is definitely a red flag.

When I've seen that "your password is too similar..." warning, it was with a system that required entering my current password to set a new password, so no need to store a previous version in plaintext. Though another way around it is to apply a set of common transformations to your new password, hash it and see if it matches the previous one. I.e. if your current password is "Password123" and you try to set it to "P…

I think almost every system requires you to put in your current password to change new password.

Re: Let them paste passwords

#314

Post by memmcgee »

SomeStupidPoint wrote: post #79
alanh wrote: post #27

Earlier quoted context omitted.

Oh, come on. All of them? If you're like me, that’s hundreds. Are you a memorization savant? Are you creating low-quality passwords? Mine are actually long and random (generated NOT by me and NOT four Dr Seuss words)

Why the dig at passphrases?

Because they're not actually effective. Most brute forcing is done via dictionary attacks.

Re: Let them paste passwords

#315

Post by dainichi »

SamBam wrote: post #144
makmanalp wrote: post #101

Earlier quoted context omitted.

Doesn't that decrease the benefit of storing a hash? You probably know the process through which the derivative hashes are generated, which is not known-plaintext but seems kinda iffy still.

I think it would decrease the benefit, yes. If you store the hash of the password, plus the hash of a hundred "similar" passwords, then the hacker only has to brute-force one to find that they are on the right track, and then brute-force "similar" combinations.

Supposedly, you'd only be able to get feedback about the similarity of a password in a state where you're already authenticated. So I guess this would help an attacker get the password when they've already gained access in some other way. But that's a big assumption.

Re: Let them paste passwords

#316

Post by hedora »

kolinko wrote: post #157
thesuitonym wrote: post #58

Earlier quoted context omitted.

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

Doesn't work on IE - depends on a business. I made a saas tool for mac developers. Fixing all the quirks would cost far more than the potential 2% users are worth to me. Slideshows - you mean even embeded Slideshare ones? Why? It's a good tool to explain certain ideas, and easily shareable one. We had our slides embeded on a TC post, and we used them as a significant source of traffic.

I'd say especially embedded slideshare ones. Just link to the PDF, or I won't read your content (and my browser will probably block it anyway).

I don't know what your product is, but I use four different browsers on a daily basis across three operating systems (it would have been six across 2 if not for the win10 privacy debacle, and even more if I had an android), and I want all my SAAS to work on all of them.

Experience says when they don't work everywhere, IT just dumps the service for another SAAS provider and everyone cheers.

Re: Let them paste passwords

#317

Post by hedora »

reacweb wrote: post #68
thesuitonym wrote: post #58

Earlier quoted context omitted.

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

I agree with all your points except slideshows. Why so much hate against slideshows ?

I was talking to one of the Facebook cofounders years ago, and he put it better than I could (he wasn't talking about slideshows specifically). I don't have an exact quote but it went something like this:

We don't optimize for impressions per session. Instead we optimize for the number of things a user does in a fixed amount of time, (or per session). The former is a poor proxy for the latter, and you can increase impressions by adding useless click through pages that ultimately drive away users and destroy your business in the long term. (In the short term, these things make your metrics look good.)

I bring this up because slideshows are a great way to artificially boost impressions.

Re: Let them paste passwords

#318

Post by dainichi »

kolinko wrote: post #159
joshvm wrote: post #78

Earlier quoted context omitted.

We had a gem at my last university (UCL): you must rotate your password every few months, your password can't be anything like any of the previous ones (i.e. previous ones are stored, and they're not hashed), your password must contain special characters etc. Except.. it can only be 8 characters long. Anything else gets truncated (they explicitly said so). The mind boggles. I have no idea where this limitation comes…

Theoretically, using homomorphic encryption you can both store passwords securely and check them for similarity. :)

If the similarity of ciphertexts reveals information about the similarity of the cleartexts, then given you have the encrypted password and the encryption algorithm, couldn't you guess the cleartext password by performing search? The point about hashes is that nobody can decrypt, although everybody knows the "encryption" algorithm. So not sure that homomorphic encryption would help in this case. Or am I missing something?

Re: Let them paste passwords

#319

Post by JauntyHatAngle »

alexbeloi wrote: post #301
artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

If you want to see incompetence, the California DMV doesn't allow copy/paste AND it asks for not two, not three, but SIX personal security questions. Oh, and if you forget your login/pass/security-answers, don't worry, you can just re-register your account with the same username as before, with all new password, security questions and answers.

>it asks for not two, not three, but SIX personal security questions.

As in... every login it wants you to answer all six of your questions? That's barmy.

Re: Let them paste passwords

#320

Post by xelxebar »

thesuitonym wrote: post #58
artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

Wait. Why is zero restrictions on passwords a bad thing?
Post reply on HN