311–320 of 327 posts
Earlier quoted context omitted.
I am actually appalled and baffled at American Express not applying case sensitivity. Like, what the actual.
I literally couldn't apply for an American Express card about 15 years ago because my (ISP) email address was too long. I wonder why they chose to restrict it rather than go with the standard email max length; they had to put effort in to pointlessly restrict new signups. Odd.
I've been getting pretty annoyed by the "Security Questions" some sites have you setup. A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.
Earlier quoted context omitted.
Why not have one round of hashing in the browser? That way the input to your server-side hash function is fixed-length, whether the users password is 20 characters or 20 billion, and DOS attackers are only hurting their own computers.
Wouldn't that just turn the attacker's problem into brute forcing the client-side hash? Might be a problem if the client-side hash has a lower total complexity than the longer original password. I dunno though; just pondering out loud, I'm by no means an expert on this stuff.
If you choose to attack such a scheme by guessing the hash, then all passwords have that same level of entropy, even if the password that generated the hash is only 8 characters.
Earlier quoted context omitted.
Oh yeah. Yeeeears ago, I was contracting for a telecom provider, and as a contractor, the process for getting logins to all the stuff I needed access to was onerous in some cases, nonexistent in others. So the employee who was sponsoring my presence in the building just said I could share his login. "The password is Apr1999!, if you happen to be the first one to log in when it expires, just change it to May1999! and…
If you make the system secure but unusable, the users will find a way to make it usable but insecure.
Passwords don’t really have an expiration date if they are secure (as in long enough and not reused) in the first place.
Earlier quoted context omitted.
Yeah, I've seen a similar restriction on mother's maiden name =/
My mother (and many many women in this modern world) _goes by her maiden name_ so it's not exactly a secret. I always (politely) point this out when I'm dealing with a human at an institution who asks me for this information as part of the security process.
Earlier quoted context omitted.
What bugs me about security questions is when they give you questions that have subjective or time-varying answers. "What's your favorite X" is a terrible security question for me, I am not likely to remember an answer I chose 2-3 years ago
A government site I have to use for work asks "If you were a tree, what kind of tree would you be?"
Earlier quoted context omitted.
I think it’s established in the tech community that you use a password manager, then you don’t have to care how the password looks like or how easy it is to remember.
Passphrases are still easier to transcribe between systems. Which, given password managers' brain-damagedness at archiving and migrating passwords, remains frustratingly necessary.
What do you mean with that? I don't have a problem archiving passwords in 1Password. When I change it it's automatically stored in the entry as password history. If I retire a login because a site closed but I still want to keep my credentials / details I move it to an "Archive" vault in 1Password.
Earlier quoted context omitted.
It's ironic that allowing low-entropy passwords (for example, one-character) can actually increase the available entropy. For example, if you set a minimum password length of six characters, an attacker doesn't even need to bother going through all of the 1 through 5 character combinations. The flip side of the coin is that, obviously, allowing low-entropy passwords will inevitably mean that some users will actually…
> can actually increase the available entropy Well, the theoretical entropy, but not the empirical. You could argue that ruling out "12345678" and "password" and "Password!" reduces the "available entropy" and makes things less secure (after all, your random password generator might just randomly have generated "12345678"), but in practice quite obviously it makes things more secure.
> Well, the theoretical entropy, but not the empirical.
Agreed.
There are profound implications of that statement of that statement when applied to other problems, because we mutually accept the theory as correct, but only theoretically, when we know it has significant limitations in the real world.
> You could argue that ruling out "12345678" and "password" and "Password!" reduces the "available entropy"
Obviously. And yet, equally obviously, removing those from the rounds because they're preemptively banned reduces the actual number of test hashes we have to run to brute force, and introducing a rule means that we can also eliminate huge swathes of potential keyspace.
So, the obvious is not necessarily so obvious after all. This gets more and more interesting the deeper the rabbit hole goes.
What if we have extremely random data -- perhaps even raw binary -- but it happens to have a sequence of three arbitrary integers, which is in violation of the rules, and therefore we can eliminate all such passwords from our test cases? That's a potentially huge chunk of entropy.
Earlier quoted context omitted.
I have actually thought about this a lot and done some napkin calculations: using a set of about 93 characters the search space for 5 character passwords is about 7 gigabytes; combining all the possible passwords <= length 4 is only about 74 megabytes in comparison. I think that the entropy loss is insignificant.
Indeed, and the factor is about 95, which is close to 93, and that is not a coincidence, when you think about it. If you want to crack my password, and I tell you that my password is L characters long, by skipping all passwords of length In other words, telling someone the length of your password does not help them very much.
If you say "No passwords less than eight characters", most passwords will be clustered around 9 or 10 characters. That's human nature. This means that your entire search space is only the character set in that very limited set of strings. And, if you're limiting that character set, and also it's expensive for you to hash (ie scrypt or bcrypt with lots of rounds), then not having to go through the first 1-8 set will save you a tremendous amount of time...
Earlier quoted context omitted.
> My pet peeve is sites that block pasting Firefox: about:config: dom.event.clipboardevents.enabled, toggle to "false" (default is true). Result: websites can no longer block you from pasting things into form fields on your own browser on your own computer.
There is a Firefox extension called Don’t Fuck With Paste which let’s you toggle this per-website with a button.