Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

371–380 of 447 posts

Re: I hate password rules

#371

Post by koolba »

GekkePrutser wrote: post #364
bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

My work is also big on pass phrases but I kinda hate them. It's a lot of extra work to type it every time I unlock my PC. And more characters means there's more chance to make a typo meaning I have to do the whole thing again. And the weird way my brain works I have no issue remembering "G6bH,vIz#amV" so I still do it like that :) Also, if an attacker has a hash of my password the damage is already done anyway. They…

> Also, if an attacker has a hash of my password the damage is already done anyway. They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext. So there's no real benefit there.

A diceware password of 6 words has an incredible amount of entropy. How would you ever brute force its hash?

> What matters is online guessing and that is severely limited in the amount of attempts.

Belt and suspenders.

Re: I hate password rules

#372

Post by [deleted] »

hervature wrote: post #317
mumblemumble wrote: post #307

Earlier quoted context omitted.

Will probably work about as well as that time when I was young and decided to spend about a week signing all receipts with a signature that looks nothing like my usual one, just to see if it would ever be challenged. Many people are, contrary to all pretense, mostly paid to not give any actual fucks.

What do you think the signature is for? If a store can provide a signed receipt, the bank eats a chargeback. If they can't, the business pays. No one verifies that it is your signature. It is just an anachronism of how contracts work.

[deleted]

Re: I hate password rules

#373

Post by nulbyte »

throwawayboise wrote: post #46
robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Supermicro BMC passwords do that. Recently (i.e. this year) I set up a bunch of servers and was setting the BMC password to a known value. Apparently there is a limit of 20 characters for the password. The password I set was 21 characters (which was accepted without error). When I tried to log in with this password, the login was rejected. However if I log in with just the first 20 characters of the password, it work…

> However if I log in with just the first 20 characters of the password, it works.

Even worse is when the password change form accepts more characters and processes them correctly, only to have the login form not allow you to enter all characters. If I'm not mistaken, the business remote deposit portal my bank uses does this.

Re: I hate password rules

#374

Post by kayodelycaon »

cesarb wrote: post #220
Spivak wrote: post #97

Earlier quoted context omitted.

Eh, a sticky note is pretty darn secure for the kinds of attacks you care about. If your attack vector is someone breaking into your office the security game changes completely.

> If your attack vector is someone breaking into your office the security game changes completely. There are at least two other important attack vectors against "sticky notes": accidental sharing through photographs and/or online meeting cameras, and visitors memorizing visible passwords. Both are defeated by hiding the sticky note below the keyboard, but my guess is that most people leave it visible on the monitor b…

I leave a post it on my monitor with a wrong password as a decoy.

Re: I hate password rules

#376

Post by ninjin »

Symbiote wrote: post #211
fragmede wrote: post #174

Earlier quoted context omitted.

My password generator (or just do it manually) can generate word passwords like correct-horse-battery-staple using real words, which is probably a bit easier to read over the phone.

grep --perl-regexp '^[a-z]{4,7}$' /usr/share/dict/words | \ shuf -n 5 | tr '\n' ' ' Although maybe just 2 or 3 words would be best for avoiding a support agent skipping the question. bless clench moraine

Nice one there, much simpler than my nearly POSIX one (I think I rely on a GNU sed extension, but it was years since I wrote this):

  shuf /nix/store/ny99jkpl3r9zgkkdv5apprzl18i8rb4m-scowl-2019.10.06/share/dict/wbritish.txt \
    | grep '^[A-Za-z]\+$' \
    | head -n 3 \
    | sed -e 's|\(.\)\(.*\)|\u\1\2|g' \
    | tr -d '\n' \
    | sed -e 's|$|\n|g'
Which gives you for example:

  OmegasInsentientPantheons
I only use this for “secret” questions though, not passwords.

Re: I hate password rules

#377

Post by bluGill »

tmountain wrote: post #203
bluGill wrote: post #121

Earlier quoted context omitted.

Todays computers can brute force passwords of their maximum length in a few hours. I suppose someone somewhere has a maximum length that is hard to brute force, but I've never seen it.

What max length? Once a password reaches 128 bits of entropy the key space is unfathomably large. You could have a password of length 1 with 10^100 possible values, and it could take a VERY long time to crack. In short, it has nothing to do with length, it has to do with bits of entropy, and there are still very real limits to what even the most powerful computers can brute force. Several years back, it was stated by…

8 character, upper lower case, ten numbers, and about fifteen special symbols. About 6 bits per character. Most limits are 8 characters, so around 40 bits. More or less depending on the exact rules used.

That assumes true random passwords, most attackers can make some educated guesses and cut the problem space, but that isn't a true brute force.

Re: I hate password rules

#378

Post by yawaramin »

GekkePrutser wrote: post #364
bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

My work is also big on pass phrases but I kinda hate them. It's a lot of extra work to type it every time I unlock my PC. And more characters means there's more chance to make a typo meaning I have to do the whole thing again. And the weird way my brain works I have no issue remembering "G6bH,vIz#amV" so I still do it like that :) Also, if an attacker has a hash of my password the damage is already done anyway. They…

What's stopping you from using a random password like 'G6bH,vIz#amV'?

Re: I hate password rules

#379

Post by amanzi »

Jeff_Brown wrote: post #244
amanzi wrote: post #166

Earlier quoted context omitted.

The important part is that the NIST password advice is meant to be read as a whole. Often I see people quote snippets out of the advice, but unless you read and understand the whole document, you run the risk of reducing your security posture.

But even if you didn't read all of it, and just required longer passwords instead of special characters, you'd be improving things.

That's true, but I've also seen people say that NIST no longer recommend expiring passwords periodically, so we should just let passwords never expire (source: "Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)").

While that's technically true, the advice is meant to be taken in the context of the rest of the advice (e.g. longer passwords, checking against compromised passwords, etc...).

If all you did was to change all your passwords to never expire, you'd be reducing security.

Re: I hate password rules

#380

Post by mjcl »

bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

The first place I worked was like this, with the exception of the long complicated passwords. We told people to call the helpdesk to reset their password and would save their password to an Excel sheet. This was improved slightly by rolling out a self-service password change tool that logged the passwords to a database.

One day someone that had legitimate access to the password list was fired/quit and the VP decided we needed to have everyone (~800 users, 700 remote) call the helpdesk to reset their password. All the helpdesk calls waiting for a password reset clogged the voice T1 (23 lines) for the office, preventing most calls in or out. Oops.

Thankfully when the company came in-scope for sarbanes-oxley the external consultant we hired to help with the audit said there was no way we could continue logging user passwords and stay compliant.

Post reply on HN