Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

381–390 of 447 posts

Re: I hate password rules

#381

Post by perryizgr8 »

jjcm wrote: post #108

Here's how I do passwords - require a certain amount of entropy, and compare vs common passwords on the backend. That's it. Here's a gif of it in action: http://files.jjcm.org/password.gif And an example webcomponent that implements this: https://github.com/jjcm/soci-frontend/blob/master/components... The ENTROPY_REQUIREMENT variable means you need a password that has at least 2^n possible combinations, given the cha…

Although this is brilliant, I am worried that most non-technical people will mistake the circle for counting the length of the password.

Re: I hate password rules

#382

Post by perryizgr8 »

core-utility wrote: post #175

Can anyone explain to me why even new products have a maximum character limit? I frequently see 16 or 20 maximum characters. If you're hashing the password, why does it matter?

Although 16 or 20 characters is too less, I can't think of an efficient and user-friendly way to allow arbitrary lengths. What if a user inputs a password with 604462909807314587353087 characters?

If your client is doing the hashing, it will get stuck or seem to take too much time to submit. If your backend is doing the hashing then you would need to send too much data over the internet, again killing the user experience.

I think 256 or 512 characters should be a sensible limit.

PS: 604462909807314587353087 is a Mersenne prime ;)

Re: I hate password rules

#383

Post by 14 »

throwawaygh wrote: post #356
14 wrote: post #343

Earlier quoted context omitted.

I really like that term “Cyber 9/11”. Is that something you made up or is that a term people use describing a bad attack?

Thanks, but I can't take credit :) I think I first came across this term in a foreign affairs article, and from then on used it often in presentations to various brain-dead military officers who all seemed to have degrees in Biblical Studies from colleges whose boards are full of Domionionism types. In any case, the term has been around for a while. Unfortunately, our officer corps is populated by weak-minded fools w…

I didn’t realize there was so much religion in the military. Gun in one hand bible in the other is the dumbest thing I can think of. Do they actually think if heaven and god was real they would be invited? Ha! I would love to hear how a military man justifies going to war and then preaching the bible surely the two go against each other.

Re: I hate password rules

#384

Post by MereInterest »

amanzi wrote: post #379
Jeff_Brown wrote: post #244

Earlier quoted context omitted.

But even if you didn't read all of it, and just required longer passwords instead of special characters, you'd be improving things.

That's true, but I've also seen people say that NIST no longer recommend expiring passwords periodically, so we should just let passwords never expire (source: "Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)"). While that's technically true, the advice is meant to be taken in the context of the rest of the advice (e.g. longer passwords, checking against compromised passw…

> If all you did was to change all your passwords to never expire, you'd be reducing security.

Not necessarily. Except in cases of gross negligence, such as storing passwords in plain text, the human is always the weak point in a security system. If you make people less likely to leave their passwords on sticky notes, perhaps by removing password rotation, then you have improved the weakest link of the system, and improved the security of the system as a whole.

Re: I hate password rules

#385

Post by tomc1985 »

watwut wrote: post #215
tomc1985 wrote: post #184

Earlier quoted context omitted.

That heavily depends on where you travel. Even here in Southern California there are populated areas with little to no mobile internet service (like Big Bear Lake, Anza Borrego, or Joshua Tree areas for example)

And they still have internet available to travelers?

Depends

Re: I hate password rules

#386

Post by justusw »

throwawayboise wrote: post #46
robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Supermicro BMC passwords do that. Recently (i.e. this year) I set up a bunch of servers and was setting the BMC password to a known value. Apparently there is a limit of 20 characters for the password. The password I set was 21 characters (which was accepted without error). When I tried to log in with this password, the login was rejected. However if I log in with just the first 20 characters of the password, it work…

Could that mean that the password is stored unhashed?

Re: I hate password rules

#387

Post by singlow »

GoblinSlayer wrote: post #228
dataflow wrote: post #217

Earlier quoted context omitted.

Not really. Even if you're worried about that, (36 alphanumeric + 10 symbols)^10 is roughly 4E16. Even at 2B checks/second/CPU (which is incredibly generous if the web developer has any competence) that's around 10M CPU-seconds, i.e. 115 CPU-days. For cracking one single password . An ASIC will speed it up, but again, remember this is one single password, and it can be an overestimate by like a factor of > 1 million…

If you don't let users use their preferred password structure, they'll have to use a shitty password like hunter2, letmein or dragon. Those can be recovered with a few attempts, even online. If you really want a 10 character password, you can hash the user's password, then imagine the first 10 bytes of the hash are the user's password, then do whatever you want with them.

How does one more iteration help? Your hash algorithm is already hashing multiple times. Seems it would be easier to increase the work input to PBKDF2 by 1 than to implement your own multi-hash. Even better increment it by 2000.

But the point is that you don't control the website's hashing algorithm, or whether they hash at all, or whether they store their hashes in a public s3 bucket. They may tell you what they do, they may not. But you have to trust them either way.

A long random password using a variety of characters is the only control I have when setting my password. If they have a good hashing system and protect their hashes, my long random password will not hurt anything. If they truncate my password before hashing, it will still be the best password I can make for that app.

If I use 5 5 letter words as my password and they truncate after the first 10, how would I know? My password might be "horseapple" instead of "horseapplehappygreennymph".

If I give them 10 alphanumerics and they leak their md5 hashes, I'm pwned in a few days, assuming they even salt it.

If I give them 20 random alphanumeric+symbol then I can't imagine what exotic thing they could do wrong to make it less safe than any other password I choose.

I might make an exception for some streaming service that I have to enter by hand on a tv remote control, but otherwise i am going to generate it with max entropy because I am never going to look at it anyway.

Re: I hate password rules

#389

Post by enriquto »

jhgb wrote: post #341
enriquto wrote: post #155

> I Hate Password Rules I hate passwords altogether. In this day and age, nearly all instances of password usage can be replaced by public key cryptography for a vastly improved user experience. And, of course, for a net gain in security.

> for a vastly improved user experience. Assuming for a moment that you live in the US, do you count Fifth Amendment issues into that experience?

I'm not from the US and I cannot imagine what the fifth amendment has to do with public key cryptography.

Re: I hate password rules

#390

Post by jhgb »

enriquto wrote: post #389
jhgb wrote: post #341

Earlier quoted context omitted.

> for a vastly improved user experience. Assuming for a moment that you live in the US, do you count Fifth Amendment issues into that experience?

I'm not from the US and I cannot imagine what the fifth amendment has to do with public key cryptography.

There's a significant legal difference between keys and passwords in the US: you can't be legally compelled to divulge the latter. And I imagine that based on the principle of non-self-incrimination in other countries' laws, it may very well be very similar in other countries as well.
Post reply on HN