Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules Are Bullshit

blog.codinghorror.com

Post reply on HN
Print view View original

41–50 of 283 posts

Re: Password Rules Are Bullshit

#41

Post by snowwrestler »

koolba wrote: post #31
nerdponx wrote: post #3

Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…

> Why? Because my password in the "create" page was silently truncated on the front end, but the same truncation does not occur in all places, so I would type a longer password on the login page then what was registered in the system and it would fail. Here's an even worse one than truncating the end of long passwords: truncating internal whitespace The change/reset password dialog for Apple ID does this. If your pas…

Are you sure? My Apple ID password has a bunch of internal white spaces and it works fine.

Re: Password Rules Are Bullshit

#44

Post by code_duck »

jondubois wrote: post #28

I'm surprised that this article didn't mention the most important point about password rules: They force you to come up with a new password that you probably haven't used before and so you will probably forget it. There are websites that I don't use often where I literally have to reset the password (and go through all the i-forgot-my-password steps) every time I want to log in because they forced me to come up with…

For me it's gotten to where I just assume next time I need to log into the website, 6 months from now - car insurance for example - I simply expect to recover the password. No password really matters besides my email.

Re: Password Rules Are Bullshit

#45

Post by drewg123 »

I just yesterday had to sign up for some bullshit "secure email" service to read some email from my late uncle's bank. They had all the rules described in the article, and I could not use highly secure generated passwords. I finally settled on some super weak password with one of each requirement (char, case, symbol) tacked on to the end. Sigh.

To make matters worse, the email looked just like a phishing attempt. Right down to having you download some html attachment, which, after it opens, directs you to click on something which finally takes you to the "secure email". The whole process felt like something a scammer would come up with, and is really not how banks should condition their customers.

Re: Password Rules Are Bullshit

#46

Post by redwood »

jondubois wrote: post #28

I'm surprised that this article didn't mention the most important point about password rules: They force you to come up with a new password that you probably haven't used before and so you will probably forget it. There are websites that I don't use often where I literally have to reset the password (and go through all the i-forgot-my-password steps) every time I want to log in because they forced me to come up with…

Related, some of these sites you forget what you used and have to create a new password - and some of them do this horrible "You cannot re-use your four last passwords" thing which leaves you in this sort of permanent "I'm never going to remember and always have to come up with something new" loop (for sites you go to only periodically, e.g. an HR portal, let's say). But hey, nothing important lives in an HR portal, right? :P

Re: Password Rules Are Bullshit

#47

Post by vog »

koolba wrote: post #31
nerdponx wrote: post #3

Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…

> Why? Because my password in the "create" page was silently truncated on the front end, but the same truncation does not occur in all places, so I would type a longer password on the login page then what was registered in the system and it would fail. Here's an even worse one than truncating the end of long passwords: truncating internal whitespace The change/reset password dialog for Apple ID does this. If your pas…

> Also you can work around that by hashing the entire uses password (with say SHA-512) prior to inputting into bcrypt.

I wonder why people are so eager to combine different hash algorithms, especially a strong with a weaker one. If this is isn't a well-established anti-pattern, it should become one.[1] Why? Because in some sense it combines the weaknesses of both algorithms.

Assume your password hash is:

h(p) = bcrypt(sha512(p))

Assume in the future somebody generates a sha512() collision with p and q, while bcrypt() holds water:

sha512(p) = sha512(q)

It follows that:

bcrypt(sha512(p)) = bcrypt(sha512(q))

and hence:

h(p) = h(q)

So any collision in sha512() translates directly to h(), bcrypt's strength is unable to protect you from that.

Had you just used bcrypt(), you would not have been affected.

Frankly, this is about collision and not about preimage attacks (the latter being more relevant for password cracking), but the former is usually a first step towards the latter. Also, this example demonstrates that combining a weaker and a stronger hash algorithms usually does not combine their strengths, but their weaknesses.

[1] It is almost like inventing your own crypto primitives, which actually is a well-established anti-pattern.

Re: Password Rules Are Bullshit

#48

Post by koolba »

snowwrestler wrote: post #41
koolba wrote: post #31

Earlier quoted context omitted.

> Why? Because my password in the "create" page was silently truncated on the front end, but the same truncation does not occur in all places, so I would type a longer password on the login page then what was registered in the system and it would fail. Here's an even worse one than truncating the end of long passwords: truncating internal whitespace The change/reset password dialog for Apple ID does this. If your pas…

Are you sure? My Apple ID password has a bunch of internal white spaces and it works fine.

I think it depends on when and where you updated it from. I ran into this issue last year doing it via https://appleid.apple.com/.

Re: Password Rules Are Bullshit

#49

Post by coldpie »

corobo wrote: post #38
simias wrote: post #25

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…

> if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing You do. A lot of users don't consider automation when it comes to people hacking their account. I've heard "Nobody will ever guess it though" a few times during my career.

I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords.

What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on that particular service, at least until the leak becomes discovered and the service does a full password reset.

While it would be ideal to defend against that attack, I think it's far more important to stress that users have a different password for every website. The real attack vector that we see every day is a DB leak from a poorly secured website, passwords cracked, and then reused on important services. That's where the problem lies, not in the user's password entropy.

Jeff isn't wrong here, he's just attacking a relatively unimportant problem.

Re: Password Rules Are Bullshit

#50

Post by Spooky23 »

Excess in password complexity policy is bullshit. I'm surprised Atwood would write knee jerk nonsense like this.

If you follow the NIST guidance, it's not a problem at all. The bullshit happens when you allow infosec people who lack applied skills and go overboard in their analysis of policy and standards documents. Those infosec people wrongly see increasing entropy as equating to high assurance -- in reality increased complexity leads to ad hoc "something you have" tokens (i.e. My complex password is written on a post it note).

You need length and complexity standards because users don't know how to measure risk, don't understand what a good enough password is and don't really care. So people do stupid shit like make their password "qwerty". It puts their data and the integrity of your system at risk.

Disregarding the navelgazing about cultural insensitivity re: character sets, a 10 character length + 3/4 of upper/lower/numeric/symbol, combined with lockout controls ensures a reasonably high level of assurance. Again, per the NIST guidance, if you need more trust, you need multiple factors.

Post reply on HN