No post body was provided.
Entropy isn't sufficient to measure password strength
41–50 of 124 posts
Re: Entropy isn't sufficient to measure password strength
#42Earlier quoted context omitted.
I'm curious how you think these other items work. They ultimately boil down to a shared secret that is beyond what you can remember. Which... isn't the best thing, necessarily. Consider, if I leave my hardware token at home when I go on vacation, I'm basically locked out of all of my accounts. This is fine, as I typically plan for this to be the case. But it is an attack vector. I can't even audit my protected assets…
The point of public key cryptography is that there isn't a shared secret.
While technically correct, a private key will usually need to be encrypted to provide adequate security.
From the user point of view, they will still need to remember the password to unlock this private key.
Re: Entropy isn't sufficient to measure password strength
#43> Because choosing good passwords is about memorableness as well as sheer strength That's not been true ever since the development of good password managers. There are fewer than 10 passwords I remember. One of them is my password manager's master passphrase (5 misspelled-and-with-random-punctuation words). The others include stuff like my work and home laptop/disk passwords, which I can't autofill, my 3 important ba…
> That's not been true ever since the development of good password managers. A lot of people (do not trust password managers, case in point the recent last pass scare. You want passwords to your key accounts to be 1) memorable 2) strong 3) only in your head. For these, I think the article is fairly relevant.
> A lot of people (do not trust password managers, case in point the recent last pass scare.
That's no excuse. KeePass allows having the database file locally where it's you duty to manage it.
It might be less convenient, maybe. But I don't see valid excuses for people to not start using a password manager, even less the less tech savvy people.
Re: Entropy isn't sufficient to measure password strength
#44https://xkcd.com/936/
Fundamentally is there any flaw with this method? Or a reason why it isn't better than general password approach?
Re: Entropy isn't sufficient to measure password strength
#45> Because choosing good passwords is about memorableness as well as sheer strength That's not been true ever since the development of good password managers. There are fewer than 10 passwords I remember. One of them is my password manager's master passphrase (5 misspelled-and-with-random-punctuation words). The others include stuff like my work and home laptop/disk passwords, which I can't autofill, my 3 important ba…
One could argue that you still need to remember your master password, and since it gives access to all your other passwords, it's all the more important to make it extremely strong. Therefore the randomness/memorability trade-off is still very important.
Yes, but it’s not too hard to make one ridiculously long/complicated master password that is also memorable. It might take you a while to remember it — just keep it written down on paper somewhere private & safe and refer to it as needed. If you’re not being targeted then you’ll probably be fine.
Re: Entropy isn't sufficient to measure password strength
#46> Because choosing good passwords is about memorableness as well as sheer strength That's not been true ever since the development of good password managers. There are fewer than 10 passwords I remember. One of them is my password manager's master passphrase (5 misspelled-and-with-random-punctuation words). The others include stuff like my work and home laptop/disk passwords, which I can't autofill, my 3 important ba…
I mostly agree, but I do find myself choosing a new FDE and login passphrases about once a year, and I wish that I could choose these using something like Diceware, but memorable enough that I wouldn't need to write them down at all. Thinking about how I might do that is what ultimately led to this post.
Login, like for your local computer? Why rotate those?
Re: Entropy isn't sufficient to measure password strength
#47Earlier quoted context omitted.
> That's not been true ever since the development of good password managers. A lot of people (do not trust password managers, case in point the recent last pass scare. You want passwords to your key accounts to be 1) memorable 2) strong 3) only in your head. For these, I think the article is fairly relevant.
> A lot of people (do not trust password managers, case in point the recent last pass scare. That's no excuse. KeePass allows having the database file locally where it's you duty to manage it. It might be less convenient, maybe. But I don't see valid excuses for people to not start using a password manager, even less the less tech savvy people.
It’s completely valid to distrust password managers. No software is free from bugs, or accidentally exposing your passwords. It might take a lot of work, but it’s certainly possible.
There’s also the possibility of mismanaging your password database and losing all of your data.
Re: Entropy isn't sufficient to measure password strength
#48> Because choosing good passwords is about memorableness as well as sheer strength That's not been true ever since the development of good password managers. There are fewer than 10 passwords I remember. One of them is my password manager's master passphrase (5 misspelled-and-with-random-punctuation words). The others include stuff like my work and home laptop/disk passwords, which I can't autofill, my 3 important ba…
> That's not been true ever since the development of good password managers. A lot of people (do not trust password managers, case in point the recent last pass scare. You want passwords to your key accounts to be 1) memorable 2) strong 3) only in your head. For these, I think the article is fairly relevant.
The problem with password managers was they were a commercial venture - not that commercial is inherently in the general case worse, but:
1. Closed source, so you cannot audit a critical peice of security infrastructure. 2. Perverse incentives - they want to make money, so they are naturally going to encourage new versions over old and deprecate support for old programs. 2a. If your company of choice has not great business they have an active incentive to sell your data (including bank passwords) on the black market. 3. A need to keep "Up to date" i.e. jam whatever hot takes into your app to up the selling appeal - you want your security to be very boring, having a bunch of new features mixed into every release is a recipe for insecurity and disaster. 4. Cloud access - this leads on from the last point, but as soon as you store your stuff on a third party server, even encrypted, your potential leaks go from your computer, to every device between you and the remote, and then some (all third party integrations). Which has the side effect, said companies must start (complex) security auditing practices with all the fun and failure points that brings...
Now, even on the open source side:
1. As soon as you have to update your password manager, you might as well throw away all passwords and start over: a) Can you really trust that no source was beached during the update? b) How do you know it is even a legitimate update? Better not have put your password for updating things in your password manager... c) It's open source, great, so you can audit it but...will you? d) Or will you just trust it and because some guy who wasn't getting paid and is trying to get through school and hold a part time job missed a critical bug, you end up with all your passwords compromised anyways. 2) Deserves status as its own point, Open Source is auditable but not necessarily trustworthy, not without a lot of active oversight.
As such, one can conclude that such programs are mostly collosal wastes of time, if not actively endagering security.
Even as a 'better than nothing', they are a bad idea, to the layfolk who don't know any better its just another potential bad practice they are getting drilled into them.
I would argue that writing down passwords on paper is usually a better practice than using a password manager, at least that can be locked up in your home (and if you can get into my home I have other bigger worries).
Instead we should focus on giving back some responsibility to the user - most sites don't need passwords, if you are using a password manager for those sites you should presume that password is low security.
It would be better if we could codify the importance of a password somehow.
Re: Entropy isn't sufficient to measure password strength
#49Earlier quoted context omitted.
The point of public key cryptography is that there isn't a shared secret.
While technically correct, a private key will usually need to be encrypted to provide adequate security. From the user point of view, they will still need to remember the password to unlock this private key.
Further to this point, the shared item is moved to a public key and the infrastructure to facilitate communication. Such that it is not a panacea. Getting away from trust in the system is...
Likely you will envision a system to register your key. And then you have to have a bootstrap to authenticate to this system. Probably a password.
Re: Entropy isn't sufficient to measure password strength
#50When will we stop using passwords?! They are an elementary school kid “secret club” game taken way, way too far. They are totally broken. Nobody can come up with and remember good passwords. Nobody can store passwords securely. 100% busted. Instead of continuing to debate what makes a good password, we need to put our energy into better techniques altogether! No more shared secrets! Let’s talk about one-time codes, a…
> Nobody can store passwords securely. 100% busted. [...] Let’s talk about > one-time codes One-time codes rely on a password: either it is stored in your 2FA App, or they rely on your email password, or they rely you storing a password somewhere else. OTP rely on stored secrets. You can make these secrets be much larger than the humble password and call them "private keys" : > asymmetric key cryptography, hardware t…
I don't actually think passwords are broken at all - I mostly used to see this from people pushing biometrics or hardware tokens (people selling stuff).
How we use them, is very much broken. What is the point of a password that a bit of social engineering can bypass? Why are passwords required to get info on my ice cream rewards? Shouldn't I just get a coupon instead?
You should only use passwords that mean something and they should not be resetable, otherwise you have something closer to a one time token with a replay attack. Forget the password? Tough luck. Either it should not have needed one, or it should have some tangible effect which causes the user to highly value forgetting or getting it stolen.
We have engineered a state where we can't remember passwords because we are actively encouraged to ignore them, passwords are fine, how and when we use them is not.