Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lessons from a Professional Password Cracker

themarkup.org

Post reply on HN
Print view View original

41–50 of 138 posts

Re: Lessons from a Professional Password Cracker

#41

Post by sillyinseattle »

gmane wrote: post #17

Hey, I keep seeing people claim biometrics somehow fix the password problem, but I feel like this is just a password you can't change? I can't change my fingerprints nor my retina, but if that data ever gets leaked, then that's vulnerable forever? In my mind, there's no world where one could make a biometric scanner that couldn't be spoofed (presumably with an arduino USB interface) and then when all these corporatio…

> but I feel like this is just a password you can't change

Not quite. IBM has (had?) a research program on "cancelable" biometrics. I do not recall perfectly, but I think they were tweaking the encoded biometric sensor data before committing it to DBs. If there is a leak, one can redo it with a new tweak (like a new salt or nonce).

Re: Lessons from a Professional Password Cracker

#43

Post by mistercow »

hn_throwaway_99 wrote: post #18

> Instead of passwords, we should use something like FIDO, which allows users to log in using a security key or biometric information. The problem "in the real world" is that people will lose these keys all the time . I mean, I agree, passwords need to die, and hopefully some of the work that is being done by Apple and others will help bring on an end to passwords, but you can't really talk about replacing passwords…

This is typically the problem with silver bullet solutions. You can easily look at the solution that’s been in place for decades and see where it fails, because you have decades of data to look at. You look at your new shiny solution, and you can see that it solves all of those problems. What you can’t see, because you don’t have decades of data to look at, are all the new problems that will come up with the new solution. You’ll notice some of them, and you can try to patch over them, but you’re bound to miss a lot.

Which isn’t to say that you shouldn’t go with the new solution anyway. But I’m always skeptical when all people say is “it solves all the existing problems.”

Re: Lessons from a Professional Password Cracker

#44

Post by amlozano »

exhilaration wrote: post #34
arjvik wrote: post #32

Earlier quoted context omitted.

Plus, it would mean people would stop just incrementing a number at the end if it revealed their pattern.

If companies want us to stop incrementing a number (guilty!) or writing our passwords on post-its stuck on our monitors, they should stop requiring us to change our passwords every freaking month. I think it was only in 2021 that NIST suggested the password change frequency should be yearly.

I think NIST has actually recommended against forced rotation of passwords (unless they are breached) since at least 2017.

"Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator."

- NIST SP-800-63B Digital Identity Guidelines - Authentication and Lifecycle Management

--

A large part of me wishes they made this a SHALL NOT. It would have caused chaos with other standards, but it would have been the right thing to do.

Re: Lessons from a Professional Password Cracker

#45

Post by ollifi »

macintux wrote: post #31
jiggawatts wrote: post #7

Some rules of thumb: All Windows passwords shorter than about 10 characters shouldn't be considered secure, as the NT Hash at this point is so easily reversible that it's basically a "light obfuscation" at best. A single GPU can crack all 8-character passwords in minutes. The single best security setting on a Windows network is to increase the minimum password length to something like 14 characters. Use 20+ for privi…

Something I’ve wished companies would do: publish (on an internal site) all of their employees’ previous passwords each time they’re rotated. Users would be compelled to create better passwords out of sheer embarrassment/competitive spirit.

I sort of wish companies would not have employees passwords. Hashing should be standard practice.

Re: Lessons from a Professional Password Cracker

#46

Post by Arainach »

macintux wrote: post #35
vivegi wrote: post #33

Earlier quoted context omitted.

Wouldn't that just be another attack surface? Chances are some of those rotated passwords may be used in other sites and this just exposes the company and the user to additional risk. Not to mention insiders that are bad actors.

It gives added incentive to the company to make sure all of their internal passwords are managed via SSO so the users don’t continue to use a password on non-integrated systems after it’s rotated centrally. And as long as employees are warned in advance, they should be aware of the risk of re-using passwords, which already exists today . If anything, this highlights the fact that if employees are using their company…

Not all sites are customer sites.

I generally use unique passwords for everything, but I worked many years at a company with a 3-month password rotation policy, and coming up with high-entropy yet memorable passwords was sufficient work that many accounts on machines on my home network used some retired passwords from there.

Re: Lessons from a Professional Password Cracker

#48

Post by kajecounterhack »

gmane wrote: post #17

Hey, I keep seeing people claim biometrics somehow fix the password problem, but I feel like this is just a password you can't change? I can't change my fingerprints nor my retina, but if that data ever gets leaked, then that's vulnerable forever? In my mind, there's no world where one could make a biometric scanner that couldn't be spoofed (presumably with an arduino USB interface) and then when all these corporatio…

Yeah biometrics are not password replacement. The solution everyone uses today is "something you have (2fac device) + something you know (password)" -- the 2fac device needs to be a OTP generator, but you could even further secure this by requiring biometrics to generate the OTP (e.g. imagine a security key that refuses to acknowledge touch unless it senses your fingerprint).

Biometrics without the other two doesn't help anyone.

Re: Lessons from a Professional Password Cracker

#49

Post by EnderWT »

macintux wrote: post #31
jiggawatts wrote: post #7

Some rules of thumb: All Windows passwords shorter than about 10 characters shouldn't be considered secure, as the NT Hash at this point is so easily reversible that it's basically a "light obfuscation" at best. A single GPU can crack all 8-character passwords in minutes. The single best security setting on a Windows network is to increase the minimum password length to something like 14 characters. Use 20+ for privi…

Something I’ve wished companies would do: publish (on an internal site) all of their employees’ previous passwords each time they’re rotated. Users would be compelled to create better passwords out of sheer embarrassment/competitive spirit.

You want companies to store passwords in plain text?

Re: Lessons from a Professional Password Cracker

#50

Post by 2Gkashmiri »

jiggawatts wrote: post #7

Some rules of thumb: All Windows passwords shorter than about 10 characters shouldn't be considered secure, as the NT Hash at this point is so easily reversible that it's basically a "light obfuscation" at best. A single GPU can crack all 8-character passwords in minutes. The single best security setting on a Windows network is to increase the minimum password length to something like 14 characters. Use 20+ for privi…

i am forced to use windows machines in my own office. i know people and kids who use windows machines. with new installs, they are being taught to set a password, which is fine for a bank or a super secure machine that holds financial data but for kids and grannies and drone office workers, this gets tiring. Now you are saying to FORCE them to use 14+ characters. HOW? why? in linux there is a "auto login with this password" which i love to use because there is nothing so private in my machine so i can just go in and out
Post reply on HN