Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Security: Why the horse battery staple is not correct

diogomonica.com

Post reply on HN
Print view View original

41–50 of 92 posts

Re: Password Security: Why the horse battery staple is not correct

#41

Post by tsotha »

Retric wrote: post #31
diogomonicapt wrote: post #23

Earlier quoted context omitted.

I agree that the title is more link-baity than it should. For what it's worth, part of it was just a witty title.

Reading that you come off as an idiot who has no idea what there talking about. Password managers are banned from high security applications, because their not secure. That said, the random part of randomly generating a password is an issue, but combining that with something you have is reasonably secure. PS: Some places require a 20+ character password and will fire you on the spot if it's ever written down or store…

Having worked in places with those kinds of rules I can tell you most of those passwords is written down. At one government shop we did an audit and found the longer and and better a password is (and the faster it expires), the more likely users will write it down. Not only that, 70% of them put the written down password in their top right desk drawer.

We also found a large percentage of our fancy two person authentication safes had both combinations written somewhere on the signout sheet.

You can't make peoples' lives too difficult with security directives. They'll start to ignore you no matter how much you threaten them.

Re: Password Security: Why the horse battery staple is not correct

#42

Post by nshepperd »

> For the few passwords they do need to memorize, you should focus on making them dictionary-attack resistant, not just strong from an information theory perspective.

Information theory is exactly how you measure attack resistance (dictionary- and otherwise). The entropy measure in the XKCD comic already takes into account dictionary attacks. That's the point.

Re: Password Security: Why the horse battery staple is not correct

#43

Post by morgante »

Retric wrote: post #31
diogomonicapt wrote: post #23

Earlier quoted context omitted.

I agree that the title is more link-baity than it should. For what it's worth, part of it was just a witty title.

Reading that you come off as an idiot who has no idea what there talking about. Password managers are banned from high security applications, because their not secure. That said, the random part of randomly generating a password is an issue, but combining that with something you have is reasonably secure. PS: Some places require a 20+ character password and will fire you on the spot if it's ever written down or store…

> Password managers are banned from high security applications, because their not secure.

Based on what? I've seen absolutely no evidence that good password managers (1Passoword and its ilk) are insecure.

Re: Password Security: Why the horse battery staple is not correct

#44

Post by dangoor »

techsupporter wrote: post #22
dangoor wrote: post #5

Earlier quoted context omitted.

I've used both LastPass and 1Password and while they're not open source or free, I have enjoyed using them both. I currently use 1Password and find it to be a great experience.

I'd genuinely like to know (and I promise that I'm not going for a vi/emacs discussion), why don't more people use KeePass? Specific to asking you, did you know about KeePass and, if you did know, what turned you away from it? It is both open source and free and, from what I've seen, has a good number of clients. Maybe I'm barking up the wrong tree and the marketing or brand awareness of LastPass and 1Password is muc…

I used KeePass in the distant past. 1Password has terrific usability, especially in my current Apple-product-based computing setup.

For example, the day iOS 8 came out, 1Password had an extension so that Mobile Safari could fill in my passwords.

Re: Password Security: Why the horse battery staple is not correct

#45

Post by morgante »

Despite the slightly linkbaity article, I agree with the article's actual premise (you shouldn't be remembering passwords in the first place).

Unfortunately, it'd be tough pill to swallow for sites to push/encourage users to get a password manager—you never want to be the site which people bounce from because they don't understand what a password manager is.

At the very least, I wish sites would abandon the abhorrent process of disallowing copy & paste. The completely random password my generator supplies is much more secure than me trying to remember a password for your site. Sadly, the sites which fail at this the most are also the ones where security is most important (ex. banks).

Re: Password Security: Why the horse battery staple is not correct

#46

Post by ayrx »

zanny wrote: post #35

Two factor is not a good solution either. Having to lug around your phone pulling up randomly generated strings from an RNG on both ends... defeats the point. Instead of an RNG seed, have a shared secret. Of course, you need a trusted party for that, but that is how oauth and friends work. And how Persona should have worked. Logging in to anything should be clicking login and everything happening behind the scenes, b…

Uhm... The 2FA used in Google Authenticator does use a shared secret. The algorithm is TOTP (RFC 6238). It's simply a HMAC applied on the current unix timestamp with the shared secret as a key and truncated to 6,7,8 digits depending on the implementation.

Re: Password Security: Why the horse battery staple is not correct

#47

Post by foxhill »

whilst i concur with the premise that passwords should die, saying that xkcd-passwords are hence incorrect would be like saying.. hi-dpi monitors are not better than their low-dpi predecessors - we should be using direct computer/brain interfaces.

obviously, xkcd-passwords are an improvement, in many aspects, over the passwords many people tend to pick. but until a reliable, secure, and proven alternative shows up (which i'm hoping it will), there's no need to muddy the what-makes-a-good-password waters.

Re: Password Security: Why the horse battery staple is not correct

#48

Post by Retric »

morgante wrote: post #43
Retric wrote: post #31

Earlier quoted context omitted.

Reading that you come off as an idiot who has no idea what there talking about. Password managers are banned from high security applications, because their not secure. That said, the random part of randomly generating a password is an issue, but combining that with something you have is reasonably secure. PS: Some places require a 20+ character password and will fire you on the spot if it's ever written down or store…

> Password managers are banned from high security applications, because their not secure. Based on what? I've seen absolutely no evidence that good password managers (1Passoword and its ilk) are insecure.

One of the most common failure modes is screen captures which are often used for auditing. So there enabled even when everything is working correctly. For encrypted passwords that are sent directly to the clipboard you still get those files backed up which means you can brute force the password file without throwing up any red flags. Also, pasting passwords is disabled on many secure applications. For apps there stored on an unsecured device with a wide range of failure modes.

Re: Password Security: Why the horse battery staple is not correct

#49

Post by julie1 »

ObviousScience wrote: post #17

Linkbaity title from a PhD student with something to sell: the example cited was entirely correct about password strength, and is something the article author admits is important as it is the underpinning of using password managers. > Even if we entertained the XKCD comic and started training users to select four random words instead of a complex single-word password, I argue that it would not amount to a significant…

I would be strongly relieved learning he failed his PhD in security: his article is a pure FUD.

Why secrets are needed? Because secrets are unpredictable and thus are the signature of a common knowledge that cannot be guessed when checked against randomness.

Every other solutions are scams especially biometry:

- measure can fail; - if something can be measured it can be captured/duplicated.

Security market is based on fear.

I so wished security efficiency was audited based on the number of security holes they cause sometimes.

Re: Password Security: Why the horse battery staple is not correct

#50

Post by Retric »

tsotha wrote: post #41
Retric wrote: post #31

Earlier quoted context omitted.

Reading that you come off as an idiot who has no idea what there talking about. Password managers are banned from high security applications, because their not secure. That said, the random part of randomly generating a password is an issue, but combining that with something you have is reasonably secure. PS: Some places require a 20+ character password and will fire you on the spot if it's ever written down or store…

Having worked in places with those kinds of rules I can tell you most of those passwords is written down. At one government shop we did an audit and found the longer and and better a password is (and the faster it expires), the more likely users will write it down. Not only that, 70% of them put the written down password in their top right desk drawer . We also found a large percentage of our fancy two person authent…

No offence, but if your not going to fire people when you find their password written down then there going to write their password down. Written policies are practically irrelevant it's enforced policies people pay attention to.

One example of security. Someone (A) giving a breafing has someone (B) grabs at it so they can read the document. At which point (A) pulls his sidearm and threatens (B). Later (A) is given an intense debriefing to verify that he was willing to shoot (B) and simply wanted to clarify the situation vs being unwilling to shoot (B). (B) was later told he was lucky not to have been shot.

Post reply on HN