Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

431–440 of 447 posts

Re: I hate password rules

#431

Post by fsflover »

latchkey wrote: post #415
fsflover wrote: post #397

Earlier quoted context omitted.

Actually, it's not just paranoia, also convenience. Qubes allows very convenient separation of different parts of your digital life, like personal files/apps from working ones and from random internet surfing. Also, IMHO it's more convenient to copy-paste passwords without an actual password manager. More details: https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15

> Were you ever concerned about opening your online banking/entering your credit card in the same browser where you go to random websites? Nope. This is from the late 90's when we started entering credit cards and people thought it would be unsafe. In reality, the credit card companies have covered these charges forever now. Otherwise, we wouldn't be using them today. > Are you tired of remembering tens of complicate…

Thanks for the feedback, I will think how to improve that.

Re: I hate password rules

#432

Post by vbrandl »

jjk166 wrote: post #430
gspencley wrote: post #414

Earlier quoted context omitted.

The funnier thing about that story is that the passphrase they gave you is not necessarily secure in the first place if we're talking about a scenario where a hash is found. While length is a factor when brute forcing randomness, any words or phrases that commonly appear together in written text are likely to come up in various types of dictionaries that can be used in more sophisticated brute forcing algorithms. "sl…

Really the key is using words that aren't in a dictionary, or at least not the same dictionary. It's pretty trivial for a brute force attack to just take a list of English words and try them in a large number of combinations. But if you have some non-english words, as far as that attacker is concerned its random gibberish. Of course the attacker might use a few languages so just mixing say english and spanish won't d…

Here is a small back of the envelope calculation. Websters dictionary includes 470.000 words [0]. 52 lower and uppercase letters + 10 digits + ~20 special chars = 82 possibilities. There are are 82^20 = 1.89 * 10^38 possible combinations for passwords consisting of 20 random characters. Picking 7 random words from Websters dictionary has 470.000^7 = 5.07 * 10^39 possible combinations. I'd argue that remembering 7 words is easier for most people, than remembering 20 random characters.

[0]: https://www.merriam-webster.com/help/faq-how-many-english-wo...

Re: I hate password rules

#433

Post by jjcm »

perryizgr8 wrote: post #381
jjcm wrote: post #108

Here's how I do passwords - require a certain amount of entropy, and compare vs common passwords on the backend. That's it. Here's a gif of it in action: http://files.jjcm.org/password.gif And an example webcomponent that implements this: https://github.com/jjcm/soci-frontend/blob/master/components... The ENTROPY_REQUIREMENT variable means you need a password that has at least 2^n possible combinations, given the cha…

Although this is brilliant, I am worried that most non-technical people will mistake the circle for counting the length of the password.

Which likely is fine. Adding length is a perfectly valid way to add entropy. If they happen to add a special character, it will just complete it faster.

Re: I hate password rules

#434

Post by ttepasse »

m-p-3 wrote: post #308

I hate those requirements, but if at least they were enumerated in a programmatic manner, for example through a RegEx or password field parameters then a password manager could read those and offer a generated password that fits those requirements.

Safari did something in that regard in 2018 and proposed a passwordrules attribute with a mini description language:

• https://github.com/whatwg/html/issues/3518

• https://developer.apple.com/documentation/security/password_...

• https://developer.apple.com/password-rules/

Re: I hate password rules

#435

Post by toto444 »

Arrath wrote: post #416
toto444 wrote: post #395

Earlier quoted context omitted.

I don't write down most of my passwords so every time I log in I do a password reset. It is mainly out of laziness not for a security purpose.

Wow, to each their own! For me this would be a nightmare and just lead to confusion as I would eventually find the distinction between the previous password and the latest one to be murky.

I just type passphrase in duckduckgo. It returns 4 random words.

Re: I hate password rules

#436

Post by SapporoChris »

leksak wrote: post #404
SapporoChris wrote: post #360

Earlier quoted context omitted.

Prepare for failure. A good rule, but painful is: The more income tied to an account the greater the difficulty to move the income. I'm too tired to list best practices but for example: Set up canaries, daily emails from your account just for the peace of mind that your email is the primary communication for the account. Biggest assets should take time and multiple steps to transfer or cashout. Know your account mana…

Hi, I hope this doesn't come across as me not respecting your tiredness but could you link or anything to best practices if you don't have the energy to write it out yourself?

Well, I will try. First, I was commenting on my interpretation of the parent comment. Identify theft, and protecting savings and retirement accounts.

Be inquisitive and aware. I think you have this covered by reading hacker news and having an interest in the subject. I've enjoyed reading Slashdot (while it was good) before switching to hacker news, but it's also been a vital ongoing education for me. Comments often having more value than the original article. Being knowledgeable of security risks and common exploits helps prevent falling victim to them.

https://hn.algolia.com/?q=identity+theft

https://www.newyorksecuritieslawyersblog.com/my-money-was-st... Good read on how someone lost their account.

Steps for securing accounts. Confirm that you are notified of email address changes. Confirm that you are notified of any transactions on the account. Setting up a canary if possible. I set up an email alert on a common event. So, I basically I get an email from the company daily, and this confirms that my email address has not been changed. If you are certain you will be contacted if your email address changes then this is not necessary as the email change notification acts as the warning. Have email and phone of account representative that you can contact if there is a problem with the account.

That should be all that is necessary. Now, the day comes, someone has changed your email address. Maybe they even did some transactions. Stay calm, stay professional. Contact your account representative and notify them of the problem. Be able to identify yourself, call from a phone number associated with the account (or previously associated). Be able to answer security questions. Account representative should be able to freeze the account and resolve any issues. If you're satisfied with the phone call, great. If you're in anyway nervous about the resolution, then create a paper trail, send a letter that documents the issue and your attempts to resolve it.

A quick disclaimer, I'm not an expert. Adjust anything to fit your own needs.

Re: I hate password rules

#437

Post by johnisgood »

justusw wrote: post #386
throwawayboise wrote: post #46

Earlier quoted context omitted.

Supermicro BMC passwords do that. Recently (i.e. this year) I set up a bunch of servers and was setting the BMC password to a known value. Apparently there is a limit of 20 characters for the password. The password I set was 21 characters (which was accepted without error). When I tried to log in with this password, the login was rejected. However if I log in with just the first 20 characters of the password, it work…

Could that mean that the password is stored unhashed?

Since the number of characters is the same in the case of hashes, yes, the password is saved as-is.

Re: I hate password rules

#438

Post by jjk166 »

vbrandl wrote: post #432
jjk166 wrote: post #430

Earlier quoted context omitted.

Really the key is using words that aren't in a dictionary, or at least not the same dictionary. It's pretty trivial for a brute force attack to just take a list of English words and try them in a large number of combinations. But if you have some non-english words, as far as that attacker is concerned its random gibberish. Of course the attacker might use a few languages so just mixing say english and spanish won't d…

Here is a small back of the envelope calculation. Websters dictionary includes 470.000 words [0]. 52 lower and uppercase letters + 10 digits + ~20 special chars = 82 possibilities. There are are 82^20 = 1.89 * 10^38 possible combinations for passwords consisting of 20 random characters. Picking 7 random words from Websters dictionary has 470.000^7 = 5.07 * 10^39 possible combinations. I'd argue that remembering 7 wor…

Yeah, for a given level of entropy words are a better choice, but the fact is that dictionary attacks greatly reduce the efficacy of what could be an incredibly strong password if they can safely assume it is formed exclusively from concoctenated standard words. However if you break the validity of that assumption by using a word that's not on a list, then the dictionary attack must be combined with a brute force attack with the same string length. If we assume an average word length of 5 letters, that 7 word password jumps to 1.22x10^79 possible combinations if you randomly substitute one letter.

Re: I hate password rules

#439

Post by Sohcahtoa82 »

logfromblammo wrote: post #420
Sohcahtoa82 wrote: post #151

Earlier quoted context omitted.

Ad-hoc, this is correct. But at the time of the password change, no, assuming password changing requires you to enter your current password as well.

The password-change form should be using a password field, and that should not be allowing any code or scripts to grab the plaintext stored in it. If the code that compares your current password to the new password can read the plaintext of your passwords, so too could a malicious program. Using HTML input type="password" alone is not sufficient protection. The same steps that protect password changes from malicious…

The check is done server-side.

At the time of a password change, the server still has your old password hash stored, and in the process of changing it, you are sending both your old password and new password. The server can verify both that your new password and old password differ enough while also verifying that the old password you sent it is valid.

Re: I hate password rules

#440

Post by yung_steezy »

5e92cb50239222b wrote: post #403
lmilcin wrote: post #273

Earlier quoted context omitted.

A few years back, on day 1 of my new job I was given root access to one of the development boxes. So I ask: "Okay, how do I log in?" The IT guy: "What do you mean, you just log in using your personal domain account and then sudo su -. You know what sudo is?" (followed by loud sigh) Me: "You mean like production domain, same that we use for our desktop?" IT guy: "Of course! What do you mean, what other domain would yo…

>sudo su - It's high time for this thing to die. sudo supports this natively since forever: $ sudo -i

su is old fashioned but it works fine. I don't even have sudo installed on my PC.
Post reply on HN