Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

networkworld.com

Post reply on HN
Print view View original

61–70 of 96 posts

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#61

Post by GrinningFool »

oniony wrote: post #39
jeremysmyth wrote: post #4

This method fails as soon as you have to change a password: - One of the sites is compromised - One of your devices is stolen/lost and you have to change some passwords - One of the sites has a password expiration policy Pretty soon you end up with multiple password schemes and you're in precisely the same situation as before, wondering which password goes with which site, only this time you have to perform algorithm…

Even if none of the sites are compromised; even if your device is not stolen or lost; even if the sites don't use password expiration it doesn't work very well because some sites are just plain stupid with their password restrictions. Some of the things you'll face: • Passwords that prevent double characters within the password: not ideal when using a scheme. • Passwords with a minimum/maximum length: I've seen sites…

Maximum length tops my list of favorite restriction, because it strongly suggests that they're keeping my password in the clear somewhere - or they used to, and just never got around to changing it.

The concept of illegal characters is tied for second. If you're handling it right, there should be no such thing - yet so many sites continue to set arbitrary limitations for reasons that aren't clear even to them.

Kind of wish I could just generate private keys for each site and not think about it anymore. (Yes, I know there are some convoluted ways to do this, but they're not particularly usable.)

THe best part is that even so many new and/or modern sites enforce the same arbitrary requirements.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#64

Post by benplumley »

borkabrak wrote: post #47
Flavius wrote: post #36

Earlier quoted context omitted.

They are probably not the "ultimate solution", but anything that starts with "You'll need to practice ahead of time..." is not even worth considering.

I can't think of a reason to agree with this. Would you like to provide some?

Any scheme I'm going to replace my current password scheme with (whatever that might be) must be both secure and convenient. A scheme which I must invest time into 'practicing' is not convenient.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#65

Post by taco_emoji »

jjoonathan wrote: post #45
wingerlang wrote: post #33

Earlier quoted context omitted.

As someone who has used passwords based on the website names for a long time, this has been an issue maybe 3 times, in total.

How long is "a long time"? Because over the year or so I gave sitename-passwords a try it popped up as an issue way more than 3 times, even after I started ignoring subdomains and instituted rules about always trying to use the main domain for big companies. There are tons of systems out there that use cross-domain (notably both of my banks and both of my schools), hidden-domain (i.e. log into an app or device where…

I use KeePass + Dropbox across Windows, Mac, and Android.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#66

Post by kragen »

msellout wrote: post #56
redblacktree wrote: post #54

Earlier quoted context omitted.

> maximum length This one really grinds my gears because it also indicates that they're most likely storing your password in the clear. Hashes are all the same length.

Or worse, if they ask you to type your password into a phone keypad (eg. the 9 button stands in for [9w-zW-Z] and 0 for all punctuation). Not only does this mean they're storing your password in plaintext, but reducing the character set to just 0-9. A major financial company does this, of all the terrible places.

It doesn't imply they're storing your password in plaintext, no.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#67

Post by mikeash »

kragen wrote: post #66
msellout wrote: post #56

Earlier quoted context omitted.

Or worse, if they ask you to type your password into a phone keypad (eg. the 9 button stands in for [9w-zW-Z] and 0 for all punctuation). Not only does this mean they're storing your password in plaintext, but reducing the character set to just 0-9. A major financial company does this, of all the terrible places.

It doesn't imply they're storing your password in plaintext, no.

It doesn't guarantee it, but it does imply it pretty heavily.

The alternative is that they're smart enough to come up with a clever scheme like hashing your password in both its raw form and when converted to 0-9, but not smart enough to realize how converting your password to 0-9 makes it vastly less secure.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#68

Post by mikeash »

raverbashing wrote: post #15
drinchev wrote: post #13

I try to ignore articles like this and I'm surprised that this was written in 2015. As @jeremysmyth noted this method is flawed. There's no solution for passwords today, better than the password manager. People reading this article, should not consider Manuel Blum's idea as use-worthy.

Password managers have a central point of failure, either it's breached or its password/data is lost I can trust a password manager, but I would keep an offline physical backup, and they're not the 'ultimate solution'

What's the central point of failure for my 1Password vault?

It's stored on four of my devices. It's stored on Dropbox as well, but a compromise of Dropbox won't give the attacker anything because it uses secure crypto and I have a strong master password.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#69

Post by TheAceOfHearts »

GrinningFool wrote: post #61
oniony wrote: post #39

Earlier quoted context omitted.

Even if none of the sites are compromised; even if your device is not stolen or lost; even if the sites don't use password expiration it doesn't work very well because some sites are just plain stupid with their password restrictions. Some of the things you'll face: • Passwords that prevent double characters within the password: not ideal when using a scheme. • Passwords with a minimum/maximum length: I've seen sites…

Maximum length tops my list of favorite restriction, because it strongly suggests that they're keeping my password in the clear somewhere - or they used to, and just never got around to changing it. The concept of illegal characters is tied for second. If you're handling it right, there should be no such thing - yet so many sites continue to set arbitrary limitations for reasons that aren't clear even to them. Kind o…

I totally get what you mean, but setting an upper limit on fields is generally a good idea. Setting the limit too low sucks, but you don't really want to accept, e.g. 1MB passwords.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#70

Post by kragen »

mikeash wrote: post #67
kragen wrote: post #66

Earlier quoted context omitted.

It doesn't imply they're storing your password in plaintext, no.

It doesn't guarantee it, but it does imply it pretty heavily. The alternative is that they're smart enough to come up with a clever scheme like hashing your password in both its raw form and when converted to 0-9, but not smart enough to realize how converting your password to 0-9 makes it vastly less secure.

No, it's easy for them to convert your password to 0-9 when you enter it on a regular keyboard, before hashing it. It does make it vastly less secure, yes, but it doesn't imply plaintext storage.
Post reply on HN