Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop forcing arbitrary password rules

ryanwinchester.ca

Post reply on HN
Print view View original

81–90 of 196 posts

Re: Stop forcing arbitrary password rules

#81

Post by ErrantX »

gambiting wrote: post #42
ErrantX wrote: post #4

Argh! The XKCD entropy comic. Back away slowly.. The "4 common words" password meme was around a lot after that comic. However, such passwords are definitely not secure because a good dictionary attack will break it in hours. You do not have as much entropy as you think with them. The same problem tangentially applies to his suggested password schema to. The problem is: as soon as you start using human word or pseudo…

No. For a dictionary attack, someone would need to know that you are using words. They would need to know if they are separated by spaces, or dots or slashes. The probability of someone knowing your personal scheme is fantastically low, unless they already know one of your other passwords and can guess it. A password like: "Żółć zżółkła w gąszczu fantazyji!" Is absolutely impossible to crack in any reasonable amount…

What you're actually doing there, though, is applying security through statistics.

No, an attacker will not know your schema. But she will know all about the common schemas. And you're risking her using your schema in her attacks.

Your proposed password is much better than the one XKCD's proposes because you're using uncommon words and punctuation. And I agree, it's more secure.

Re: Stop forcing arbitrary password rules

#82

Post by netheril96 »

microtonal wrote: post #45
xixixao wrote: post #41

Earlier quoted context omitted.

More importantly, you just replaced the problems of virtual keys with the problems of physical keys: you can lose them. Recovery is much more difficult than recovery of a virtual key.

With keys such as a U2F key, you can use it for multiple sites (each site will have a site-specific keypair). Most sites allow you to associate multiple U2F keys as well. Since U2F keys typically cost 7 to 15 Euro, it's really not much of a problem to buy one for use and to put one as a backup in a fire-proof safe. That said, I think it's bad to rely on one factor. If the key gets stolen, security is compromised. The…

People in developing countries probably won't ever buy a U2F key. 7 to 15 Euros are too expensive for them (and me).

Re: Stop forcing arbitrary password rules

#83

Post by Natanael_L »

chris_wot wrote: post #77

I've been wondering about password complexity for a while now. If a password is cryptographically hashed, so long as it isn't a dictionary word or date, why on earth do people add in complexity rules that prevent arbitrary character sequences? What I'm getting at here is that if you had a 8 character password (for the sake of the example), and you can type in lowercase letters, uppercase letters, numbers and punctuat…

They assume people are using short stupid 90's style password rules. Which many unfortunately are...

Re: Stop forcing arbitrary password rules

#84

Post by aianus »

codedokode wrote: post #63
whyoh wrote: post #59

Earlier quoted context omitted.

No doubt a lot of people suck at password management, but with proper management it's easier for a thief to steal a hardware key. Or a phone. Which is why I hate that some new services require a phone number for authentication.

I don't think so. Stealing passwords from password manager with a trojan software is much easier (and safer) than breaking into somebody's house. In some countries you can even get shot for that. You can say the same about credit cards: they can easily be lost, stolen etc. But generally they are better protected than internet bank account with just a password. And the most appealing point is ease of use. Inserting a…

> You can say the same about credit cards: they can easily be lost, stolen etc. But generally they are better protected than internet bank account with just a password.

I've physically lost one credit card and had multiple ones canceled unilaterally by the bank because some idiot merchant got hacked. On the other hand (afaik) I've never lost any bitcoin or any bank logins/passwords that were fully under my control.

Re: Stop forcing arbitrary password rules

#85

Post by [deleted] »

lhecker wrote: post #22

I completely agree with the author, but... what he completely misses is the biggest annoyance: maximum length rules. I'd probably sacrifice my firstborn if Microsoft would finally wake up and accept passwords longer than 16 goddamn characters...

[deleted]

Re: Stop forcing arbitrary password rules

#86

Post by chris_wot »

Natanael_L wrote: post #83
chris_wot wrote: post #77

I've been wondering about password complexity for a while now. If a password is cryptographically hashed, so long as it isn't a dictionary word or date, why on earth do people add in complexity rules that prevent arbitrary character sequences? What I'm getting at here is that if you had a 8 character password (for the sake of the example), and you can type in lowercase letters, uppercase letters, numbers and punctuat…

They assume people are using short stupid 90's style password rules. Which many unfortunately are...

Not following...

Re: Stop forcing arbitrary password rules

#88

Post by aianus »

ErrantX wrote: post #74
desdiv wrote: post #10

Earlier quoted context omitted.

Can you explain why the XKCD scheme is weak to dictionary attacks? Using the 2048 common words example from the comic, there would be 2048^4 = 1.8e13 four word combinations. I don't see any possible attack that's faster than brute-force here.

Of course, it's not the worst schema. But it gets a lot more credit than it is worth. Using dictionary words reduces the entropy of your password significantly. And for a cracker it can be trivial to attack passwords of that form. Given the sort of compute power you can obtain cheaply nowadays, attacking 4-word schemas (especially given people tend to use common words) is not hard. It's to some degree security throug…

> especially given people tend to use common words

You don't pick the words yourself, you choose them at random. That's the whole point.

> Given the sort of compute power you can obtain cheaply nowadays, attacking 4-word schemas (especially given people tend to use common words) is not hard.

If the password is hashed with bcrypt with a work factor of 10 (the default in Rails), it would take ~5500 years to crack a single xkcd-style password on a single modern CPU core. Maybe 4 words aren't enough to protect you from the NSA, but they're enough to protect you from Joe Botnet and his db dump.

Re: Stop forcing arbitrary password rules

#89

Post by DanBC »

chris_wot wrote: post #77

I've been wondering about password complexity for a while now. If a password is cryptographically hashed, so long as it isn't a dictionary word or date, why on earth do people add in complexity rules that prevent arbitrary character sequences? What I'm getting at here is that if you had a 8 character password (for the sake of the example), and you can type in lowercase letters, uppercase letters, numbers and punctuat…

People still think rainbow tables are a thing. So they add complexity to make rainbow tables too huge.

Re: Stop forcing arbitrary password rules

#90

Post by chris_wot »

Natanael_L wrote: post #87
chris_wot wrote: post #86

Earlier quoted context omitted.

Not following...

Stuff like aaa123

Well, if you put in xuui-659995!?)) then it won't let you use this either. How does that make any sense?

Edit: In fact, interestingly I used a pseudo-"random" generator made up in my brain. And there you have a big problem - I couldn't help myself but I grouped letters, numbers and special characters.

I have to ask - if most of us do this, as we pick our own passwords, then don't we by our very nature make it easier to crack our own passwords?

Post reply on HN