Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zxcvbn: realistic password strength estimation

tech.dropbox.com

Post reply on HN
Print view View original

81–90 of 134 posts

Re: Zxcvbn: realistic password strength estimation

#81

Post by jerf »

Garbage wrote: post #59
ashishgandhi wrote: post #15

Earlier quoted context omitted.

Loan word. I can't remember the the Hindi word for "guess" right now. PS: Although I don't remember the exact words but there were some which are strikingly similar in both languages. But I found this for you. http://en.wikipedia.org/wiki/List_of_English_words_of_Hindi_...

Guess = अनुमान , अंदाज़ , अटकल

I'd love to be able to use Unicode in general in my passwords. I've already mapped an interrobang on to my keyboard because I was using it so much I needed a key for it. But who would take it?

(Since someone will ask, yes, there are some accounts I'm willing to limit myself to using one of my personal computers to access, or jumping through significant hoops to get there, like my bank account.)

Re: Zxcvbn: realistic password strength estimation

#82

Post by tzs »

brownbat wrote: post #74
16s wrote: post #37

Many sites won't accept my passwords (SHA1_Pass). They say that they are too long or have inappropriate chars or that they are not complex enough. Here's an example of inappropriate chars: UTP+NnhabgHKx6 So I make a different password and the sites say it is too weak as it has no special chars or uppercase chars: 5133fe36785a6e01cac7a68c9c111afff5bb4821 So I give up and type Password1 which is normally accepted.

My biggest pet peeve is how no one explains their password constraints until you break one of them.

I recently did a password change for some Apple site (iTunes, I think) and they handled this nicely. They put up a box beside the password field that listed the requirements, and as soon as I started typing it started dynamically changing the list to mark the requirements that my current entry did not meet.

Re: Zxcvbn: realistic password strength estimation

#83

Post by taw »

wh-uws wrote: post #39

I have waited for this for so long. I'm glad someone finally took it up and and more importantly that its on a site as popular as dropbox. (this way hopefully the thinking will gain some traction) Every time I'm forced to have a password with 3 or 4 character classes I sigh and think of that xkcd comic Edit: also try typing the password from the xkcd comic here https://www.dropbox.com/register nice touch

correcthorsebatterystaple1 works.

Re: Zxcvbn: realistic password strength estimation

#84

Post by Shank »

The real problem with humans is that passwords are still hard to remember for multiple services. Doesn't matter if you have a secure password and it's used everywhere.

Likewise, if it's used with LastPass or 1Password style services, you face the problem of dealing with entering it. Though a desktop PC is fine for this, the best counter-examples are mobile devices.

LastPass on mobile: 1. Use app that needs a password. 2. Realize password is in LastPass. Exit app, find LastPass. 3. Open LastPass, and login. 4. Copy password. 5. Switch back to the other app. 6. Enter password.

This is so tedious that people are going to re-use some password just for the sake of not having to do the above every time.

Re: Zxcvbn: realistic password strength estimation

#85

Post by Shank »

16s wrote: post #37

Many sites won't accept my passwords (SHA1_Pass). They say that they are too long or have inappropriate chars or that they are not complex enough. Here's an example of inappropriate chars: UTP+NnhabgHKx6 So I make a different password and the sites say it is too weak as it has no special chars or uppercase chars: 5133fe36785a6e01cac7a68c9c111afff5bb4821 So I give up and type Password1 which is normally accepted.

Blizzard please? 13-20 characters, an upper case character, a lower case character, a number and a symbol. I'm not using LastPass here, because battle.net requires me to type that every damn time I start Starcraft.

Re: Zxcvbn: realistic password strength estimation

#86

Post by elithrar »

jstalin wrote: post #78
aidenn0 wrote: post #73

Earlier quoted context omitted.

My solution so far is: cat /dev/urandom|base64|tr -d '/+'|head -c10 Nearly every site supports a-z,A-Z,0-9 at 10 characters

10-character apha-numeric password is crackable in a matter of days: http://whitepixel.zorinaq.com/

> 10-character apha-numeric password is crackable in a matter of days: http://whitepixel.zorinaq.com/

I think the assumption here is that the password isn't an MD5 hash, but instead something a little more resilient. If it's MD5, you're probably screwed anyway.

Re: Zxcvbn: realistic password strength estimation

#87

Post by elithrar »

furyofantares wrote: post #43
impendia wrote: post #27

> One in nine people had a password in this top 500 list. These passwords include some real stumpers: password1, compaq, 7777777, merlin, rosebud. Looks unbelievable at first. How could people be so stupid? But I use such passwords all the time. I use a variety of websites where I have no need or desire for security. Want to post burrito reviews on burritophile.com as me? I picked something simple and easy to guess,…

It always bothers me a bit when I see analysis of password strength for compromised sites without any mention of the possibility that the account might just not be important to users. But there is a caveat. If the account is somehow identifiable as yours (say, because your friends know it's your account) then suddenly it's a possible social attack vector. Perhaps a weak one, but probably not something to be ignored,…

> It always bothers me a bit when I see analysis of password strength for compromised sites without any mention of the possibility that the account might just not be important to users.

I actually use that as a factor when considering a password. If I think the site isn't going to be the most secure (a phpBB forum, or hand-rolled web-app), then I'm more likely to use a simple (but still relatively decent) password.

Re: Zxcvbn: realistic password strength estimation

#88

Post by jstalin »

Game_Ender wrote: post #79
jstalin wrote: post #78

Earlier quoted context omitted.

10-character apha-numeric password is crackable in a matter of days: http://whitepixel.zorinaq.com/

Does that break more then md5? I thought it was well known that md5 was a bad password hash algorithm.

I don't know why an application couldn't also attack other hashing algorithms. It's just about brute force creating lots of hashes.

This app also uses GPUs to brute force TrueCrypt: http://www.golubev.com/igprs/

Re: Zxcvbn: realistic password strength estimation

#89

Post by chimeracoder »

ch0wn wrote: post #53
16s wrote: post #37

Many sites won't accept my passwords (SHA1_Pass). They say that they are too long or have inappropriate chars or that they are not complex enough. Here's an example of inappropriate chars: UTP+NnhabgHKx6 So I make a different password and the sites say it is too weak as it has no special chars or uppercase chars: 5133fe36785a6e01cac7a68c9c111afff5bb4821 So I give up and type Password1 which is normally accepted.

Whenever I come across a site that refuses to let me sign up with a secure password, I either leave right away or send them a short mail first. There were times where I had to rely on password managers too, though. Banking sites are one common place ...

>Banking sites are one common place ...

I can't tell you the number of times I've tried to explain to banks that 'security questions' are absolutely worthless, and that their 'secure password' policy is actually worse than no policy at all.

One bank actually requires passwords to be between 6 and 8 characters in length, with at least one letter and one number and no special characters.

Re: Zxcvbn: realistic password strength estimation

#90

Post by landr0id »

_delirium wrote: post #7
landr0id wrote: post #2

> Bank of America doesn’t allow passwords over 20 characters, disallowing correcthorsebatterystaple. Passwords can contain some symbols, but not & or !, disallowing the other two passwords Can anyone elaborate why "&" or "!" wouldn't be allowed?

A not-very-great but traditional way to avoid some kinds of security holes is to sanitize your input by blacklisting anything that could be a shell/scripting/SQL metacharacter. Seems restrictions like that are still pretty common, either because it's actually still needed for security (alarming if true at BoA), or because it's now a sort of cargo-cult thing.

That's what I had assumed, and I recently started web development so I'm not very educated on some of this stuff, but it seems to me like that could easily be avoided if things are done right. It's a banking site though, so I guess any extra protection to protect those users is good.
Post reply on HN