Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Security: Why the horse battery staple is not correct

diogomonica.com

Post reply on HN
Print view View original

81–90 of 92 posts

Re: Password Security: Why the horse battery staple is not correct

#81

Post by cantankerous »

dllthomas wrote: post #78
ZenoArrow wrote: post #25

Earlier quoted context omitted.

Exactly. Ironically it's good advice for master passwords too. I use a password manager, but we should recognise there is one prominent issue with them, in that they create a single point of failure. The article suggests that the strength of algorithms like scrypt will keep you safe, but that doesn't stop low tech hacking methods (key loggers, shoulder surfing, etc...). We should be looking at using master passwords…

And possibly a handful of master passwords (and handful of dongles) of various levels of security. I'd rather not unlock my bank info every time I want to log into facebook.

This is a good point, and one I've wondered about since using LastPass. Having a segmented password safe would be nice for more secure accounts you use less often. I definitely wouldn't like to leave my password safe open in, say, a library.

Re: Password Security: Why the horse battery staple is not correct

#82

Post by lisper »

arnarbi wrote: post #65
lisper wrote: post #38

Maybe this would be a good time to plug my proposed solution to this problem: http://dswi.net/

Could you give a short explanation of the differences to BrowserId? Are the keys tied to origins? If so, how is that enforced? If not, how do you address the privacy issue of origins tracking you through your key?

> Could you give a short explanation of the differences to BrowserId?

DSSID pre-dates BrowserID. The underlying protocols are essentially the same, except that in BrowserID you have multiple keys and they are bound to email addresses. In the current implementation of DSSID you only have one key (though that could easily be changed) and it isn't bound to anything. You establish the identity of your key simply by using it to sign things.

> Are the keys tied to origins?

No, but again, that could be changed.

> If so, how is that enforced?

That depends on what you mean by "enforced", but the answer is probably that they keys would be stored in a dictionary whose keys are origins.

> If not, how do you address the privacy issue of origins tracking you through your key?

The current implementation is just a proof-of-concept prototype that I put out there several years ago to see if there was any interest in it. There wasn't. But since BrowserID hasn't really caught on I bring it up every now and again. It's a plausible theory that BrowserID hasn't caught on because it's too complicated to deploy, and that DSSID might turn out to be closer to the Right Thing. Its pretty clear that passwords must die sooner or later, preferably sooner.

Re: Password Security: Why the horse battery staple is not correct

#83

Post by Dylan16807 »

tempestn wrote: post #54
dllthomas wrote: post #14

This article includes some good points, but puts them together into something inane. It's true that silly constraints lead to trivial changes that lead to crackable passwords. It's also true that assuming brute force over all character classes included in a password is wrong. Those are precisely what the "correct horse battery staple" comic was getting at. Picking words at random (that is, based on a PRNG - not "rand…

His primary point is that people should not be choosing passwords at all , and should instead use a password manager, except for a select few passwords such as logins for computer and phone, and the password manager master password itself. Yes, the correct horse battery staple has more entropy than most common passwords, but the point is that we don't need a way of generating better memorable passwords. We can alread…

>people should not be choosing passwords

CHBS is a method for generating passwords, not choosing them.

Re: Password Security: Why the horse battery staple is not correct

#84

Post by tempestn »

Dylan16807 wrote: post #83
tempestn wrote: post #54

Earlier quoted context omitted.

His primary point is that people should not be choosing passwords at all , and should instead use a password manager, except for a select few passwords such as logins for computer and phone, and the password manager master password itself. Yes, the correct horse battery staple has more entropy than most common passwords, but the point is that we don't need a way of generating better memorable passwords. We can alread…

>people should not be choosing passwords CHBS is a method for generating passwords, not choosing them.

OK, but its purpose is to generate memorable passwords. The point of the article is that focusing on making passwords memorable is counter-productive, since we shouldn't generally be trying to remember passwords. And if you're not trying to remember it, a string of 16 random characters works fine.

Re: Password Security: Why the horse battery staple is not correct

#85

Post by vegedor »

tempestn wrote: post #57
morgante wrote: post #45

Despite the slightly linkbaity article, I agree with the article's actual premise (you shouldn't be remembering passwords in the first place). Unfortunately, it'd be tough pill to swallow for sites to push/encourage users to get a password manager—you never want to be the site which people bounce from because they don't understand what a password manager is. At the very least, I wish sites would abandon the abhorrent…

I've found banks on average to be absolutely terrible with password security. I mentioned in another comment, my bank requires a password of exactly six characters, alphanumeric only. It's like they're trying to make it as crackable as possible. (I believe the reasoning is that they want you to be able to enter it for telephone banking using a touch tone phone, but obviously it would be far better to use a separate p…

If you only have three attempts entering the PW, how is that remarkably insecure?

Re: Password Security: Why the horse battery staple is not correct

#86

Post by dllthomas »

tempestn wrote: post #84
Dylan16807 wrote: post #83

Earlier quoted context omitted.

>people should not be choosing passwords CHBS is a method for generating passwords, not choosing them.

OK, but its purpose is to generate memorable passwords. The point of the article is that focusing on making passwords memorable is counter-productive, since we shouldn't generally be trying to remember passwords. And if you're not trying to remember it, a string of 16 random characters works fine.

Yes and no. Secure and memorable passwords are still vital for securing your password manager. Having a means to generate them is not counter productive.

Re: Password Security: Why the horse battery staple is not correct

#87

Post by MarkMc »

arnarbi wrote: post #63
MarkMc wrote: post #33

Earlier quoted context omitted.

No. Here are two differences between a password manager and 2FA: 1. A password manager will prevent someone from hacking into a website you use, stealing your password, then logging into another website as you. 2FA won't prevent this because someone who hacks into to a website can get access to the unique random seed that is used to generate the 2FA sequence, and can then use brute-force to determine your password. 2…

Re 1: If a.com is hacked, only a.com's OTP seeds are compromised. b.com should (hopefully) use different seeds, so 2FA still prevents someone from logging in.

Yes you are right - I was thinking about the case where only a.com uses 2FA, not b.com

Re: Password Security: Why the horse battery staple is not correct

#88

Post by tsotha »

dllthomas wrote: post #80
tsotha wrote: post #77

Earlier quoted context omitted.

It doesn't matter if you fire people. You're not going to catch the vast majority of them, and they know it.

From what you said earlier you can catch 70% of them pretty easy.

Sure, if you go through all their stuff. And then what? Do we fire 70% of our staff?

Re: Password Security: Why the horse battery staple is not correct

#89

Post by dllthomas »

tsotha wrote: post #88
dllthomas wrote: post #80

Earlier quoted context omitted.

From what you said earlier you can catch 70% of them pretty easy.

Sure, if you go through all their stuff. And then what? Do we fire 70% of our staff?

Well, you could. Whether you should depends on the context, including importance of security, importance of institutional stability, other available mechanisms for punishment, &c...

But honestly, I mostly just thought the inconsistency between your two figures was amusing.

Re: Password Security: Why the horse battery staple is not correct

#90

Post by tsotha »

dllthomas wrote: post #89
tsotha wrote: post #88

Earlier quoted context omitted.

Sure, if you go through all their stuff. And then what? Do we fire 70% of our staff?

Well, you could. Whether you should depends on the context, including importance of security, importance of institutional stability, other available mechanisms for punishment, &c... But honestly, I mostly just thought the inconsistency between your two figures was amusing.

The inconsistency is a result of the fact that that number came from a one-time, expensive, intrusive audit that necessarily covered a subset of all our people. Even then we didn't go through anyone's wallet where I would expect to find at least that many.

After that the password policy was substantially relaxed so people could remember them more easily, and dire warnings were issued about writing them (and safe combinations) down. I moved on to a new job shortly after, so I'm not sure how much those warnings were taken to heart.

Post reply on HN