Password Security: Why the horse battery staple is not correct

Post by dllthomas » Tue, Oct 14, 2014, 1:49 PM UTC

tsotha wrote: post #90

dllthomas wrote: post #89

Earlier quoted context omitted.

Well, you could. Whether you should depends on the context, including importance of security, importance of institutional stability, other available mechanisms for punishment, &c... But honestly, I mostly just thought the inconsistency between your two figures was amusing.

The inconsistency is a result of the fact that that number came from a one-time, expensive, intrusive audit that necessarily covered a subset of all our people. Even then we didn't go through anyone's wallet where I would expect to find at least that many. After that the password policy was substantially relaxed so people could remember them more easily, and dire warnings were issued about writing them (and safe comb…

Well, wallet is a much better place than desk drawer.

https://www.schneier.com/blog/archives/2005/06/write_down_yo...

Still may or may not be acceptable, depending on context.

Post by tempestn » Wed, Oct 15, 2014, 12:47 AM UTC

vegedor wrote: post #85

tempestn wrote: post #57

Earlier quoted context omitted.

I've found banks on average to be absolutely terrible with password security. I mentioned in another comment, my bank requires a password of exactly six characters, alphanumeric only. It's like they're trying to make it as crackable as possible. (I believe the reasoning is that they want you to be able to enter it for telephone banking using a touch tone phone, but obviously it would be far better to use a separate p…

If you only have three attempts entering the PW, how is that remarkably insecure?

If you only have three attempts to enter a password, even most dictionary words are secure. The problem is when the unexpected happens, and someone finds a way around that restriction. In the worst case that might mean getting a hold of a copy of password hashes. Or it might just be an exploit that lets them try more combinations over the internet. Regardless, just because there are other safeguards in place doesn't mean that password strength should be ignored.

As far as why exactly six alphanumeric characters is bad, it should be obvious, but it significantly reduces the difficulty of brute-forcing. You have 2B possibilities, total, not even taking into account dictionary attacks, which also become far easier.

Re: Password Security: Why the horse battery staple is not correct

Re: Password Security: Why the horse battery staple is not correct