Partial password usability sucks

#1

Post by gaevoy » Wed, Mar 06, 2019, 7:06 PM UTC

Partial password usability sucks
gaevoy.com

Re: Partial password usability sucks

#2

Post by springogeek » Wed, Mar 06, 2019, 7:27 PM UTC

This sort of thing needs to be built into password managers.

Re: Partial password usability sucks

#3

Post by jdashg » Wed, Mar 06, 2019, 7:30 PM UTC

"Please enter your password in this mutable github pages page." Eek.

I have a real desire for a document firewall mode where nothing can enter or leave.

Re: Partial password usability sucks

#4

Post by Leace » Wed, Mar 06, 2019, 7:32 PM UTC

springogeek wrote: post #2

This sort of thing needs to be built into password managers.

Agreed but I'd rather they allow normal passwords where you can use the "password you can't remember" and U2F token like civilized people.

Re: Partial password usability sucks

#5

Post by Matterrr » Wed, Mar 06, 2019, 7:34 PM UTC

> Open partial-password.github.io & copy-paste your password there.

Sounds like a great idea, let's all paste our bank passwords in this website!

Banks have peculiar ideas about security sometimes, I don't think this partial password business will have a net positive effect (especially if people use "solutions" like these and potentially send their password to a third party)

Re: Partial password usability sucks

#6

Post by waltbosz » Wed, Mar 06, 2019, 7:38 PM UTC

That's such a strange UI. I couldn't tell you the fifth letter of most words without writing them down, let alone that of my 20 character passwords.

Re: Partial password usability sucks

#7

Post by _asummers » Wed, Mar 06, 2019, 7:40 PM UTC

Perhaps I'm misunderstanding the security model behind this, but why should the site be storing my password's length at all? Why does it know I have a 10th character at all? The site should just have a hash of my password (normalizing the length).

Re: Partial password usability sucks

#8

Post by inetknght » Wed, Mar 06, 2019, 7:42 PM UTC

> The idea is good it gives you an extra layer of protection against password theft (link 1, link 2, link 3).

That sounds obnoxiously insecure on the back-end. Notoriously, the most broken authentication mechanisms used plaintext (or reversibly encrypted) storage. The answers to the three security questions that the article links to also point this out.

Sounds like ING Poland needs to be called out by some security researchers.

[0] https://security.stackexchange.com/a/194818/47800

[1] https://security.stackexchange.com/a/7479/47800

[2] https://security.stackexchange.com/a/196430/47800

Re: Partial password usability sucks

#9

Post by tedunangst » Wed, Mar 06, 2019, 7:43 PM UTC

Make your security policy difficult enough to comply with, and people will find workarounds like pasting their passwords into strangers' websites.

Re: Partial password usability sucks

#10

Post by john-radio » Wed, Mar 06, 2019, 7:44 PM UTC

_asummers wrote: post #7

Perhaps I'm misunderstanding the security model behind this, but why should the site be storing my password's length at all? Why does it know I have a 10th character at all? The site should just have a hash of my password (normalizing the length).

I guess (hope) they just have a collection of patterns that they apply (like (3, 9, 11, 12, 15) from the OP), and when they store your password's hash, they also store the hash of those several characters so that they can present the pattern to you later and check whether you matched the pattern correctly.