Myths of Password Security
stormpath.com
Myths of Password Security
1–10 of 52 posts
Re: Myths of Password Security
#2This is a bit of a fluff piece, isn't it? All five points are "true", to some degree, but not when you consider the details.
Take point #4:
> "4. MYTH: Two-Factor Auth Means Any Password Will Do" > > This is absolutely not a dismissal of multi-factor auth. Use it when it’s available! Two factor is on the Stormpath roadmap, and we use it for many backend systems. Just don’t consider it a substitute for strong passwords.
The example that the OP blithely cites is Cloudflare's incident in 2012, when CloudFlare's CEO explained how his GMail account got compromised despite activating 2-factor authentication. However, if you actually click through the post, you see that CloudFlare's problem had nothing to do with a weak password, but a flaw in AT&T's authentication procedures which allowed a hacker to bypass GMail's password/auth requirement with a little social engineering. It had nothing to do with the CF CEO's password, which he says was strong and 20-characters long. In his case, it wouldn't matter if the password was 8 characters long and a dictionary word, if 2-factor auth worked as it was supposed to.
http://blog.cloudflare.com/post-mortem-todays-attack-apparen...
And that's kind of the whole dilemma of security, isn't it? That certain maxims ("Your password should be x characters long and contain y different kinds of characters") do not universally apply, and that the implementation of security protocols is extremely important into understanding your potential to be hacked. The OP's mythbusting is somewhat counter-productive here.
Re: Myths of Password Security
#3I like how Myth 1 tells us long passwords are better than complex passwords then Myth 3 complains that Microsoft rate the long but non-complex password "jjjjjjjjjjjjjjjjjjjjjjjjjjj" highly
Re: Myths of Password Security
#4I like how Myth 1 tells us long passwords are better than complex passwords then Myth 3 complains that Microsoft rate the long but non-complex password "jjjjjjjjjjjjjjjjjjjjjjjjjjj" highly
They aren't contradictory. While this is, as someone else stated, a "fluff piece", neither b4#L or aaaaaaaaaaaaaaaaaaaaaaaaaaa are necessarily secure passwords. It's a gradient.
Having said that, does any cracker even try for something like jjjjjjjjjjjjjjjjjjjjjjjjjjj? If I were trying to brute force password, I would think that such a password would be relatively safe simply because it's such an irregular pattern.
Re: Myths of Password Security
#5>Simply put, adding length increases entropy more efficiently than replacing letters with symbols.
I don't like this meme. Because it's not necessarily "more efficient." Like most things, it depends. If I have a password made of 10 lowercase characters, it's much better to replace with an upper case character rather than add another lower case one.
Option 1) Add a lower case character. Password is 26 times stronger.
Option 2) Replace 1 upper with 1 lower case character. Password is 1024 times stronger.
Re: Myths of Password Security
#6I like how Myth 1 tells us long passwords are better than complex passwords then Myth 3 complains that Microsoft rate the long but non-complex password "jjjjjjjjjjjjjjjjjjjjjjjjjjj" highly
> It is also important for users to use random text in passwords, [...] repeating characters [...] are expected – the opposite of random.
Re: Myths of Password Security
#7I like how Myth 1 tells us long passwords are better than complex passwords then Myth 3 complains that Microsoft rate the long but non-complex password "jjjjjjjjjjjjjjjjjjjjjjjjjjj" highly
They aren't contradictory. While this is, as someone else stated, a "fluff piece", neither b4#L or aaaaaaaaaaaaaaaaaaaaaaaaaaa are necessarily secure passwords. It's a gradient. Having said that, does any cracker even try for something like jjjjjjjjjjjjjjjjjjjjjjjjjjj? If I were trying to brute force password, I would think that such a password would be relatively safe simply because it's such an irregular pattern.
>Having said that, does any cracker even try for something like jjjjjjjjjjjjjjjjjjjjjjjjjjj? If I were trying to brute force password, I would think that such a password would be relatively safe simply because it's such an irregular pattern.
Here's my response to that: https://news.ycombinator.com/item?id=5546741
tldr: I could try all repeating characters so fricking fast it would be worth it to build into a cracker.
Re: Myths of Password Security
#8>Simply put, adding length increases entropy more efficiently than replacing letters with symbols. I don't like this meme. Because it's not necessarily "more efficient." Like most things, it depends. If I have a password made of 10 lowercase characters, it's much better to replace with an upper case character rather than add another lower case one. Option 1) Add a lower case character. Password is 26 times stronger.…
What you say is true if attackers know the composition of your password: If the system provided them with some sort of hints telling them how many upper, lower, digits and special characters existed in the password.
Hopefully such systems don't exist.
Instead most attackers have to run through the obvious, then through brute forcing against the known character set.
Re: Myths of Password Security
#9Earlier quoted context omitted.
They aren't contradictory. While this is, as someone else stated, a "fluff piece", neither b4#L or aaaaaaaaaaaaaaaaaaaaaaaaaaa are necessarily secure passwords. It's a gradient. Having said that, does any cracker even try for something like jjjjjjjjjjjjjjjjjjjjjjjjjjj? If I were trying to brute force password, I would think that such a password would be relatively safe simply because it's such an irregular pattern.
>Having said that, does any cracker even try for something like jjjjjjjjjjjjjjjjjjjjjjjjjjj? If I were trying to brute force password, I would think that such a password would be relatively safe simply because it's such an irregular pattern. Here's my response to that: https://news.ycombinator.com/item?id=5546741 tldr: I could try all repeating characters so fricking fast it would be worth it to build into a cracker.
tldr: I could try all repeating characters so fricking fast it would be worth it to build into a cracker.
In the context of this discussion, of course we'll all say that. Does any actual cracker program try for that, though? Not to my knowledge.
Re: Myths of Password Security
#10>Simply put, adding length increases entropy more efficiently than replacing letters with symbols. I don't like this meme. Because it's not necessarily "more efficient." Like most things, it depends. If I have a password made of 10 lowercase characters, it's much better to replace with an upper case character rather than add another lower case one. Option 1) Add a lower case character. Password is 26 times stronger.…
What you say is true if attackers know the composition of your password: If the system provided them with some sort of hints telling them how many upper, lower, digits and special characters existed in the password. Hopefully such systems don't exist. Instead most attackers have to run through the obvious, then through brute forcing against the known character set.
[deleted]