4 ms·

I think he has a point, but do we really have better alternatives? Soon enough computers will be able to check every possibility for passwords as big as we can

I think he has a point, but do we really have better alternatives? Soon enough computers will be able to check every possibility for passwords as big as we can remember them. With good algorithms predicting what is likely to be a valid password, maybe they already can. Even though I agree fingerprints aren't a good solution, passwords aren't either. Any ideas? Maybe we could have some kind of card that would have big keys stored on it. EDIT: Fixed missing word

_ZeD_ 10y ago
Start using phrases as password. Mix languages.
- egypturnash 10y ago
  Typing out a lengthy phrase on a phone keyboard, without being able to see any visual feedback because the letters are replaced with dots, is an exercise in frustration. I do this on a regular basis because I have an entire sentence as my LastPass passphrase.
  - pmontra 10y ago
    I do the same with keepass. I think it's the best we can do now.
    - egypturnash 10y ago
      I usually hit the "make visible" button on LastPass' password entry slot, to be honest. I usually make sure nobody's got a good view of my phone when I do this. Usually. I should never become a spy, my security technique is laughable.
deleted 10y ago
[deleted]
e12e 10y ago
There are a couple of things here: I think the most important is that without rate-limiting, there are no such things as passwords. There can only be passphrases. That is, if "something you know" is a shared secret, it need to be high entropy, effectively around 128 bits. That's much harder than most people think. You could probably make a list of 256 common, short words that are distinguished by their first two letters[1], but to encode 128 bits of entropy, you'd need 19 words, (or 16 if you managed to get use 512 words). Even if you picked only the first two letters, that's best case 32 characters. It's a lot to type blind, it's a lot to remember, it's complicated to cycle the phrase. So it's better to not have to remember the password - use a password manager. Or, if you could somehow avoid the possibility of off-line attack, and guarantee solid rate-limiting -- much less entropy might be needed. A 4-digit pin is probably on the low side (consider that on a site with ~100.000 users, if you tried any set of three pins, you'd probably compromise many accounts, assuming uniform distribution of pins). Another way, is to continue using a shared secret, but prove knowledge in a different way: eg using TOTP[2]. On the other hand, TOTP shares some of the disadvantages of unsalted passwords: the secrets are stored in plain text both on your one-time token generator (your insecure smartphone), and on the server. On the other hand, they're harder for most users to re-use than passwords are (users typically don't know the secret used to generate one-time passwords). But all these have another problem: how to you protect your secrets? You could use full disk encryption... protected by ... a password? Still, the idea of using a fingerprint for authentication, especially on a device filled with your fingerprints seems like a pretty bad idea. Never mind the fact that once compromised they can never be changed. As for your last point, I do think the combination of something like a yubikey neo[3] along with NFC is probably the sweetspot for practical security right now. You can use it to unlock your smartphone, and your computer. [1] (26^2=512, but not all combinations are common, fitting 256 should probably be possible, even if the more common combination of vowel+consonant is only ~6*20=120. Possibly in combinations with the numbers 1..99) [2] https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_A... [3] https://www.yubico.com/products/yubikey-hardware/yubikey-neo/ https://www.yubico.com/products/yubikey-hardware/yubikey-neo...
vatotemking 10y ago
For a non english speaker, I use a phrase from our native language. The lesser known the language the better.

_ZeD_ 10y ago

Start using phrases as password. Mix languages.

egypturnash 10y ago
Typing out a lengthy phrase on a phone keyboard, without being able to see any visual feedback because the letters are replaced with dots, is an exercise in frustration. I do this on a regular basis because I have an entire sentence as my LastPass passphrase.
- pmontra 10y ago
  I do the same with keepass. I think it's the best we can do now.
  - egypturnash 10y ago
    I usually hit the "make visible" button on LastPass' password entry slot, to be honest. I usually make sure nobody's got a good view of my phone when I do this. Usually. I should never become a spy, my security technique is laughable.

deleted 10y ago

[deleted]

e12e 10y ago

There are a couple of things here: I think the most important is that without rate-limiting, there are no such things as passwords. There can only be passphrases. That is, if "something you know" is a shared secret, it need to be high entropy, effectively around 128 bits. That's much harder than most people think. You could probably make a list of 256 common, short words that are distinguished by their first two letters[1], but to encode 128 bits of entropy, you'd need 19 words, (or 16 if you managed to get use 512 words). Even if you picked only the first two letters, that's best case 32 characters. It's a lot to type blind, it's a lot to remember, it's complicated to cycle the phrase. So it's better to not have to remember the password - use a password manager. Or, if you could somehow avoid the possibility of off-line attack, and guarantee solid rate-limiting -- much less entropy might be needed. A 4-digit pin is probably on the low side (consider that on a site with ~100.000 users, if you tried any set of three pins, you'd probably compromise many accounts, assuming uniform distribution of pins). Another way, is to continue using a shared secret, but prove knowledge in a different way: eg using TOTP[2]. On the other hand, TOTP shares some of the disadvantages of unsalted passwords: the secrets are stored in plain text both on your one-time token generator (your insecure smartphone), and on the server. On the other hand, they're harder for most users to re-use than passwords are (users typically don't know the secret used to generate one-time passwords). But all these have another problem: how to you protect your secrets? You could use full disk encryption... protected by ... a password? Still, the idea of using a fingerprint for authentication, especially on a device filled with your fingerprints seems like a pretty bad idea. Never mind the fact that once compromised they can never be changed. As for your last point, I do think the combination of something like a yubikey neo[3] along with NFC is probably the sweetspot for practical security right now. You can use it to unlock your smartphone, and your computer. [1] (26^2=512, but not all combinations are common, fitting 256 should probably be possible, even if the more common combination of vowel+consonant is only ~6*20=120. Possibly in combinations with the numbers 1..99) [2] https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_A... [3] https://www.yubico.com/products/yubikey-hardware/yubikey-neo/ https://www.yubico.com/products/yubikey-hardware/yubikey-neo...

vatotemking 10y ago

For a non english speaker, I use a phrase from our native language. The lesser known the language the better.