7 ms·
They should settle on requiring a memorable, yet high entropy password that is impossible to conpromise. For example the string "IpromiseIamauthorizedtoaccess
by logicallee 10y ago
They should settle on requiring a memorable, yet high entropy password that is impossible to conpromise. For example the string "IpromiseIamauthorizedtoaccessthissystem". This string is very high-entropy (does not appear anywhere in Google, is 9 words, a mixture of upper and lowercase. For someone trying every character combination, it would take over a thousand years to crack. It includes a second factor (the promise) by definition. In short it should be the REQUIRED secure password for all applications.
- dublinben 10y ago>does not appear anywhere in Google It does now! This is why it's so important to use a method like diceware to select a strongly random set of words for your passphrase.
- deleted 10y ago[deleted]
- ricardobeat 10y agoIf uniqueness is a goal, why not just use UUIDv4?
- malka 10y agoboth uniqueness and easiness of memorization are important here
- criddell 10y agoI have one passphrase that I've memorized and that gets me into my password manager. I couldn't tell you any of my passwords other than that one. I also use two factor authentication in the form of TOTP (the 6 digit number that changes every 30 seconds) wherever I can. If so many sites didn't have a limit on password length, I would use UUIDs. BTW, is there any reason to have a short limit on password length? I'm talking less than 20 characters? I could understand limiting it to 100 characters, but when it's short it makes me feel like the site might be storing my password rather than a hash.
- tuwtuwtuw 10y agoIf you only have the password to your password manager, how do you log on to your computer? Honest question since I want a solution to that problem. I want separate credentials for my home and office computer so even though I use a password manager I have like 3-4 sensitive passwords I have to keep in my head.
- criddell 10y agoMy laptop has a fingerprint sensor that I use. There is a backup password but I don't know what it is but I do have it in my password manager that I can access from my phone. My office computer has a relatively weak password because there's nothing on it that is personally sensitive. They force a password change every three months so I added a counter to the password and just increment that each time (pa$$1word, pa$$2word, pa$$3word, etc...).
- logicuce 10y agoIsn't fingerprint based authentication considered, generally, weaker than that based on a password?
- criddell 10y agoI might be wrong, but I believe a fingerprint is equivalent to around 80 bits of entropy which is roughly the strength of a good 13 character password. A determined adversary can do things like lift a fingerprint from elsewhere and use that, but it's not really something I worry about too much. They could also arrest me and press my finger down on the sensor or beat me and I'll tell them every password I can. I mostly worry about having strong credentials to remote systems.
- Terr_ 10y agoFYI, I think that needs a little more sarcasm early on, I got pretty far before I realized it wasn't just, well, wrong.
- sowbug 10y agoThis is an excellent approach. In addition, I recommend adding pithy terms of service to the end so that the holder can sue anyone who steals the password. You'd be surprised how many black-hats are deterred by the threat of prosecution.
- knicholes 10y agoCorrect Horse Battery Staple https://xkcd.com/936/ https://xkcd.com/936/
- GrinningFool 10y agoNot so much. Too many sites arbitrarily block spaces and impose maximum lengths. Other character exclusions are all too common as well, though not relevant to this pattern Is there anyone reading this who has chosen to implement such limits? If so, why?
- lmm 10y agoChosen to impose a maximum length? No (though I would probably limit to 4k just to have some kind of sanity limit - if you don't define a limit then your system still has a practical limit, it just doesn't fail gracefully when you hit it). Had to implement a maximum length for compatibility with a legacy system? Yes.
- JadeNB 10y ago> Is there anyone reading this who has chosen to implement such limits? If so, why? I haven't, but here's one answer I got from someone who did. The bizarre password requirements at $WORK have the property that, sometimes, a subset of a password will be permitted when the full password would not be. I contacted our IT department once with a specific example of an objectively weak password which was accepted, and a stronger password (at least, it contained the weaker password as a strict subset) which was rejected. I proposed a concrete, simple-to-implement suggestion for how to relax the rules to avoid this kind of paradox. (I don't remember what it was.) He agreed with me that this was an undesireable outcome, and that my proposal was implementable. However, he said that the institution would nonetheless not implement it, because people were used to the old rules, and would be confused if they changed. (When I asked how people could be confused if all the old passwords were still acceptable, and the only change was that new, stronger passwords also became acceptable, he stopped responding.)
- GrinningFool 10y ago
- loup-vaillant 10y agoOne little problem with your passphrase is, it's grammatically correct. If the attacker suspects as much, this will dramatically reduce the search space. Personally, I'd rather bet on something like Diceware.
- cmdrfred 10y agoAt very least that is more secure than a random 9 character password and much easier to remember. 9 words to the power of 20k[0] compared to 9 letters to the power of 52 (random case). [0]http://www.lingholic.com/how-many-words-do-i-need-to-know-the-955-rule-in-language-learning-part-2/ http://www.lingholic.com/how-many-words-do-i-need-to-know-th...
- loup-vaillant 10y agoYou're right, it's much better, but the entropy of an English word is nowhere near log2(20K) (between 14 and 15 bits of entropy), especially in a grammatically correct sentence, because you're simply unlikely to select them truly randomly. Some words are way more common than others, and they are much more likely to be found in your passphrase if you didn't use an external random index generator (be it a set of dice or /dev/urandom), because of availability bias: you're more likely to chose common words, or even worse, uncommon words pertaining to your interests. Diceware uses a smaller set (about 8K words), but if you select them truly randomly, you'll get close to 13 bits of entropy per word —guaranteed. I wouldn't cry too much over the loss of 2 bits per word, because Diceware words tend to be short. Then again, even a word in a grammatically correct sentence is likely to have more than the 6-7 bits of entropy a character may have. I wouldn't bet on anything above 10, though.
- criddell 10y agoBruce Schneier disagrees with you: https://www.schneier.com/blog/archives/2014/03/choosing_secure_1.html https://www.schneier.com/blog/archives/2014/03/choosing_secu... The main point from his essay is anything that can be remembered can be hacked. He then softens that statement to show a way to take your memorable phrase and turn it into something stronger.
- CppCoder 10y agoBut he starts with saying the file can be processed offline. And I wonder, if one gets the "password" file to be processed offline, why can't he simply get the data too? Maybe there is a difference between what is supposed to be protected. The login to some server based server? Or something I use locally like my tax files.
- Tomte 10y agoSchneier is simply wrong there. He wanted to rant and therefore didn't read the description of the "xkcd scheme" with enough concentration to understand it. Legions of security people debunked Schneier, but unfortunately he didn't have it in him to retract his claim and update his post. This blog post is the best example you can give of Schneier quitting academic discourse and becoming a pundit.
- criddell 10y agoCan you point to a good debunking?
- VLM 10y agoThe problem with long passwords and "culture fit employees" is at a former employer root passwords were mostly never used (magic of sudo, kerberos, etc) and were stored in sealed envelopes in a semi-secured lockbox, and during the inevitable outage it was comically discovered two star trek fans configured two machines to the same trek quote as a password. I would imagine in the "real world" outside strict culture fit requirements that a certain percentage of passwords will be popular bible verses, for example. There's a curve where the likelihood of collision or predictability is very high with short passwords and it declines with length until it starts increasing again. I used to use full engineering parts numbers of semiconductors I used in projects. I also used some verbose API names that I used a lot. In retrospect that's a terrible idea. I wonder how many people sitting next to me used the same password.
- jff 10y ago> during the inevitable outage it was comically discovered two star trek fans configured two machines to the same trek quote as a password. Was it "Live long and prosper" or "He's dead, Jim"? The latter seems more suitable given the circumstances :)
- VLM 10y agoI believe it was one of the numerous starship self destruct codes, which also technically passes the usual hoops of letters and numbers and mixed case and punctuation. I actually looked it up: 1,1A(bunch more stuff here)000Destruct0 it was kinda long. From memory that movie even displayed it on the screen so the guys used the same capitalization and everything.
- jessaustin 10y agohttps://www.google.com/search?q=ipromiseiamauthorizedtoaccessthissystem https://www.google.com/search?q=ipromiseiamauthorizedtoacces...