6 ms·
This part is very good advice: When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets agai
by bdamm 10y ago
This part is very good advice:
When processing requests to establish and change memorized
secrets, verifiers SHALL compare the prospective secrets
against a list of known commonly-used, expected, and/or
compromised values.
So, no rotation, no character set rules, but the password better not be already known. They specifically refer to comparing against a corpus of known broken passwords. Very good.
- shandor 10y agoThe same got my attention too. A really great idea, though I'm not aware of it being used currently at all. It might be, but I've never come across/heard anyone mentioning it. Hopefully this takes root! Actually, couldn't privacy-caring service providers also check current passwords against newly-leaked lists in case something pretty big gets disclosed and warn their affected users? Would probably take some time for services with big amount of users, but that would be some awesome help to users who use same passwords in most places.
- jsjohnst 10y agoNot sure if they still use it, but Tumblr blocked setting your password to a common password in the past. (Source: I wrote the feature)
- gmac 10y agoI've been implementing this on secure sites for about ten years.
- bdamm 10y agoCracklib has been around for ... years. https://github.com/cracklib/cracklib https://github.com/cracklib/cracklib
- glandium 10y agoHow long before this advice triggers someone to create a service to test passwords against a known corpus with a nice API, and, worse, people using it?
- jsjohnst 10y agoNeed to find the URL again, but this already exists. Yes, WTF indeed.
- AstralStorm 10y agoBest idea, send a password over the Internet to verify it. (sarcasm) Even with good TLS it is a stupid risk to take when you could verify locally. (Just the DoS potential not to mention compromise risk.)
- jsjohnst 10y agoYou do realize every time you login to a website you are "send[ing] a password over the internet to verify it" ;)
- thaumaturgy 10y agoI wrote a tool a while back that's excellent at this. It produces a 1MB file that you can do a straightforward search against and use to blacklist 161,000 different common passwords. https://github.com/robsheldon/bad-passwords-index https://github.com/robsheldon/bad-passwords-index I want people to use it. I gave it the most permissible possible license. Please people, use it. I'll even update it Real Soon Now.
- Hondor 10y agoI like your license choice. Is there a reason you chose Unlicense over CC0? I've never heard of it before. The text is a bit shorter than CC0 which is nice. Creative Commons recommends against using CC licenses for software so as not to step on the toes of the GPL which doesn't seem applicable if you really want public domain. [1] [1] https://creativecommons.org/2011/04/15/using-cc0-for-public-domain-software/ https://creativecommons.org/2011/04/15/using-cc0-for-public-...
- thaumaturgy 10y agoOof. I don't remember exactly, but I do remember spending a lot of time (too much time) deciding between various license options. I think in the end I chose Unlicense primarily because it's easier to find Unlicensed projects on Github.
- PerfectElement 10y agoThank you for this. I was looking for something similar the other day.
- semi-extrinsic 10y ago> There are no fancypants libraries, frameworks, or nonsense required. Use your favorite language with the index, I don't care what it is. ...unless you like XML. If you like XML, I'm judging you. My hat's off to you, good sir.
- 013 10y ago"bad_passwords.txt" seems to be 1 line long? Am I missing something.. edit: Oh, "Convert your user's password to lowercase and do a simple string search against the index. No regular expressions are necessary." That makes sense, apologies.
- kbart 10y agoYes, it is simple, yet elegant solution to the common password problems. I would also add check against common patterns (numbers or letters in increasing/decreasing order or keys subsequent in keyboard etc.) to this, so you can't use "password1239" instead of "password123" and call it a day.
- bloaf 10y agoI'd say to just treat any of the common passwords as a single character when validating. If "password" was treated as a single character, then password123 would only count for 4 characters. It might be tough to explain to users, but it would solve the problem.
- AstralStorm 10y agoDon't worry, we will find a way around that stupidly draconian rule by making it not look like a word. For reference, common English dictionary words have about 24-bit entropy, a character has some 6 bits.
- unclebucknasty 10y agoYeah, I think this comparison against known/expected/compromised values is the key offset for not imposing character set rules. They made the smart choice.
- robodale 10y agoAn easy to overcome hurdle: Pass1word Pass2word Pass3word (my scheme at my last software gig when IT required periodic password changes)