8 ms·

I'm starting to come of the opinion that systems should probably not let users pick their passwords. That is they get to pick a generated password (by the syst

• Daniel_Marcos 10y ago
  Emojis in passwords would both make passwords more secure and easier to remember for some people. The drawback is that they're very hard to enter in normal, physical keyboards.
  • Swizec 10y ago
    Macs come with a built-in emoji keyboard. Cmd+ctrl+space But does it really improve security that much? If password is short, it's still gonna be quick to crack.
    • teej 10y ago
      There are ~1800 widely supported emojis. That blows out the search space. There are 10^19 possible passwords for a 6 character alphanum+emoji, the same as a 10 character password using just alphanum + simple keyboard symbols.
      • eslaught 10y ago
        But what's the actual distribution of usage of emoji? I'm guessing there is a small-ish set that people actually use, just like there is a small-ish set of words that people will pick from if you ask them to pick a passphrase containing "random" words. Unless you pick the passphrase for them, you're not really gaining the advantage of the search space size.
      • MichaelGG 10y ago
        Except people will probably stick to a few common ones and do a pattern. Love eyes x2 heart heart, thumbs up -- just like people don't pick words uniformly.
    • deleted 10y ago
      [deleted]
    • mcintyre1994 10y ago
      Another problem that's easy to overlook until it isn't is entering your password in front of people - if you're selecting stuff on screen then that's a lot more likely to be seen than typing on the keyboard.
    • zer0t3ch 10y ago
      > If password is short, it's still gonna be quick to crack Only if the cracker is brute-forcing instead of using common passwords mixed with dictionary words, and if the brute-forcer thought to implement emojis. Given how many emojis there are, it would by psychotic to include them in a brute-force attack unless you already know the person used emojis.
  • mynewtb 10y ago
    And a change in keyboard layout or font could easily render the user lost.
  • grapeshot 10y ago
    The other drawback to emojis was that they used to completely crash Chrome's password manager, but I just checked again and it seems it's been fixed.
  • balladeer 10y ago
    I have actually used this ":-) buddha sporty donkey ;-)" for "laughing buddha sporty donkey winking" in the past. Not Emojis though. PS. No I don't use it anymore. And yes xkcd 936 was my inspiration.
  • mistercow 10y ago
    If they're randomly generated, are they still going to be easy to remember? User-chosen emoji passwords would probably be even weaker than user-chosen passphrases.
• herrkanin 10y ago
  This requires that everyone uses password managers that either work across all their platforms or that they know how to access and look up passwords for. I don't think the general user is ready for that.
• revelation 10y ago
  Sounds like you actually want client certificates. If only our ancestors didn't so royally screw that up.. they took the brilliant public-key crypto and even just through the bazillion different encoding schemes and various "cert store" madness have made its use entirely untenable. The whole "the service can't know the password" problem was entirely solved and look where we stand today.
  • homakov 10y ago
    Are they still working? anyone ever used it as auth method?
    • revelation 10y ago
      Chrome blocked client certificate generation by default from version 49, I think you have to enable it specifically now and in general the process is messy (difficult to tell if your private key info is lost or where it ended up). Firefox still works. No idea if people use it for auth, but it is popular when requesting a certificate.
      • iMerNibor 10y ago
        I've used it for internal (internet exposed due to remote) services before - works in ff, the only issue I've had is remembering them
    • cookiecaper 10y ago
      It was used on an IE-only project I worked on many years ago. It was very difficult for users to manage and was used in addition to individual credentialing with a username/password. The certificate would identify the physical location, so there'd be one per client installed onto all the machines from which the site could be used.
      • homakov 10y ago
        Ah, no wonder it's dead.
• dpweb 10y ago
  Better to just ditch passwords altogether. If maybe 5% of the accesses the site requires authentication (the other 95% passthru cause you have the cookie) - make that 5% use a text code to your phone. EDIT: App on yr phone, not an SMS No more passwords.
  • beefhash 10y ago
    Which then requires: 1. every site to obtain some automatable way to send text messages, which can get mildly expensive, 2. people to acquire at least one burner phone for authentication because they don't want $randomwebsite to have their real phone number, and 3. users to give up some degree of anonymity because the country of origin can't be hidden behind a proxy, as the phone number gives it away. This sounds like an overall loss for everybody to me.
  • fpgaminer 10y ago
    Text messages are incredibly insecure because of how easy it is for someone to take over your phone number.
    • dpweb 10y ago
      So Google and Microsoft use 2FA cause texts are more insecure? If I lose control of my phone they're into all my websites anyway.
      • simple10 10y ago
        Yes, texts are insecure for 2FA. It's better to use Google Authenticator or similar. https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/ https://www.wired.com/2016/06/hey-stop-using-texts-two-facto...
      • pdpi 10y ago
        Not losing control of your phone. Losing control of your phone _number_. There's plenty of stories around of spear phishing attacks involving attackers taking over the victim's phone number. Mobile operators are notoriously vulnerable to that sort of shenanigans.
• Fiahil 10y ago
  Keep in mind that, a lot of really poorly designed system are not sanitizing properly user input. I am prepared to bet a lot on the simple idea that an UTF-8 password might break so much of them...
• gluczywo 10y ago
  systems should probably not let users pick their passwords. That is they get to pick a generated password (by the system) It implies that the system knows plaintext password. Even if the system deletes the password and keeps a hash, it remains the problem of distributing that password to the client in a secure way.
  • nickodell 10y ago
    Most services don't hash the password before sending it to the service, so it's going to pass through the service at some point.
    • gluczywo 10y ago
      You are right. The second point remains valid though.
      • andreareina 10y ago
        If the client can securely transmit the password to the system for verification, the system can securely transmit it to the user in the first place.
  • drdaeman 10y ago
    Absolute majority of systems know the plaintext password on sign-up and subsequent logins. Don't think SRP or any similar protocols are any common.
  • nmat 10y ago
    >It implies that the system knows plaintext password No it doesn't, the password can be generated client side. I know that client side code is not safe, but the purpose here is to protect people who are not tech savvy enough to figure that out.
  • remus 10y ago
    Depends on the system. If it's a website of some description you could always generate the password in the clients browser. Obviously you'd then need to be pretty careful to generate your suggested passwords in a secure way, because any attacker would have visibility of your password generating system.
• dheera 10y ago
  Almost all of my passwords are: password = base64.b64encode(pbkdf2(master_password + '/' + domain, b'', 100000+n, keylen=16))[0:16].decode() + '$1Aa' where master_password is not written or stored anywhere, domain is the domain name of the service in question, and n is the nth password generated for the service in question (since some services force you to change passwords every N months). '$1Aa' is to appease stupid websites that require a symbol, number, uppercase, and lowercase letter. Truncation to 16 characters is to appease stupid websites that limit passwords to 20 characters. I also use the same thing for the answers to all "security" questions online, where I just plug in the security question as domain. (They're basically de-security questions, since, you know, a lot of people in this world know what my favorite color is and what streets I used to live on). I should probably use HMAC but whatever. The only passwords I have that are not part of this system are my computer's root password, e-mail password, and bank account passwords; for those I just memorized random strings). This system gives me the following advantages: * Peace of mind that I don't have to trust a 3rd party, closed-source password manager * No need to cloud-sync anything across machines. No need to access the internet. * I can calculate my passwords without a database, so if I have to randomly reformat my machine while travelling I can still compute my passwords and login to everything I need to.
  • nmat 10y ago
    How do you login to sites on your phone?
    • dheera 10y ago
      A Python script on my Android phone computes the above. I might write a native app later. I'm also thinking of making something at my desk that emulates a USB keyboard that I plug into my phone with an OTG cable to enter the computed password automatically. For less-sensitive sites (i.e. things that aren't going to screw me over if my account is hacked), I just save the computed password into the Chrome password manager. The computed password can't be feasibly used to get my master password anyway. For many sites it's possible to stay logged in with a session cookie without saving the password.
• JoshTriplett 10y ago
  > That is they get to pick a generated password (by the system) that is easy to remember. Maybe from 10 or so. I think we need to get away from the idea that people should memorize passwords at all. The default should be "generate long password (or encryption key for sites that support it) and put it in your browser's password manager". You only need to memorize the main passphrase for your system-level encryption.
• cm2187 10y ago
  If you choose passwords for your users you might as well use a base64 256bit key.
• OJFord 10y ago
  > I have even thought maybe emojis might make for better passwords for some users. hunter2-esque "how do you know my password?!" would be rife!
• kolinko 10y ago
  I'd prefer there to be no passwords at all, aside from my e-mail password. If I want to log in, an e-mail is sent to my mail, and an optional 2FA on my mobile. If my mail is compromised, all the other passwords can be reset anyway.
• csydas 10y ago
  I had proposed a similar idea at my last place of employment at a smaller University when I was spearheading an initiative to revamp our identity management system. The system itself needed to be rebuilt at it was hacked together by our former Systems Lead to replace an ancient server that handled everything, and while it worked, it was far from ideal. Initially we just wanted to implement zxcvbn and be done with it, but due to some in office politics, we had to take it a step further and do a password policy review; our federated login across so many systems resulted in some really bizarre password requirements, so we wanted to simplify it and push users towards passphrases for more secure passwords. The idea I was pushing was that we'd basically just spend an afternoon coming up with as many benign questions as we could to get a list of about 400-500 some questions, on account creation, the user would be queried for 3-4 of the questions randomly, and a system would generate a passphrase based on the answers provided with a bit of security fuzziness (maybe a substitution or two, random order, underscores or spaces, etc) to the passphrase to ensure it met what zccvbn considered secure. I'm not a security guy as much as I'd like to be, so I don't quite know what harm there is in such a system, but it seemed like a good idea at the time. The biggest problem as we could tell it would be the user would forget the password or be annoyed by long passwords, and even if you knew the entire list, it seemed unlikely you could figure out which questions they got and in what order, and the number of questions seemed to prevent even educated guesses by spouses/stalkers. It was ultimately shot down by politics because the President of the University couldn't come up with a valid password using this system. (he insisted he must be able to use his password scheme, which it turns out always included the university mascot name, which was part of the forbidden list) Currently I think it just runs with the simplified rules requiring at least 8 characters and meeting a security rating of at least 4 per zxcvbn.