24 ms·

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 1

by simias 10y ago

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary password restrictions to begin with? I mean, I can imagine that a clueless user might have the illusion of safety if they're using something like "1q2w3e4r5t" but if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. So why even bother? I think there are two possible ways to look at this problem from a service provider perspective: - if the user getting their password stolen is a bad thing for you (i.e., you're a bank or something like that, and getting an account compromised will put you in trouble), then IMO the only satisfactory solution is to impose a password to the user. In effect these ridiculous password requirements are exactly that, except less convenient and secure. Cut to the chase and say "your bank password is Axei5aoc0i, write it down somewhere safe". - if the user getting their password stolen is not a problem for you because it's not your responsibility to handle these issues (like a hacker news account for instance) then just let the user pick whatever they want and deal with the consequences. If they care enough about it they'll care enough to pick a decent password. At most if you really want to be friendly give an indication that a password might be weak, but please don't disallow it.

Brendinooo 10y ago
>but if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. So why even bother? I agree. Sometimes I'm just signing up to a site where I don't put any personal info up, or at least nothing more sensitive than my name. Why do I need high-level security there?
sverige 10y ago
Yes and yes! Many throwaway accounts I have use some variation of the same password, because I don't care if someone hacks my HN or reddit or youtube account. I don't use my real name on any of them. If I lose control of it, I'll just make a new one. (Karma doesn't pay the bills, and I don't make money from my very excellent youtube comments; someone else does.) This is why all these accounts get an email account that doesn't include my real name, too. There are so many sites that have these signup dialogs that require an email address -- why? Oh yeah, that's right, user data is the oil that will fuel the future economy.
- neikos 10y ago
  Two ways why I think E-Mails are useful at signup: - Password Recovery (this can be optional though, for my sites it usually is) - 'Legit Users', sending an email and having them confirmed through a code in them gives a bit more confidence in the user
  - camiller 10y ago
    'legit users' There isn't a day that goes by that I don't get an email intended for someone else, often including personal information, due to a mistyped email address. Whoever decided that email verification was a poor user experience needs to be hit in the head with a shovel after he digs the appropriate sized hole. If you know Catherin (PA) let her know her round trip to vegas is confirmed Carolyn's (NYC) open table reservation was canceled by the restaurant. Different Carolyn (CA) needs to correct email address with the walnut creak school district. Possible the same Catherine (PA), your financial advisor needs a distribution form filled out. Clint (OH), your repair at Kay jewelers in Akron is done. Ann (FL), Thank you for scheduling an online appointment with Conley Subaru sigh, you get the idea Edit: Oh, and I'm going to start canceling Open Table reservations that show up in my inbox.
    - mholmes680 10y ago
      same here. apropos xkcd: https://xkcd.com/1279/ https://xkcd.com/1279/ My most entertaining email yet was a group thread that kept track of a young missionary's progress as he traveled through South America. He's home now, so I don't get weekly updates anymore :( I almost miss it.
    - paulmd 10y ago
      As someone with an unusual name (used for my public-facing email address) and who uses a fairly unusual email for personal stuff... that's pretty different from my experiences. I've never ended up with someone else's mail at all. That's a solid argument for business cards with vCard QR codes as I see it. Or a pack of stickers with QR codes that you could slap on whatever documents you needed. It's too bad QR code adoption is so horrible. I'm just as guilty of it as anyone else, I assume that any QR code is probably just some marketing thing. But vCards seem like one of the very legit use-cases. Now that I am imagining using stickers and never filling out my contact info on a form again, I realize that's definitely a world I want to live in.
corobo 10y ago
> if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing You do. A lot of users don't consider automation when it comes to people hacking their account. I've heard "Nobody will ever guess it though" a few times during my career.
- coldpie 10y ago
  I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords. What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on that particular service, at least until the leak becomes discovered and the service does a full password reset. While it would be ideal to defend against that attack, I think it's far more important to stress that users have a different password for every website. The real attack vector that we see every day is a DB leak from a poorly secured website, passwords cracked, and then reused on important services. That's where the problem lies, not in the user's password entropy. Jeff isn't wrong here, he's just attacking a relatively unimportant problem.
  - nerdponx 10y ago
    I was wondering this as I read it as well. Yes, we know it would be fairly easy to compromise an individual account by guessing common passwords. But that assumes you have one particular account in mind. If you're just looking for bank accounts to access, you first need a list of usernames to try (ideally usernames of non-tech-savvy people) and then you need to run your entire password guessing routine for each one. I'm no security expert, but I start to wonder if the "practical" entropy of a given password is actually much higher than the theoretical entropy numbers people derive. Serious question: when is the last time anyone has had an account compromised because of a weak password?
    - SapphireSun 10y ago
      The last time a company had their password hashes exfiltrated. All the common passwords are quickly broken.
allengeorge 10y ago
That's a very interesting way to categorize passwords. I wonder if one reason why banks etc. don't auto-generate passwords is to avoid liability: I can totally imagine a class-action lawsuit where a lawyer claims that all the auto-generated passwords were insecure.
coldtea 10y ago
>I mean, I can imagine that a clueless user might have the illusion of safety if they're using something like "1q2w3e4r5t" but if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. So why even bother? It's not an illusion, 1q2w3e4r5t is indeed better than aaaaaaaaa, even if it's just the numbers interleaved with qwerty (and probably easy to brute force generate up to it). >if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. So why even bother? Because not everyone who uses "aaaaaaaaa" (or "1q2w3e4r5t" for that matter) knows "full well" that it's insecure?
- corobo 10y ago
  > 1q2w3e4r5t "COMMON PASSWORD: IN THE TOP 9635 MOST USED PASSWORDS Your password is very commonly used. It would be cracked almost instantly[1]" I do realise there's a difference between cracking a local system password vs a website password but always assume a site's database is going to be leaked at some point [1] https://howsecureismypassword.net/ https://howsecureismypassword.net/ (Don't go putting real passwords in there..)
  - jessaustin 10y ago
    It would take a computer about 47 TREDECILLION YEARS to crack your password Why not create even stronger passwords with Dashlane? It's free! I didn't know that was a number!
- simias 10y ago
  Okay, I'm game: HHHnHHHHnHHHHHnnnnnnnnnHHnnnnnnHHHHH It's a password that I postulate is more secure that the average and yet is only made of two different symbols and would've been rejected by the proposed "x amongst y" character policy. It's a bit far fetched but not that much, you'll notice that the pattern is simply the first digits of pi, so it's fairly easy to remember. And the letters are "Hn", like hacker news. That's my point, really. If you think you know better than the user how to pick a password, then just do it. Otherwise don't get in my way, you don't know how I generate my passwords.
  - 10y ago
aleksei 10y ago
> if the user getting their password stolen is not a problem for you because it's not your responsibility to handle these issues (like a hacker news account for instance) then just let the user pick whatever they want and deal with the consequences. If they care enough about it they'll care enough to pick a decent password. Surely that's a cop-out? If the user getting their data stolen is not a big deal for you, why bother securing any system at all? The reason service providers set password rules is because there are many, many people who do not understand what a good password is, or the risks associated with losing them. There are people out there using the same password for everything, unaware that the compromise of one service can spell doom for their financial life. Developers really need to start taking responsibility for their code. Setting password rules, while arbitrary, are about protecting users. This may upset those who are tech-savvy and know what they are doing, but that really weighs nothing compared to the benefits it brings to those who are not.
- tboyd47 10y ago
  I guess Atwood's point is that it's impossible for developers to stop users from creating dumb passwords just using regexes. That much is true. Even if you require an uppercase letter, lowercase letter, special character, and number, you're still going to have a lot of passwords like "Password_1" coming in. And then, if you require people to change their password every so often, it will become "Password_2," "Password_3," etc. There's no easy way around this. It is weird that he goes on to suggest a complex system of rules literally right after saying rules are bad, and that's the point where he lost me too. If users don't understand what a good password is, they are going to eventually get an account compromised somewhere, if not on your site, then on another. In cases where there's no liability back to you, then there's no sense in babying them. If you do have liability, then two-factor authentication is probably a better way to go. I personally would hate it if a company forced me to use their generated passwords because I like to manage my own passwords.
  - aleksei 10y ago
    Okay, I see the issue regarding regexes. However I take offense at the notion of "babying" users. We are all babied in some aspect of our lives: if it weren't for the active work and intervention of those in other fields, we wouldn't know whether the food we eat is safe, or if the roof isn't going to collapse during the night. I'd like developers to assume some responsibility for their users in turn. But I concede that may be beside the point in the case of password rules.
bambax 10y ago
Totally agree. If you annoy the user too much, they will not try to circumvent your rules, they will leave and find something else to do with their time. Also, the big question that's missing from the article is: who's the enemy? If the enemy are Russian genius hackers, then certainly very long passwords and maybe other measures are in order. But the enemy is not always remote. I just bought a new iPad and had to reset my password and so-called "security questions". In my experience, there are only two kinds of security questions: ones I don't know the answer to myself, and ones everyone around me knows the answer to (what was your first job, what was your surname when you were a child, etc.) The problem is, in the case of the iPad, your enemy is not some James Bond villain in a cave in Ukraine, it's your 13 year old child who wants to use your account to buy apps, or your spouse during a nasty separation. And they both know, or can guess, answers to "security questions". What I do personally is type random things as the answers, and write them down somewhere. But that doesn't improve security, it weakens it.
- Raphmedia 10y ago
  I simply type passwords in the answers. "What is your mother's maiden name?" - "gHk899iL@"
  - GrinningFool 10y ago
    Annoyingly,some sites have started putting limits and validations on their security question answers...
    - tromp 10y ago
      Imagine the site complaining that your answer has "too much entropy" to be correct...
    - syntheticnature 10y ago
      Ran into one where it demanded I choose from a drop-down list, e.g. "What was your first pet" had "dog", "cat", "hamster", "gerbil", etc. I recall the list having a scrollbar, but there was not even enough choices for eight bits worth of entropy. Oh, and they referred to these security questions as "2FA."
JulianMorrison 10y ago
Imposed passwords aren't the only solution. Something like Google Authenticator is an alternative. Or key fobs. Or send a confirmation code to their phone. Or something like Barclays' PINsentry [1] for cards where you need the gadget, the card and the PIN. Or face recognition, which I recently saw demonstrated (it includes liveness checks like asking you to blink). [1] http://www.barclays.co.uk/Helpsupport/UpgradetoPINsentry/P1242559314766 http://www.barclays.co.uk/Helpsupport/UpgradetoPINsentry/P12...
- pbhjpbhj 10y ago
  Authenticator is great, but then you get the arsehole effect - every arsehole company decision maker wants you to only use their authenticator. So, I made an account on MS recently and can't use GA because "fuck you user, we won't stop until we own every facet of your digital existence" or something. That shows you where such companies rank security. [FWIW I expect the reverse situation is probably the same, this is just my anecdotal experience].
  - Sargos 10y ago
    Assuming MS means Microsoft then you are incorrect. You can use Google Authenticator just fine with Microsoft accounts (because I'm doing it.)
    - pbhjpbhj 10y ago
      Then I apologise, it must be an information 'hiding' issue then because they clearly flagged installing their own Authenticator and I was completely ignorant of the use of GA; GA must be the most popular authenticator? Does this all mean I can use a third-party auth for both MS and Google sites or is it only MS that supports third-party authenticators?
      - Sargos 10y ago
        You can use any authenticator. Authy is actually probably the best nowadays.
paulddraper 10y ago
For what it's worth, the current NIST draft has the exact same recommendations: > Verifiers SHOULD NOT impose other composition rules (e.g., mixtures of different character types) on memorized secrets. > When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example, the list MAY include (but is not limited to): > * Passwords obtained from previous breach corpuses. > * Dictionary words. > * Repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’). > * Context specific words, such as the name of the service, the username, and derivatives thereof. I suppose you could open a pull request :) https://github.com/usnistgov/800-63-3 https://github.com/usnistgov/800-63-3
pps43 10y ago
> if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. There's no substitute for length. "dog" is a bad password. "doooooooooooooooog" is much better. The entropy is still the same, but the latter takes much longer to brute force and is just as easy to remember. Of course one should not use passwords one can remember for anything critical, but many passwords are for services where compromise is not a big deal.
snarf21 10y ago
I agree with what you have said but I think the new guidelines don't go far enough. The biggest problem is that in the balance of security and convenience, users will always opt for convenience. Only via legislation will that change, think credit card chips versus swiping. (We should have chip + PIN in my opinion.) We need to make passwords a much simpler thing to manage so that people don't create a bigger problem by putting it on post-its on their monitor. What I'm suggesting would take some effort but is where we need to go. Your username is your fingerprint. You won't forget that and it is very hard to fake/brute force. (Your phone already has one and a usb one for you computer would be trivial. A lot already have them.) Your password is always just 8 characters, alpha numeric only (62^8 is plenty big) and you must have 2FA on. It would be trivial for the phone manufacturer to add that at the OS level and it could be visible on your lock screen. Also, finally a good use for a smart watch. The rules are simple and you have removed the biggest security hole most companies have: people. Just my two cents....
- officelineback 10y ago
  2FA is something you know and something you have. So fingerprint gives you part 2 and password gives you part 1. No need for an additional MFA device.
  - rosser 10y ago
    No. Your parent's comment is correct: fingerprints should be usernames, not passwords. An MFA device is still warranted.
gist 10y ago
> but if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. That's you. The average user thinks 'nobody will guess this password'. In other words don't assume they know about brute force attacks, rainbow tables, most common password lists and a host of other things that they haven't thought of or don't know even exist. They don't even know the complete group of actors that could potentially breach the account.
problems 10y ago
> if the user getting their password stolen is not a problem for you because it's not your responsibility to handle these issues (like a hacker news account for instance) then just let the user pick whatever they want and deal with the consequences Yes! Please. Let users determine the value of their accounts for themselves. If I decide that say, my HN account isn't valuable and use a common password that is shared with many websites, I know the risk I'm taking and I'd rather take it than have to mark down a unique password for HN. On sites I write I advocate for no password rules at all (hit enter is good enough for me, yes we can hash an empty string), have usually compromised on a simple length check. Proper password storage is important, use the latest bcrypt/scrypt/argon2, don't cheap out there. You can cheap out on password rules. If you want to write a fancy entropy checker, run it client side and tell the user how secure their password is, let them choose whether they want that or not.
dickbasedregex 10y ago
Yes! Left me make my own bad life decisions and get out of my way. Nothing makes me immediately dismiss a site or piece of software faster than nannying me, especially from go.
ifdefdebug 10y ago
> "your bank password is Axei5aoc0i, write it down somewhere safe" "So I send it to my mail account for when I am on the go... that account with the qwerty password..." The point being, you can't really protect users from themselves so a bank can't build it's security model upon the assumption of safe user accounts.
elif 10y ago
yeah i'm on your side. I randomly generated a password one time that ended up with 3 repeated characters. I used it because, hey p-random is p-random i'm not gonna argue. Unfortunately the site it was for rejected it. I've since had to change my random generator to avoid 3 of a kind, which actually makes it less random/secure i believe.. pruned some branches off of the search tree.. especially since i've now told everyone ;)
johnchristopher 10y ago
> Axei5aoc0i I don't want to trust a bank who knows my password.

by simias 10y ago

Brendinooo 10y ago

>but if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. So why even bother? I agree. Sometimes I'm just signing up to a site where I don't put any personal info up, or at least nothing more sensitive than my name. Why do I need high-level security there?

sverige 10y ago

Yes and yes! Many throwaway accounts I have use some variation of the same password, because I don't care if someone hacks my HN or reddit or youtube account. I don't use my real name on any of them. If I lose control of it, I'll just make a new one. (Karma doesn't pay the bills, and I don't make money from my very excellent youtube comments; someone else does.) This is why all these accounts get an email account that doesn't include my real name, too. There are so many sites that have these signup dialogs that require an email address -- why? Oh yeah, that's right, user data is the oil that will fuel the future economy.

neikos 10y ago
Two ways why I think E-Mails are useful at signup: - Password Recovery (this can be optional though, for my sites it usually is) - 'Legit Users', sending an email and having them confirmed through a code in them gives a bit more confidence in the user
- camiller 10y ago
  'legit users' There isn't a day that goes by that I don't get an email intended for someone else, often including personal information, due to a mistyped email address. Whoever decided that email verification was a poor user experience needs to be hit in the head with a shovel after he digs the appropriate sized hole. If you know Catherin (PA) let her know her round trip to vegas is confirmed Carolyn's (NYC) open table reservation was canceled by the restaurant. Different Carolyn (CA) needs to correct email address with the walnut creak school district. Possible the same Catherine (PA), your financial advisor needs a distribution form filled out. Clint (OH), your repair at Kay jewelers in Akron is done. Ann (FL), Thank you for scheduling an online appointment with Conley Subaru sigh, you get the idea Edit: Oh, and I'm going to start canceling Open Table reservations that show up in my inbox.
  - mholmes680 10y ago
    same here. apropos xkcd: https://xkcd.com/1279/ https://xkcd.com/1279/ My most entertaining email yet was a group thread that kept track of a young missionary's progress as he traveled through South America. He's home now, so I don't get weekly updates anymore :( I almost miss it.
  - paulmd 10y ago
    As someone with an unusual name (used for my public-facing email address) and who uses a fairly unusual email for personal stuff... that's pretty different from my experiences. I've never ended up with someone else's mail at all. That's a solid argument for business cards with vCard QR codes as I see it. Or a pack of stickers with QR codes that you could slap on whatever documents you needed. It's too bad QR code adoption is so horrible. I'm just as guilty of it as anyone else, I assume that any QR code is probably just some marketing thing. But vCards seem like one of the very legit use-cases. Now that I am imagining using stickers and never filling out my contact info on a form again, I realize that's definitely a world I want to live in.

corobo 10y ago

> if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing You do. A lot of users don't consider automation when it comes to people hacking their account. I've heard "Nobody will ever guess it though" a few times during my career.

coldpie 10y ago
I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords. What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on that particular service, at least until the leak becomes discovered and the service does a full password reset. While it would be ideal to defend against that attack, I think it's far more important to stress that users have a different password for every website. The real attack vector that we see every day is a DB leak from a poorly secured website, passwords cracked, and then reused on important services. That's where the problem lies, not in the user's password entropy. Jeff isn't wrong here, he's just attacking a relatively unimportant problem.
- nerdponx 10y ago
  I was wondering this as I read it as well. Yes, we know it would be fairly easy to compromise an individual account by guessing common passwords. But that assumes you have one particular account in mind. If you're just looking for bank accounts to access, you first need a list of usernames to try (ideally usernames of non-tech-savvy people) and then you need to run your entire password guessing routine for each one. I'm no security expert, but I start to wonder if the "practical" entropy of a given password is actually much higher than the theoretical entropy numbers people derive. Serious question: when is the last time anyone has had an account compromised because of a weak password?
  - SapphireSun 10y ago
    The last time a company had their password hashes exfiltrated. All the common passwords are quickly broken.

allengeorge 10y ago

That's a very interesting way to categorize passwords. I wonder if one reason why banks etc. don't auto-generate passwords is to avoid liability: I can totally imagine a class-action lawsuit where a lawyer claims that all the auto-generated passwords were insecure.

coldtea 10y ago

>I mean, I can imagine that a clueless user might have the illusion of safety if they're using something like "1q2w3e4r5t" but if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. So why even bother? It's not an illusion, 1q2w3e4r5t is indeed better than aaaaaaaaa, even if it's just the numbers interleaved with qwerty (and probably easy to brute force generate up to it). >if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. So why even bother? Because not everyone who uses "aaaaaaaaa" (or "1q2w3e4r5t" for that matter) knows "full well" that it's insecure?

corobo 10y ago
> 1q2w3e4r5t "COMMON PASSWORD: IN THE TOP 9635 MOST USED PASSWORDS Your password is very commonly used. It would be cracked almost instantly[1]" I do realise there's a difference between cracking a local system password vs a website password but always assume a site's database is going to be leaked at some point [1] https://howsecureismypassword.net/ https://howsecureismypassword.net/ (Don't go putting real passwords in there..)
- jessaustin 10y ago
  It would take a computer about 47 TREDECILLION YEARS to crack your password Why not create even stronger passwords with Dashlane? It's free! I didn't know that was a number!
simias 10y ago
Okay, I'm game: HHHnHHHHnHHHHHnnnnnnnnnHHnnnnnnHHHHH It's a password that I postulate is more secure that the average and yet is only made of two different symbols and would've been rejected by the proposed "x amongst y" character policy. It's a bit far fetched but not that much, you'll notice that the pattern is simply the first digits of pi, so it's fairly easy to remember. And the letters are "Hn", like hacker news. That's my point, really. If you think you know better than the user how to pick a password, then just do it. Otherwise don't get in my way, you don't know how I generate my passwords.
- 10y ago

aleksei 10y ago

> if the user getting their password stolen is not a problem for you because it's not your responsibility to handle these issues (like a hacker news account for instance) then just let the user pick whatever they want and deal with the consequences. If they care enough about it they'll care enough to pick a decent password. Surely that's a cop-out? If the user getting their data stolen is not a big deal for you, why bother securing any system at all? The reason service providers set password rules is because there are many, many people who do not understand what a good password is, or the risks associated with losing them. There are people out there using the same password for everything, unaware that the compromise of one service can spell doom for their financial life. Developers really need to start taking responsibility for their code. Setting password rules, while arbitrary, are about protecting users. This may upset those who are tech-savvy and know what they are doing, but that really weighs nothing compared to the benefits it brings to those who are not.

tboyd47 10y ago
I guess Atwood's point is that it's impossible for developers to stop users from creating dumb passwords just using regexes. That much is true. Even if you require an uppercase letter, lowercase letter, special character, and number, you're still going to have a lot of passwords like "Password_1" coming in. And then, if you require people to change their password every so often, it will become "Password_2," "Password_3," etc. There's no easy way around this. It is weird that he goes on to suggest a complex system of rules literally right after saying rules are bad, and that's the point where he lost me too. If users don't understand what a good password is, they are going to eventually get an account compromised somewhere, if not on your site, then on another. In cases where there's no liability back to you, then there's no sense in babying them. If you do have liability, then two-factor authentication is probably a better way to go. I personally would hate it if a company forced me to use their generated passwords because I like to manage my own passwords.
- aleksei 10y ago
  Okay, I see the issue regarding regexes. However I take offense at the notion of "babying" users. We are all babied in some aspect of our lives: if it weren't for the active work and intervention of those in other fields, we wouldn't know whether the food we eat is safe, or if the roof isn't going to collapse during the night. I'd like developers to assume some responsibility for their users in turn. But I concede that may be beside the point in the case of password rules.

bambax 10y ago

Totally agree. If you annoy the user too much, they will not try to circumvent your rules, they will leave and find something else to do with their time. Also, the big question that's missing from the article is: who's the enemy? If the enemy are Russian genius hackers, then certainly very long passwords and maybe other measures are in order. But the enemy is not always remote. I just bought a new iPad and had to reset my password and so-called "security questions". In my experience, there are only two kinds of security questions: ones I don't know the answer to myself, and ones everyone around me knows the answer to (what was your first job, what was your surname when you were a child, etc.) The problem is, in the case of the iPad, your enemy is not some James Bond villain in a cave in Ukraine, it's your 13 year old child who wants to use your account to buy apps, or your spouse during a nasty separation. And they both know, or can guess, answers to "security questions". What I do personally is type random things as the answers, and write them down somewhere. But that doesn't improve security, it weakens it.

Raphmedia 10y ago
I simply type passwords in the answers. "What is your mother's maiden name?" - "gHk899iL@"
- GrinningFool 10y ago
  Annoyingly,some sites have started putting limits and validations on their security question answers...
  - tromp 10y ago
    Imagine the site complaining that your answer has "too much entropy" to be correct...
  - syntheticnature 10y ago
    Ran into one where it demanded I choose from a drop-down list, e.g. "What was your first pet" had "dog", "cat", "hamster", "gerbil", etc. I recall the list having a scrollbar, but there was not even enough choices for eight bits worth of entropy. Oh, and they referred to these security questions as "2FA."

JulianMorrison 10y ago

Imposed passwords aren't the only solution. Something like Google Authenticator is an alternative. Or key fobs. Or send a confirmation code to their phone. Or something like Barclays' PINsentry [1] for cards where you need the gadget, the card and the PIN. Or face recognition, which I recently saw demonstrated (it includes liveness checks like asking you to blink). [1] http://www.barclays.co.uk/Helpsupport/UpgradetoPINsentry/P1242559314766 http://www.barclays.co.uk/Helpsupport/UpgradetoPINsentry/P12...

pbhjpbhj 10y ago
Authenticator is great, but then you get the arsehole effect - every arsehole company decision maker wants you to only use their authenticator. So, I made an account on MS recently and can't use GA because "fuck you user, we won't stop until we own every facet of your digital existence" or something. That shows you where such companies rank security. [FWIW I expect the reverse situation is probably the same, this is just my anecdotal experience].
- Sargos 10y ago
  Assuming MS means Microsoft then you are incorrect. You can use Google Authenticator just fine with Microsoft accounts (because I'm doing it.)
  - pbhjpbhj 10y ago
    Then I apologise, it must be an information 'hiding' issue then because they clearly flagged installing their own Authenticator and I was completely ignorant of the use of GA; GA must be the most popular authenticator? Does this all mean I can use a third-party auth for both MS and Google sites or is it only MS that supports third-party authenticators?
    - Sargos 10y ago
      You can use any authenticator. Authy is actually probably the best nowadays.

paulddraper 10y ago

For what it's worth, the current NIST draft has the exact same recommendations: > Verifiers SHOULD NOT impose other composition rules (e.g., mixtures of different character types) on memorized secrets. > When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example, the list MAY include (but is not limited to): > * Passwords obtained from previous breach corpuses. > * Dictionary words. > * Repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’). > * Context specific words, such as the name of the service, the username, and derivatives thereof. I suppose you could open a pull request :) https://github.com/usnistgov/800-63-3 https://github.com/usnistgov/800-63-3

pps43 10y ago

> if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. There's no substitute for length. "dog" is a bad password. "doooooooooooooooog" is much better. The entropy is still the same, but the latter takes much longer to brute force and is just as easy to remember. Of course one should not use passwords one can remember for anything critical, but many passwords are for services where compromise is not a big deal.

snarf21 10y ago

I agree with what you have said but I think the new guidelines don't go far enough. The biggest problem is that in the balance of security and convenience, users will always opt for convenience. Only via legislation will that change, think credit card chips versus swiping. (We should have chip + PIN in my opinion.) We need to make passwords a much simpler thing to manage so that people don't create a bigger problem by putting it on post-its on their monitor. What I'm suggesting would take some effort but is where we need to go. Your username is your fingerprint. You won't forget that and it is very hard to fake/brute force. (Your phone already has one and a usb one for you computer would be trivial. A lot already have them.) Your password is always just 8 characters, alpha numeric only (62^8 is plenty big) and you must have 2FA on. It would be trivial for the phone manufacturer to add that at the OS level and it could be visible on your lock screen. Also, finally a good use for a smart watch. The rules are simple and you have removed the biggest security hole most companies have: people. Just my two cents....

officelineback 10y ago
2FA is something you know and something you have. So fingerprint gives you part 2 and password gives you part 1. No need for an additional MFA device.
- rosser 10y ago
  No. Your parent's comment is correct: fingerprints should be usernames, not passwords. An MFA device is still warranted.

gist 10y ago

> but if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. That's you. The average user thinks 'nobody will guess this password'. In other words don't assume they know about brute force attacks, rainbow tables, most common password lists and a host of other things that they haven't thought of or don't know even exist. They don't even know the complete group of actors that could potentially breach the account.

problems 10y ago

> if the user getting their password stolen is not a problem for you because it's not your responsibility to handle these issues (like a hacker news account for instance) then just let the user pick whatever they want and deal with the consequences Yes! Please. Let users determine the value of their accounts for themselves. If I decide that say, my HN account isn't valuable and use a common password that is shared with many websites, I know the risk I'm taking and I'd rather take it than have to mark down a unique password for HN. On sites I write I advocate for no password rules at all (hit enter is good enough for me, yes we can hash an empty string), have usually compromised on a simple length check. Proper password storage is important, use the latest bcrypt/scrypt/argon2, don't cheap out there. You can cheap out on password rules. If you want to write a fancy entropy checker, run it client side and tell the user how secure their password is, let them choose whether they want that or not.

dickbasedregex 10y ago

Yes! Left me make my own bad life decisions and get out of my way. Nothing makes me immediately dismiss a site or piece of software faster than nannying me, especially from go.

ifdefdebug 10y ago

> "your bank password is Axei5aoc0i, write it down somewhere safe" "So I send it to my mail account for when I am on the go... that account with the qwerty password..." The point being, you can't really protect users from themselves so a bank can't build it's security model upon the assumption of safe user accounts.

elif 10y ago

yeah i'm on your side. I randomly generated a password one time that ended up with 3 repeated characters. I used it because, hey p-random is p-random i'm not gonna argue. Unfortunately the site it was for rejected it. I've since had to change my random generator to avoid 3 of a kind, which actually makes it less random/secure i believe.. pruned some branches off of the search tree.. especially since i've now told everyone ;)

johnchristopher 10y ago

> Axei5aoc0i I don't want to trust a bank who knows my password.