4 ms·

What this shows is that even with best practices passwords are a fairly weak security control. We need a standardised second factor id. The FCC or correspondi

by dzdt 9y ago

What this shows is that even with best practices passwords are a fairly weak security control. We need a standardised second factor id. The FCC or corresponding body elsewhere should mandate that phone networks and phones support a secure messenging protocol which could guarantee that a message could be sent to a phone number and only be received by that device. Password-only authentication is like locks on luggage, even with best practices.

swsieber 9y ago
Well, between Google authenticator (and apps like it) and keybase, it seems pretty much covered.
criddell 9y ago
Steve Gibson's SQRL project is pretty interesting. Right now I use TOTP whenever possible, but I think SQRL looks promising.
Ajedi32 9y ago
> We need a standardised second factor id We've already got TOTP (RFC6238) and U2F. At this point it's just a matter of adoption.
raesene9 9y ago
I'm not sure why you think this article shows that with best practice passwords, it's a relatively weak control? From the article a user choosing a random (i.e. not in wordlists) 8 character password with upper/lower/numeric characters could expect an attacker to take 3 years to crack the password (and that's attacking one hash!) Now to be clear, I totally think that passwords are a bad idea (mainly because humans aren't well equipped to choose and manage large numbers of random strings) but I don't really see why this article advances that concept?
- dzdt 9y ago
  Quoth the article: A very motivated attacker, or one with a sophisticated set of wordlists and masks, could eventually recover 39 × 16 = 624 passwords, or about five percent of the total users. That's reasonable, but higher than I would like.
  - raesene9 9y ago
    Sure so the attacker has entirely compromised the site in the first place, offline brute-force only works where the attacker has already got a copy of the database. They've then eventually got access to 5% of the user's passwords, and the one's they got access to were all based on dictionary words... Assuming that the site has any level of reactive/detective controls, they've noticed the breach and invalidated the passwords, thus rendering them useless. What I'm saying is the offline password cracking times demonstrated in this article don't seem to indicate any more weakness in the use of passwords than was already known. the percentage of attackers who are going to bother with hitting a PBKDF2'ed password database on a forum site with any level of dedicated cracking past a run with some dictionaries, just isn't that high. Attackers are drowning in existing compromised password databases already many/most of which exposed clear-text or weakly hashed (MD5/SHA-1 with no salt) passwords, so realistically speaking the incentives for getting another set where you really have to work hard to get them, isn't likely to be that high unless it's a high value site. If you want examples just look at the lists on https://haveibeenpwned.com/ https://haveibeenpwned.com/ 500 million accounts with cleartext passwords from a single dump is at the top of the list. That said, I admire discourses efforts to move the bar higher by increasing complexity and blocking weak passwords, all helps people move away from less secure alterntives
    - codinghorror 9y ago
      well yes, that's true, you don't need to outrun the bear, you just need to outrun the person in front of you ;) Easy targets will always been compromised first.
      - raesene9 9y ago
        strong password hashing definitely has it's place as part of overall app. security. Where I think many/most applications would benefit from more security is in detecting/reacting to attacks. Most apps have no controls in this line at all, and make an attackers life very easy in that they can keep trying vast numbers of attacks without being blocked by the application. There's been some decent foundational work done on this by things like OWASP AppSensor (https://www.owasp.org/index.php/OWASP_AppSensor_Project https://www.owasp.org/index.php/OWASP_AppSensor_Project) but I've not seen many applications actually implement the guidance...

by dzdt 9y ago

swsieber 9y ago

Well, between Google authenticator (and apps like it) and keybase, it seems pretty much covered.

criddell 9y ago

Steve Gibson's SQRL project is pretty interesting. Right now I use TOTP whenever possible, but I think SQRL looks promising.

Ajedi32 9y ago

> We need a standardised second factor id We've already got TOTP (RFC6238) and U2F. At this point it's just a matter of adoption.

raesene9 9y ago

I'm not sure why you think this article shows that with best practice passwords, it's a relatively weak control? From the article a user choosing a random (i.e. not in wordlists) 8 character password with upper/lower/numeric characters could expect an attacker to take 3 years to crack the password (and that's attacking one hash!) Now to be clear, I totally think that passwords are a bad idea (mainly because humans aren't well equipped to choose and manage large numbers of random strings) but I don't really see why this article advances that concept?

dzdt 9y ago
Quoth the article: A very motivated attacker, or one with a sophisticated set of wordlists and masks, could eventually recover 39 × 16 = 624 passwords, or about five percent of the total users. That's reasonable, but higher than I would like.
- raesene9 9y ago
  Sure so the attacker has entirely compromised the site in the first place, offline brute-force only works where the attacker has already got a copy of the database. They've then eventually got access to 5% of the user's passwords, and the one's they got access to were all based on dictionary words... Assuming that the site has any level of reactive/detective controls, they've noticed the breach and invalidated the passwords, thus rendering them useless. What I'm saying is the offline password cracking times demonstrated in this article don't seem to indicate any more weakness in the use of passwords than was already known. the percentage of attackers who are going to bother with hitting a PBKDF2'ed password database on a forum site with any level of dedicated cracking past a run with some dictionaries, just isn't that high. Attackers are drowning in existing compromised password databases already many/most of which exposed clear-text or weakly hashed (MD5/SHA-1 with no salt) passwords, so realistically speaking the incentives for getting another set where you really have to work hard to get them, isn't likely to be that high unless it's a high value site. If you want examples just look at the lists on https://haveibeenpwned.com/ https://haveibeenpwned.com/ 500 million accounts with cleartext passwords from a single dump is at the top of the list. That said, I admire discourses efforts to move the bar higher by increasing complexity and blocking weak passwords, all helps people move away from less secure alterntives
  - codinghorror 9y ago
    well yes, that's true, you don't need to outrun the bear, you just need to outrun the person in front of you ;) Easy targets will always been compromised first.
    - raesene9 9y ago
      strong password hashing definitely has it's place as part of overall app. security. Where I think many/most applications would benefit from more security is in detecting/reacting to attacks. Most apps have no controls in this line at all, and make an attackers life very easy in that they can keep trying vast numbers of attacks without being blocked by the application. There's been some decent foundational work done on this by things like OWASP AppSensor (https://www.owasp.org/index.php/OWASP_AppSensor_Project https://www.owasp.org/index.php/OWASP_AppSensor_Project) but I've not seen many applications actually implement the guidance...