6 ms·

This is a great article, but it doesn't acknowledge that there is sometimes a tradeoff between security and profit. For example, imagine a typical user who tri

by MarkMc 9y ago

This is a great article, but it doesn't acknowledge that there is sometimes a tradeoff between security and profit. For example, imagine a typical user who tries to choose a password: User: I want my password to be "monkey" System: Sorry, that password is in the dictionary User: OK, I want my password to be "monkey1" System: Sorry, that password is on a list of exposed passwords User: Grrr! OK, I want my password to be "monkeymonkey" System: Sorry, that password is on a list of exposed passwords User: Grrr! OK, I want my password to be "monkeyfuckyou!!!" System: Sorry, that password is on a list of exposed passwords User: Screw this, I'll just sign up with one of your competitors.

shandor 9y ago
The real problem relating to "profit" in these cases is that companies are not penalized at all for leaking their users' secrets, not the fact that security has "tradeoffs". Software industry is in the same boat regarding this as car manufacturers were decades ago, i.e. it was "more profitable" to make cars that killed their passengers in every other car crash, since people were just making the very rational choice of buying the cheaper rather than safer car.
weinzierl 9y ago
It's a usability nightmare. I played a bit with password crackers recently and to me it is still often completely counterintuitive which passwords are easy to crack and which are not. Now good luck explaining that to your users without frustrating them. Take for example '_=$%=_$ _ !'. Why is that a bad password? Because it's in one of the common wordlists (yes, it has two spaces and no, I didn't make that up). That's why I think there should be more focus on the point that users should never produce passwords themselves, but leave that job to a good random generator. This is also something I missed from Troy's otherwise excellent article. What is the point of using a password manager if you only use it to store your weak passwords? I also believe the argument about passwords being memorable is a red herring. It is possible to remember a low number of sufficiently long truly random passwords. It takes effort and it is risky, but it is not impossible. Producing a good password without the help of a random generator on the other hand is simply impossible.
- lostcolony 9y ago
  I have a few sites where this is effectively what happens. They have really bad security to where triggering a password change has them send me a new -password-, not just a link to reset my password. And then it doesn't force me to change the password when logging in. Well, that actually works out (except that the password is too short to survive brute forcing), because I then log in with that, do my business, and move on. Next time, same thing happens, "forgot password". Which presents a much better authentication flow to my mind. Nevermind passwords at all; just focus on whether they own a particular email account. If the email account gets pwned, the attacker can likely log in with them anyway (and if that's an issue you need 2-factor). So rather than force a password at all, send them a verification email, and have that immediately give them a token. If/when the token expires, have the login window require their email address, and send them another link that, when clicked (in the next X amount of time) will log them in with another token. I know for me that would mean -every- account I have is suddenly 2-factor (since my email account is), they all have strong security (since my email has a long, complicated, hard to brute force password that I keep only in my head; it's the only one like that), and I'd stop having to rely on a password manager. Curious if there's any obvious flaws that I'm missing.
  - onli 9y ago
    No, you missed nothing, that scheme works. Add a bit of OAuth magic to support direct logins for gmail, and you basically described portier (https://portier.github.io/ https://portier.github.io/), a successor project for Mozillas Persona.
    - lostcolony 9y ago
      Thanks, I'll check that out!
  - 0xffff2 9y ago
    >Curious if there's any obvious flaws that I'm missing. The obvious flaw is that email is not instantaneous. https://luxsci.com/blog/why-email-is-not-instantaneous-and-not-supposed-to-be.html https://luxsci.com/blog/why-email-is-not-instantaneous-and-n...
shkkmo 9y ago
This seem like a a relatively easy problem to solve: User: I want my password to be "monkey" System: Sorry, that password is in the dictionary. May we suggest one of these strong client side generated passwords? ... User: OK, I want my password to be "monkey1" System: Sorry, that password is on a list of exposed passwords. May we suggest one of these strong client side generated passwords? ...
- ivanbakel 9y ago
  Then your user has to remember one of the generated passwords, which is going to be more difficult than one that they came up with.
  - morgante 9y ago
    Users shouldn't be memorizing passwords in the first place.
    - wst_ 9y ago
      Tell that to the user.
      - morgante 9y ago
        Good advice. I think it's a great idea for sites to encourage adoption of password managers.
  - shkkmo 9y ago
    No, they don't but you give them an option. It's only a suggestion for a password that will work and you can use any of a variety of tools that generates passwords that a not that hard to remember.

by MarkMc 9y ago

shandor 9y ago

The real problem relating to "profit" in these cases is that companies are not penalized at all for leaking their users' secrets, not the fact that security has "tradeoffs". Software industry is in the same boat regarding this as car manufacturers were decades ago, i.e. it was "more profitable" to make cars that killed their passengers in every other car crash, since people were just making the very rational choice of buying the cheaper rather than safer car.

weinzierl 9y ago

It's a usability nightmare. I played a bit with password crackers recently and to me it is still often completely counterintuitive which passwords are easy to crack and which are not. Now good luck explaining that to your users without frustrating them. Take for example '_=$%=_$ _ !'. Why is that a bad password? Because it's in one of the common wordlists (yes, it has two spaces and no, I didn't make that up). That's why I think there should be more focus on the point that users should never produce passwords themselves, but leave that job to a good random generator. This is also something I missed from Troy's otherwise excellent article. What is the point of using a password manager if you only use it to store your weak passwords? I also believe the argument about passwords being memorable is a red herring. It is possible to remember a low number of sufficiently long truly random passwords. It takes effort and it is risky, but it is not impossible. Producing a good password without the help of a random generator on the other hand is simply impossible.

lostcolony 9y ago
I have a few sites where this is effectively what happens. They have really bad security to where triggering a password change has them send me a new -password-, not just a link to reset my password. And then it doesn't force me to change the password when logging in. Well, that actually works out (except that the password is too short to survive brute forcing), because I then log in with that, do my business, and move on. Next time, same thing happens, "forgot password". Which presents a much better authentication flow to my mind. Nevermind passwords at all; just focus on whether they own a particular email account. If the email account gets pwned, the attacker can likely log in with them anyway (and if that's an issue you need 2-factor). So rather than force a password at all, send them a verification email, and have that immediately give them a token. If/when the token expires, have the login window require their email address, and send them another link that, when clicked (in the next X amount of time) will log them in with another token. I know for me that would mean -every- account I have is suddenly 2-factor (since my email account is), they all have strong security (since my email has a long, complicated, hard to brute force password that I keep only in my head; it's the only one like that), and I'd stop having to rely on a password manager. Curious if there's any obvious flaws that I'm missing.
- onli 9y ago
  No, you missed nothing, that scheme works. Add a bit of OAuth magic to support direct logins for gmail, and you basically described portier (https://portier.github.io/ https://portier.github.io/), a successor project for Mozillas Persona.
  - lostcolony 9y ago
    Thanks, I'll check that out!
- 0xffff2 9y ago
  >Curious if there's any obvious flaws that I'm missing. The obvious flaw is that email is not instantaneous. https://luxsci.com/blog/why-email-is-not-instantaneous-and-not-supposed-to-be.html https://luxsci.com/blog/why-email-is-not-instantaneous-and-n...

shkkmo 9y ago

This seem like a a relatively easy problem to solve: User: I want my password to be "monkey" System: Sorry, that password is in the dictionary. May we suggest one of these strong client side generated passwords? ... User: OK, I want my password to be "monkey1" System: Sorry, that password is on a list of exposed passwords. May we suggest one of these strong client side generated passwords? ...

ivanbakel 9y ago
Then your user has to remember one of the generated passwords, which is going to be more difficult than one that they came up with.
- morgante 9y ago
  Users shouldn't be memorizing passwords in the first place.
  - wst_ 9y ago
    Tell that to the user.
    - morgante 9y ago
      Good advice. I think it's a great idea for sites to encourage adoption of password managers.
- shkkmo 9y ago
  No, they don't but you give them an option. It's only a suggestion for a password that will work and you can use any of a variety of tools that generates passwords that a not that hard to remember.