4 ms·

> I think the problem is that people don't understand how to use passwords From the looks of it, neither do the authenticators. The capital letter + symbol + n

by screye 8y ago

> I think the problem is that people don't understand how to use passwords From the looks of it, neither do the authenticators. The capital letter + symbol + number requirement had led to the current predicament. Just asking for really long passwords would have been a lot better. As it stands, people either use a predictable string of num-symbol to satisfy requirements or remember that one strong password,.which qualifies for all of the above. Software like Lastpass are great, but I don't always have access to them. They also make all of my.online security have a single point of failure. I think it would be a lot better if companies just changed password requirements to a decently large length eg: min 20. This eliminates the likely hood of password like abc123, qwerty and the oh so lovely "password".

hyperpape 8y ago
Just by itself, long passwords will result in people using "franklymydearIdontgiveadamn" and other things susceptible to a dictionary attack. Long passwords plus a bad password check (https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/ https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...) might suffice. However, without that check, I suspect requiring special characters marginally improves entropy in practice.
- guitarbill 8y ago
  Pretty much everybody I know and asked in the office just sticks some punctuation at the end, e.g. "Passw0rd$". IDK how much of an "improvement" that is, compared to e.g. 4 extra characters.
  - hyperpape 8y ago
    That's definitely a thing, and you're right, it doesn't add much entropy (people choose from a few numbers, a few special characters, not that many substitutions). Four extra characters that are truly random (even just out of 26 letters) is way better. However, that's not the alternative I'm worried about. I'm worried about people using phrases that will be in the first few thousand entries in a phrase dictionary.
- beatgammit 8y ago
  And that's still better than a crappy, short password. I use lyrics, quotes, etc for my important passwords (password manager, email, etc), and my passwords are >20 characters (usually >30) and really easy to remember (and I can secure it by placing one extra symbol in there). The attacker doesn't know what I'm using for my password, so they have to attack all valid combinations up to the max length the server supports.
  - hyperpape 8y ago
    Song lyrics are not safe https://arstechnica.com/information-technology/2013/08/thereisnofatebutwhatwemake-turbo-charged-cracking-comes-to-long-passwords/ https://arstechnica.com/information-technology/2013/08/there... I don’t know exactly where the breakeven point is, but there is some point where a song lyric or other phrase provides less entropy than a relatively short password. Bottom line: use a lot of random ascii characters(at least 14 or 16, or 4 random words) and you’re probably set. Use less, or a found phrase and it’s not good.
    - acdha 8y ago
      You can't talk about safe without a threat-model, especially distinguishing between whether you're trying to prevent offline attacks against stored data or brute-forcing a running login system. If you can rate-limit many things are fine, especially if you have some confirmations at key points (“Your account was just accessed from …”) with restrictions which make it hard for an attacker to permanently wrest control of the account or incur large costs immediately after gaining access — think about how Amazon.com doesn't require 30 character passwords because adding a new shipping address requires you to re-confirm the credit card information first.
      - hyperpape 8y ago
        That's definitely true, though you can simplify matters by saying "I'm always going to try to have passwords that are safe against offline attacks".
WorldMaker 8y ago
People aren't good at memorizing long lists of things, so just requiring long passwords isn't sufficient unless you are willing to also allow everyone to use the same password everywhere, and that's worse than the single point of failure problem than password managers because that's a distributed point of failure (just one breach of any site/application that you use; your security there is only as good as the weakest link).
- TremendousJudge 8y ago
  >People aren't good at memorizing long lists of things It's much easier to remember a 40 character passphrase of real words than a 12 character password of random symbols including punctuation
  - ryan-c 8y ago
    A 40 character password of real words is usually easier to crack than a random 12 character string, though.
    - guitarbill 8y ago
      Citation needed (that sounds wrong without seeing the maths). But also missing the point. It just has to be better than the usual 8 + some punctuation at the end that most people resort to when faced with these shitty, asinine password rules.
      - ryan-c 8y ago
        English words are ~1.5 bits per character, random ascii garbage is ~6.5 bits per character.
        jrockway 8y ago
        It really starts to depend on the details. If there are 10,000 words and you use 5 of them, that is 1.1x more than 12 characters where you only use lowercase letters, numbers, and shifted numbers. Tweak the allowed symbols, length, and your dictionary and you can make either one look better than the other. I think there are probably less than 10,000 words that people would choose for their password, and that people use capital letters... maybe, but don't use 12 character passwords (8 more reasonable) so it could really go either way.
tomjen3 8y ago
The problem with that is that in quite some cases I don't care about the security so I can just use a crap password. But a sufficiently long password could literally just be 'a', repeated. Would that really be more secure? Honestly if you want somebody to have a secure password, make it for them and e-mail it to 'em. Virtually no chance they are going to use it for anything else, and if somebody has their e-mail, they can recreate one anyway.

by screye 8y ago

hyperpape 8y ago

Just by itself, long passwords will result in people using "franklymydearIdontgiveadamn" and other things susceptible to a dictionary attack. Long passwords plus a bad password check (https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/ https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...) might suffice. However, without that check, I suspect requiring special characters marginally improves entropy in practice.

guitarbill 8y ago
Pretty much everybody I know and asked in the office just sticks some punctuation at the end, e.g. "Passw0rd$". IDK how much of an "improvement" that is, compared to e.g. 4 extra characters.
- hyperpape 8y ago
  That's definitely a thing, and you're right, it doesn't add much entropy (people choose from a few numbers, a few special characters, not that many substitutions). Four extra characters that are truly random (even just out of 26 letters) is way better. However, that's not the alternative I'm worried about. I'm worried about people using phrases that will be in the first few thousand entries in a phrase dictionary.
beatgammit 8y ago
And that's still better than a crappy, short password. I use lyrics, quotes, etc for my important passwords (password manager, email, etc), and my passwords are >20 characters (usually >30) and really easy to remember (and I can secure it by placing one extra symbol in there). The attacker doesn't know what I'm using for my password, so they have to attack all valid combinations up to the max length the server supports.
- hyperpape 8y ago
  Song lyrics are not safe https://arstechnica.com/information-technology/2013/08/thereisnofatebutwhatwemake-turbo-charged-cracking-comes-to-long-passwords/ https://arstechnica.com/information-technology/2013/08/there... I don’t know exactly where the breakeven point is, but there is some point where a song lyric or other phrase provides less entropy than a relatively short password. Bottom line: use a lot of random ascii characters(at least 14 or 16, or 4 random words) and you’re probably set. Use less, or a found phrase and it’s not good.
  - acdha 8y ago
    You can't talk about safe without a threat-model, especially distinguishing between whether you're trying to prevent offline attacks against stored data or brute-forcing a running login system. If you can rate-limit many things are fine, especially if you have some confirmations at key points (“Your account was just accessed from …”) with restrictions which make it hard for an attacker to permanently wrest control of the account or incur large costs immediately after gaining access — think about how Amazon.com doesn't require 30 character passwords because adding a new shipping address requires you to re-confirm the credit card information first.
    - hyperpape 8y ago
      That's definitely true, though you can simplify matters by saying "I'm always going to try to have passwords that are safe against offline attacks".

WorldMaker 8y ago

People aren't good at memorizing long lists of things, so just requiring long passwords isn't sufficient unless you are willing to also allow everyone to use the same password everywhere, and that's worse than the single point of failure problem than password managers because that's a distributed point of failure (just one breach of any site/application that you use; your security there is only as good as the weakest link).

TremendousJudge 8y ago
>People aren't good at memorizing long lists of things It's much easier to remember a 40 character passphrase of real words than a 12 character password of random symbols including punctuation
- ryan-c 8y ago
  A 40 character password of real words is usually easier to crack than a random 12 character string, though.
  - guitarbill 8y ago
    Citation needed (that sounds wrong without seeing the maths). But also missing the point. It just has to be better than the usual 8 + some punctuation at the end that most people resort to when faced with these shitty, asinine password rules.
    - ryan-c 8y ago
      English words are ~1.5 bits per character, random ascii garbage is ~6.5 bits per character.
      - jrockway 8y ago
        It really starts to depend on the details. If there are 10,000 words and you use 5 of them, that is 1.1x more than 12 characters where you only use lowercase letters, numbers, and shifted numbers. Tweak the allowed symbols, length, and your dictionary and you can make either one look better than the other. I think there are probably less than 10,000 words that people would choose for their password, and that people use capital letters... maybe, but don't use 12 character passwords (8 more reasonable) so it could really go either way.

tomjen3 8y ago

The problem with that is that in quite some cases I don't care about the security so I can just use a crap password. But a sufficiently long password could literally just be 'a', repeated. Would that really be more secure? Honestly if you want somebody to have a secure password, make it for them and e-mail it to 'em. Virtually no chance they are going to use it for anything else, and if somebody has their e-mail, they can recreate one anyway.