5 ms·

> Enforce a password policy > (links to https://www.digicert.com/blog/creating-password-policy-best-practices/ https://www.digicert.com/blog/creating-password-

by jupp0r 7y ago

> Enforce a password policy > (links to https://www.digicert.com/blog/creating-password-policy-best-practices/ https://www.digicert.com/blog/creating-password-policy-best-...) where they give the usual (at least 2 special characters, but not " or \) advice This is counterproductive and is actually discouraged by the latest NIST guidelines, that prefer passwords that are easy to remember, but still hard to guess [1]. [1] https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/ https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

ddxxdd 7y ago
What does NIST have to say about passwords like CorrectHorseBatteryStaple [0] that can be easily cracked by brute-forcing concatenations of dictionary words? [0] https://xkcd.com/936/ https://xkcd.com/936/
- cardine 7y ago
  Even if you knew the pattern, four random lowercase dictionary words (assuming a dictionary size of 50,000 words) would take longer to crack than a randomly generated 10 digit password with letters, numbers, and special characters. 50,000^4 > (26+26+10+10)^10
  - jupp0r 7y ago
    This is really dependent on the size of the dictionary.
    - bhelkey 7y ago
      > assuming a dictionary size of 50,000 words
    - cardine 7y ago
      If your dictionary is smaller than 50,000 words, all you would have to do is add another word. 10,000^5 > 50,000^4
  - montecarl 7y ago
    Its not quite fair to assume that people are choosing randomly from 50k words. Here is what those passwords look like. I excluded proper nouns and possessives. If you want to try, this command works on Ubuntu: echo $(cat /usr/share/dict/american-english | grep -v \' | egrep -v '[A-Z].*' | shuf -n 4 | tr '\n' ' ') trawled scratch protract sagings perpetuates barium entreated credits integrals virago chronicled weathercocks foremasts milkmaid bashful maddened disposes shrunk propose stanchion midwived romantics gallbladders spotlighted
    - deleted 7y ago
      [deleted]
    - j88439h84 7y ago
      What is the size of that dictionary?
      - montecarl 7y ago
        About 60k words.
    - codetrotter 7y ago
      Good point. The EFF has made and published three lists of words to use that are easy to spell and generally easy to remember. I wrote a command-line tool in Rust for generating passphrase using these wordlists. I use it myself any time I need a password. My tool is fast, free of charge, open source and it can also tell you the entropy that will result for any given choice of number of words. For example let’s say I want it to give me four words from the long wordlist, and I want to know how many bits of entropy this corresponds to. pgen -l -n 4 -e Current settings will create passphrases with 51.70 bits of entropy. 51.70 bits of entropy. What does that mean, you might ask. The Wikipedia article on password strength (https://en.wikipedia.org/wiki/Password_strength https://en.wikipedia.org/wiki/Password_strength) explains it well: > A password with an entropy of 42 bits calculated in this way would be as strong as a string of 42 bits chosen randomly, for example by a fair coin toss. Put another way, a password with an entropy of 42 bits would require 2^42 (4,398,046,511,104) attempts to exhaust all possibilities during a brute force search. Thus, by increasing the entropy of the password by one bit the number of guesses required doubles, making an attacker's task twice as difficult. On average, an attacker will have to try half the possible number of passwords before finding the correct one. Ok, so how good is 51.70 bits of entropy, you ask? Wikipedia, same article again: > The minimum number of bits of entropy needed for a password depends on the threat model for the given application. [...] RFC 4086, "Randomness Requirements for Security", presents some example threat models and how to calculate the entropy desired for each one. Their answers vary between 29 bits of entropy needed if only online attacks are expected, and up to 96 bits of entropy needed for important cryptographic keys used in applications like encryption where the password or key needs to be secure for a long period of time and stretching isn't applicable. So let's say that you are satisfied with 51.70 bits of entropy in this case. What does a password like that look like? Let's generate one. pgen -l -n 4 plastic case refocus demise Pretty memorable if you ask me :) Oh yeah, and about the claim that it's fast. Just how fast is it? Have a look. time pgen -l -n 4 browbeat hummus sandbox unfixable real 0m0.005s user 0m0.001s sys 0m0.006s That's 5 milliseconds. But hey, let's say we wanted to generate a bunch of passphrases at once. How much time does it take to generate 10.000 passphrases and dump them into a text file? time pgen -l -n 4 -k 10000 > 10k.txt real 0m0.132s user 0m0.073s sys 0m0.058s About zero point one seconds. Not that generating 10.000 passphrases is something that you are likely to do, but it just speaks to how fast this tool is ^^ Source and instructions on how to install it are on GitHub. https://github.com/ctsrc/Pgen https://github.com/ctsrc/Pgen
  - txcwpalpha 7y ago
    It would be very interesting to see the results of a study asking people to come up with a list of random words. I really doubt that the actual dictionary size would be anywhere near 50k, and probably would have a high frequency of common words like 'apple', 'house', 'food' etc, making them easier to crack, and almost no frequency of less common words.
    - deleted 7y ago
      [deleted]
    - dyu 7y ago
      the assumption is you do not come up with your own words, and pick words at random from the whole dictionary.
      - txcwpalpha 7y ago
        I'm not sure I agree with that assumption, as the entire purpose of a passphrase of words rather than a password of random characters is that the passphrase should be easier to remember. If you're randomly picking words like 'gargarize-youster-noctivagant-axilla', it's not exactly accomplishing that purpose very well. It's also a huge PITA to type in, which based on my experience in the IAM space, is an immediate dealbreaker.
        lstamour 7y ago
        I’d rather pick from obscure words I know than at random. In my case the words might lean tech/business/news/sports, but I’m sure I could come up with a good list. It might be interesting to try and generate passwords from a corpus of email and/or browsing history... assuming you blacklist sensitive subjects.
        bigiain 7y ago
        I let my password manager pick words for me, and I keep hitting refresh until I get one that I think I'm likely to get the spelling correct when needed. 1Password just gave me this: land convolve witchery bequest Having said that, since I use 1Password, these are rare and almost exclusively used for things where I need very-short-term memorable passphrases for things that won't let me copy/paste from 1Password (like my Apple ID or the passwords my bank ask me for over the phone...) Everything else just gets 25 random chars (or the maximum number of chars the input will allow).
  - danielbarla 7y ago
    What I find interesting about the XKCD is that the entropy analysis is basically spot-on, even very generous towards the opposition. It shows that a) the typical "strong password" that people pick is not truly random (i.e. not 26+26+10+10, but worse), and b) that under these conditions even a 4-length pass phrase picked from a measly dictionary of 2048 words is better. (This is probably an even more interesting / compelling argument.) Yet somehow, each time the XKCD is posted, someone will "point out" that pass phrases can be dictionary attacked, which is kind of like me saying "I know which letters are on your keyboard, and can therefore brute force your password!", but not having done the math beyond that.
- jupp0r 7y ago
  Quoting: When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example, the list MAY include, but is not limited to: - Passwords obtained from previous breach corpuses. - Dictionary words. - Repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’). - Context-specific words, such as the name of the service, the username, and derivatives thereof. [1] https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html
  - dllthomas 7y ago
    If I read that correctly, it's about comparing the entire password, not portions thereof, so it's not really about "multiple English word" passwords (except that I assume "passwords obtained from previous breach corpuses" is likely to contain some specific examples of the breed, almost certainly including "correct horse battery staple").
- wiml 7y ago
  They can't be, unless you generate them badly. A diceware passphrase has 6^6 possibilities ≈ 15 bits of entropy per word, so an unremarkable 5-word password has 77 bits of entropy — generally good enough — and if you have a high value target that might be susceptible to offline attacks, 90-100 bit passwords are still pretty easy to remember. I wish people wouldn't use XKCD as the go-to reference for "collection of randomly selected words"-style passwords; it always seems to leave people confused about why the technique works.
- dllthomas 7y ago
  > easily cracked by brute-forcing concatenations of dictionary words This is probably misleading (and possibly confused). Diceware style passphrases are easily brute forced relative to a random passphrase of the same length but that doesn't mean they're "easily brute forced". Assume your attacker knows how you're constructing your password, estimate the amount of entropy, and be sure it's enough. 44 bits is low for offline attacks, but (as the comic points out) still better than a lot of passwords people use even when they're trying to make a good password and following NIST guidelines. If you use 5 words and draw from a longer list, it's easy to be solidly out of the range that's crackable on modern hardware.
ZebZ 7y ago
Easy to remember high-entropy pass phrases still makes the most sense to me, with maybe a number or symbol thrown in somewhere for added extra oomph. correct horse 19 battery staple https://xkcd.com/936/ https://xkcd.com/936/
- PopeDotNinja 7y ago
  Just don't use that as the key to generate your BitCoin address. I saw a funny video, can't remember where, where a guy does that to prove a point. He sends a small amount of BitCoin to the wallet address, and someone steals it within seconds.
  - huehehue 7y ago
    There's an article floating around about Ethereum private keys, where people use "0x[...]0000" or "0x[...]0314" or what have you. You can check the corresponding public addresses on Etherscan and see funds being systematically siphoned out by the same few accounts.
orev 7y ago
Starting to feel like this is one of those things that people just blindly parrot all over the Internet without understanding the full context of the NIST guidelines, and as a result are actually causing many security problems. You can’t take one recommendation that you like out of a whole body of work and start running around telling everyone to do this one thing. If you’re going to follow NIST, you need to do all of it. MFA is a big part of why complexity is reduced in the NIST guide, and you MUST have it if you’re going to remove complexity requirements. If you can’t have MFA for some reason (and yes, there are legitimate reasons for this), then you still need to use complexity, expiration, etc.
- technion 7y ago
  If for some reason you're stuck without MFA (and I appreciate why it happens), I can't agree short expiration adds value. I've done brute force exercises. Some people always pick bad passwords. Tell an organisation to change every 60 days and a lot more people give up and land on May2019!.
  - privateSFacct 7y ago
    This 100%. I have a complicated google password - I use it no where else. I have a security key. In 12 years I've NEVER had to change my google account password AND I have not been hacked. This works well. Because google is resistant to brute force I don't even bother adding tons of weird special characters. I worked at a govt related agency. They had to change passwords every 30 days and there was a dual password requirement (one to login to the VPN, the next for the app). Result? - Many folks used a shared account with a public password emailed out every 30 days so everyone else did not have to deal with all the hassles of the password expiration dance. It was also super hard to onboard anyone new (ie, 3-4 months for staff with 12 month projects) This account ended up posted next to every computer. The idea that making security so user unfriendly will makes folks like and use security is a ridiculous approach. - Rate limit attempts - Block after 4 tries for an hour, after 8 tries till a reset - Screen against password lists - Screen out other obviously bad (ie, too short etc). - Allow hardware 2fa BUT allow staff to validate computer. This alone gets you a ton of mileage
snarfy 7y ago
At least 8 characters, upper and lower, numbers and symbols... that advice is from the 70s [1] [1] - https://security.stackexchange.com/questions/33470/what-technical-reasons-are-there-to-have-low-maximum-password-lengths/33471#33471 https://security.stackexchange.com/questions/33470/what-tech...
ZeroMinx 7y ago
fourwordsalluppercase
- Legogris 7y ago
  ONE WORD ALL LOWERCASE
someonehere 7y ago
Yeah but when you partner with companies, they sometimes force your company to adhere to those ancient guidelines. I’ve worked for companies where they ask for the out of date NIST stuff you mention and it’s either you follow what they ask or you lose out on a deal to fund your company.
- DKnoll 7y ago
  If you require PCI DSS compliance it won't fly either. https://pcipolicyportal.com/blog/pci-compliance-password-requirements-best-practices-know/ https://pcipolicyportal.com/blog/pci-compliance-password-req...
  - yaleman 7y ago
    If you require PCI DSS I hope you're not just blindly following some random post on hackernews for your policy ;)
    - DKnoll 7y ago
      I'm not, that's why I know PCI DSS requirements off-hand.
  - downtown_ 7y ago
    No. You can use NIST guidance and are not required to change your password every 90 days

by jupp0r 7y ago

ddxxdd 7y ago

What does NIST have to say about passwords like CorrectHorseBatteryStaple [0] that can be easily cracked by brute-forcing concatenations of dictionary words? [0] https://xkcd.com/936/ https://xkcd.com/936/

cardine 7y ago
Even if you knew the pattern, four random lowercase dictionary words (assuming a dictionary size of 50,000 words) would take longer to crack than a randomly generated 10 digit password with letters, numbers, and special characters. 50,000^4 > (26+26+10+10)^10
- jupp0r 7y ago
  This is really dependent on the size of the dictionary.
  - bhelkey 7y ago
    > assuming a dictionary size of 50,000 words
  - cardine 7y ago
    If your dictionary is smaller than 50,000 words, all you would have to do is add another word. 10,000^5 > 50,000^4
- montecarl 7y ago
  Its not quite fair to assume that people are choosing randomly from 50k words. Here is what those passwords look like. I excluded proper nouns and possessives. If you want to try, this command works on Ubuntu: echo $(cat /usr/share/dict/american-english | grep -v \' | egrep -v '[A-Z].*' | shuf -n 4 | tr '\n' ' ') trawled scratch protract sagings perpetuates barium entreated credits integrals virago chronicled weathercocks foremasts milkmaid bashful maddened disposes shrunk propose stanchion midwived romantics gallbladders spotlighted
  - deleted 7y ago
    [deleted]
  - j88439h84 7y ago
    What is the size of that dictionary?
    - montecarl 7y ago
      About 60k words.
  - codetrotter 7y ago
    Good point. The EFF has made and published three lists of words to use that are easy to spell and generally easy to remember. I wrote a command-line tool in Rust for generating passphrase using these wordlists. I use it myself any time I need a password. My tool is fast, free of charge, open source and it can also tell you the entropy that will result for any given choice of number of words. For example let’s say I want it to give me four words from the long wordlist, and I want to know how many bits of entropy this corresponds to. pgen -l -n 4 -e Current settings will create passphrases with 51.70 bits of entropy. 51.70 bits of entropy. What does that mean, you might ask. The Wikipedia article on password strength (https://en.wikipedia.org/wiki/Password_strength https://en.wikipedia.org/wiki/Password_strength) explains it well: > A password with an entropy of 42 bits calculated in this way would be as strong as a string of 42 bits chosen randomly, for example by a fair coin toss. Put another way, a password with an entropy of 42 bits would require 2^42 (4,398,046,511,104) attempts to exhaust all possibilities during a brute force search. Thus, by increasing the entropy of the password by one bit the number of guesses required doubles, making an attacker's task twice as difficult. On average, an attacker will have to try half the possible number of passwords before finding the correct one. Ok, so how good is 51.70 bits of entropy, you ask? Wikipedia, same article again: > The minimum number of bits of entropy needed for a password depends on the threat model for the given application. [...] RFC 4086, "Randomness Requirements for Security", presents some example threat models and how to calculate the entropy desired for each one. Their answers vary between 29 bits of entropy needed if only online attacks are expected, and up to 96 bits of entropy needed for important cryptographic keys used in applications like encryption where the password or key needs to be secure for a long period of time and stretching isn't applicable. So let's say that you are satisfied with 51.70 bits of entropy in this case. What does a password like that look like? Let's generate one. pgen -l -n 4 plastic case refocus demise Pretty memorable if you ask me :) Oh yeah, and about the claim that it's fast. Just how fast is it? Have a look. time pgen -l -n 4 browbeat hummus sandbox unfixable real 0m0.005s user 0m0.001s sys 0m0.006s That's 5 milliseconds. But hey, let's say we wanted to generate a bunch of passphrases at once. How much time does it take to generate 10.000 passphrases and dump them into a text file? time pgen -l -n 4 -k 10000 > 10k.txt real 0m0.132s user 0m0.073s sys 0m0.058s About zero point one seconds. Not that generating 10.000 passphrases is something that you are likely to do, but it just speaks to how fast this tool is ^^ Source and instructions on how to install it are on GitHub. https://github.com/ctsrc/Pgen https://github.com/ctsrc/Pgen
- txcwpalpha 7y ago
  It would be very interesting to see the results of a study asking people to come up with a list of random words. I really doubt that the actual dictionary size would be anywhere near 50k, and probably would have a high frequency of common words like 'apple', 'house', 'food' etc, making them easier to crack, and almost no frequency of less common words.
  - deleted 7y ago
    [deleted]
  - dyu 7y ago
    the assumption is you do not come up with your own words, and pick words at random from the whole dictionary.
    - txcwpalpha 7y ago
      I'm not sure I agree with that assumption, as the entire purpose of a passphrase of words rather than a password of random characters is that the passphrase should be easier to remember. If you're randomly picking words like 'gargarize-youster-noctivagant-axilla', it's not exactly accomplishing that purpose very well. It's also a huge PITA to type in, which based on my experience in the IAM space, is an immediate dealbreaker.
      - lstamour 7y ago
        I’d rather pick from obscure words I know than at random. In my case the words might lean tech/business/news/sports, but I’m sure I could come up with a good list. It might be interesting to try and generate passwords from a corpus of email and/or browsing history... assuming you blacklist sensitive subjects.
        bigiain 7y ago
        I let my password manager pick words for me, and I keep hitting refresh until I get one that I think I'm likely to get the spelling correct when needed. 1Password just gave me this: land convolve witchery bequest Having said that, since I use 1Password, these are rare and almost exclusively used for things where I need very-short-term memorable passphrases for things that won't let me copy/paste from 1Password (like my Apple ID or the passwords my bank ask me for over the phone...) Everything else just gets 25 random chars (or the maximum number of chars the input will allow).
- danielbarla 7y ago
  What I find interesting about the XKCD is that the entropy analysis is basically spot-on, even very generous towards the opposition. It shows that a) the typical "strong password" that people pick is not truly random (i.e. not 26+26+10+10, but worse), and b) that under these conditions even a 4-length pass phrase picked from a measly dictionary of 2048 words is better. (This is probably an even more interesting / compelling argument.) Yet somehow, each time the XKCD is posted, someone will "point out" that pass phrases can be dictionary attacked, which is kind of like me saying "I know which letters are on your keyboard, and can therefore brute force your password!", but not having done the math beyond that.
jupp0r 7y ago
Quoting: When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example, the list MAY include, but is not limited to: - Passwords obtained from previous breach corpuses. - Dictionary words. - Repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’). - Context-specific words, such as the name of the service, the username, and derivatives thereof. [1] https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html
- dllthomas 7y ago
  If I read that correctly, it's about comparing the entire password, not portions thereof, so it's not really about "multiple English word" passwords (except that I assume "passwords obtained from previous breach corpuses" is likely to contain some specific examples of the breed, almost certainly including "correct horse battery staple").
wiml 7y ago
They can't be, unless you generate them badly. A diceware passphrase has 6^6 possibilities ≈ 15 bits of entropy per word, so an unremarkable 5-word password has 77 bits of entropy — generally good enough — and if you have a high value target that might be susceptible to offline attacks, 90-100 bit passwords are still pretty easy to remember. I wish people wouldn't use XKCD as the go-to reference for "collection of randomly selected words"-style passwords; it always seems to leave people confused about why the technique works.
dllthomas 7y ago
> easily cracked by brute-forcing concatenations of dictionary words This is probably misleading (and possibly confused). Diceware style passphrases are easily brute forced relative to a random passphrase of the same length but that doesn't mean they're "easily brute forced". Assume your attacker knows how you're constructing your password, estimate the amount of entropy, and be sure it's enough. 44 bits is low for offline attacks, but (as the comic points out) still better than a lot of passwords people use even when they're trying to make a good password and following NIST guidelines. If you use 5 words and draw from a longer list, it's easy to be solidly out of the range that's crackable on modern hardware.

ZebZ 7y ago

Easy to remember high-entropy pass phrases still makes the most sense to me, with maybe a number or symbol thrown in somewhere for added extra oomph. correct horse 19 battery staple https://xkcd.com/936/ https://xkcd.com/936/

PopeDotNinja 7y ago
Just don't use that as the key to generate your BitCoin address. I saw a funny video, can't remember where, where a guy does that to prove a point. He sends a small amount of BitCoin to the wallet address, and someone steals it within seconds.
- huehehue 7y ago
  There's an article floating around about Ethereum private keys, where people use "0x[...]0000" or "0x[...]0314" or what have you. You can check the corresponding public addresses on Etherscan and see funds being systematically siphoned out by the same few accounts.

orev 7y ago

Starting to feel like this is one of those things that people just blindly parrot all over the Internet without understanding the full context of the NIST guidelines, and as a result are actually causing many security problems. You can’t take one recommendation that you like out of a whole body of work and start running around telling everyone to do this one thing. If you’re going to follow NIST, you need to do all of it. MFA is a big part of why complexity is reduced in the NIST guide, and you MUST have it if you’re going to remove complexity requirements. If you can’t have MFA for some reason (and yes, there are legitimate reasons for this), then you still need to use complexity, expiration, etc.

technion 7y ago
If for some reason you're stuck without MFA (and I appreciate why it happens), I can't agree short expiration adds value. I've done brute force exercises. Some people always pick bad passwords. Tell an organisation to change every 60 days and a lot more people give up and land on May2019!.
- privateSFacct 7y ago
  This 100%. I have a complicated google password - I use it no where else. I have a security key. In 12 years I've NEVER had to change my google account password AND I have not been hacked. This works well. Because google is resistant to brute force I don't even bother adding tons of weird special characters. I worked at a govt related agency. They had to change passwords every 30 days and there was a dual password requirement (one to login to the VPN, the next for the app). Result? - Many folks used a shared account with a public password emailed out every 30 days so everyone else did not have to deal with all the hassles of the password expiration dance. It was also super hard to onboard anyone new (ie, 3-4 months for staff with 12 month projects) This account ended up posted next to every computer. The idea that making security so user unfriendly will makes folks like and use security is a ridiculous approach. - Rate limit attempts - Block after 4 tries for an hour, after 8 tries till a reset - Screen against password lists - Screen out other obviously bad (ie, too short etc). - Allow hardware 2fa BUT allow staff to validate computer. This alone gets you a ton of mileage

snarfy 7y ago

At least 8 characters, upper and lower, numbers and symbols... that advice is from the 70s [1] [1] - https://security.stackexchange.com/questions/33470/what-technical-reasons-are-there-to-have-low-maximum-password-lengths/33471#33471 https://security.stackexchange.com/questions/33470/what-tech...

ZeroMinx 7y ago

fourwordsalluppercase

Legogris 7y ago
ONE WORD ALL LOWERCASE

someonehere 7y ago

Yeah but when you partner with companies, they sometimes force your company to adhere to those ancient guidelines. I’ve worked for companies where they ask for the out of date NIST stuff you mention and it’s either you follow what they ask or you lose out on a deal to fund your company.

DKnoll 7y ago
If you require PCI DSS compliance it won't fly either. https://pcipolicyportal.com/blog/pci-compliance-password-requirements-best-practices-know/ https://pcipolicyportal.com/blog/pci-compliance-password-req...
- yaleman 7y ago
  If you require PCI DSS I hope you're not just blindly following some random post on hackernews for your policy ;)
  - DKnoll 7y ago
    I'm not, that's why I know PCI DSS requirements off-hand.
- downtown_ 7y ago
  No. You can use NIST guidance and are not required to change your password every 90 days