16 ms·

When it comes to composition and length, passwords mostly don't matter

182 points by deegles 7y ago

default-kramer 7y ago
> Your password doesn’t matter, but MFA does! Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA. I'd be much more interested what that percentage is when you only consider people who use password managers. (Which is not to imply that MFA isn't good.)
- q_queue 7y ago
  Furthermore many sites make it difficult to use a password manager because it's hard to block automated password guessers and not interfere with password managers trying to enter passwords.
  - RandomInteger4 7y ago
    The web developers that think like this are bad at web development, and likely security. Why would anyone trying to brute force your authentication portal care about using your UI?
    - gpm 7y ago
      This is giving me bad ideas about making the UI (and only way to log in) be to send the password 1 character at a time as it's typed, and then using some form of ml to try and identify probable bots. You'd probably mostly catch password managers and people copy-pasting passwords though. If you had per-user fingerprints also people typing on a new device...
      - gruez 7y ago
        >This is giving me bad ideas about making the UI (and only way to log in) be to send the password 1 character at a time as it's typed, and then using some form of ml to try and identify probable bots. at that point you might as well outsource that sort of fingerprinting/behavior analysis to some service like recaptcha.
        gpm 7y ago
        I mean, I suppose my idea is basically "build a recaptcha competitor". Otoh in house recaptcha is "better" because - Hackers haven't spent time breaking it - It doesn't raise the same level of privacy concerns - You control the UI (though recaptcha3 gives you that) and have greater insight into what the score means and why
      - spydum 7y ago
        I’m pretty sure that would be unmanageable, but love to see it tried.. Are you thinking of each character acting more like a number in a combination lock and needing to be provided to the app sequentially to be checked? I dont get how you distinguish between password managers and bots or API dictionary attacks on the same interface?
        jarfil 7y ago
        Isn't that essentially how the "I'm not a bot" captcha works though? And it seems to work pretty well.
      - q_queue 7y ago
        I think this is actually done, and I wish I could remember the godforsaken website I encountered it on.
      - RandomInteger4 7y ago
        Sounds like a great way to create a huge security flaw for your users and their passwords, or a nifty method by which your attackers can DoS your site. KISS.
  - mr_toad 7y ago
    Trying to block automated password guessers on the client end is a fools errand anyway.
  - neotek 7y ago
    My old bank used to "encrypt" your password as you typed it into the input field, on keydown it would take the character you typed and — and I'm not making this up — ROT13 it. This had the effect of making it impossible to paste anything into the input field since the script would capture your ctrl+v and replace it with the letter "i". The icing on the cake is that when I called to complain about it, the support agent insisted in very sombre tones that it was a measure to stop keyloggers. I don't use that bank any more.
    - gruez 7y ago
      >since the script would capture your ctrl+v and replace it with the letter "i". not an issue on firefox because you can toggle the dom.event.clipboardevents.enabled to false, and sites won't be able to hijack your pastes.
      - adjkant 7y ago
        My guess is if you did that and pasted "password" you would get "passworq" and then your password would be wrong according to their "encryption" method.
      - neotek 7y ago
        The only problem with that is that the stupid ROT13 step wouldn't be performed so the site would reject your login attempt anyway. It was one of the dumbest design decisions I've ever seen, honestly.
        Zancarius 7y ago
        I'm guessing the solution would've then been to 1) disable the update event and 2) paste the ROT13'd password, either into the browser or into the input field value via the inspector. Like you, whenever I run into sites that do weird things like that, I always find it hard to shake a bit of suspicion about how their backend is implemented (or not, depending on the case). For instance, when they start rejecting characters like "%" or "'" which have special meaning in SQL. I can't help but wonder if they're storing things in plain text. I've run into at least two vendors I can think off the top of my head that limit what characters you can use for a password. That always makes me uneasy, and I don't buy anything from them on principle. Who knows what else they're doing that's not immediately obvious.
  - deleted 7y ago
    [deleted]
- jedberg 7y ago
  It's hard to know who is using a password manager, but I'm sure the number is much lower, because if you're using a password manager, you are most likely smart enough to avoid phishing and some of the other attacks too (not always, but at least much more likely to be conscience about these things).
fuckMicrosoft 7y ago
No, Microsoft. Your password doesn't matter.
ListeningPie 7y ago
The conclusion of the article is the exact opposite of the title. As long as it is 9 and over characters and not on password list, it's safe. There is a rise in sim hacking and still MFA is not a solution if you lose your MFA device. We always go back to passwords, even password resets rely on a password protected email. Until quantum computers make passwords obsolete I have not seen a better solution.
DecoPerson 7y ago
If we start thinking passwords don't matter, we go back to single-factor authentication. What makes the "second" factor in 2FA more secure than the first? Is that it's usually a time-based generated key? Or is it that users usually use a physical device for this second key, hence removing a lot of internet-only attack vectors?
- Latty 7y ago
  Definitely your second point, although it's worth noting that mobile authentication apps are still weak (although not as weak as just a password) to remote phishing attacks where security keys aren't. Mobile authentication apps rely on the user only typing that code into the right website—and people suck at noticing if they are on the wrong site. Right now, this is mostly only a problem with spear-phishing as most don't bother, but if 2FA becomes too popular, they'll start to adapt. Security keys, on the other hand, get the host directly from the browser. This means they should be safe even if you fall for a phishing attack.
- closeparen 7y ago
  TOTP and U2F both perform a single authentication from a captive secret, rather than revealing a reusable secret. U2F does even better, and ensures you are authenticating to the right website, not an intermediary. If we eliminated passwords in favor of onboard U2F chips, we'd be much better off than today, though not as amazing as U2F + passwords.
  - tialaramex 7y ago
    Arguably what's inside a U2F/ FIDO token isn't a secret but a private value. The TOTP secret is known to the authenticator, they calculate the same TOTP value as you to verify that yours is correct. In U2F / WebAuthn the device just proves it still knows a private asymmetric key that it can use to sign messages, the authenticator learns the _public_ key, but not the private one, it can authenticate these signatures but not produce its own. To deliver pseudonymity the device doesn't use a single public/private pair for everything but instead generates them randomly from a seed or key it knows and _this_ private value is what makes your FIDO Security Key different from my FIDO Security Key so that you can be authenticated, whilst not making it possible to fingerprint you and see where else you use these credentials. Single Factor FIDO is a thing, Microsoft offers it. The device takes a PIN (something you know) and incorporates that into the results, so that anyone who doesn't know the PIN now can't authenticate even if they've stolen your Security Key. You need a suitable device, the Yubikey Security Keys with a "2" emblazened are suitable.
TimTheTinker 7y ago
Note this is from the perspective of a security decision maker, like an IT administrator. Policy-wise, users can't be forced or trusted to create excellent passwords on their own. But as an individual, your passwords do matter. It makes a world of a difference to use a password manager and long, completely random passwords - such passwords are immune to all sorts of cracking attempts, and using them can often make MFA unnecessary/redundant (though using MFA always reduces your personal attack surface).
- metildaa 7y ago
  Rate-limiting & banning after repeat failed login attempts should be the baseline moat an IT admin or selfhosted infrastructure should have. Fail2ban rules like "after 5 failed logins, ban for 30min, 10 failed logins in a day (with no succesful login) is a permaban" will curtail most non-spear phishing attacks.
  - deogeo 7y ago
    A permaban is an awful idea. A legitimate user who forgot their password can easily go through more than 10 failed attempts as they try variations of what they think their own password might be. "I know I used my usual password, but did it start lower or upper case? Or camel case... did I end it with a number? Did the service require a special symbol, so I added that to the end? Or to the beginning.." - banned.
    - Polyisoprene 7y ago
      Or getting your account banned after someone failed trying to brute force it and not being able to access it due to changes in security policies.
      - metildaa 7y ago
        Fail2ban bans an IP address or range of IPs, not specific users.
danShumway 7y ago
> Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA. An important thing to remember here is that MFA works with a password. Otherwise, that 99% goes down dramatically because I can just steal your phone/Yubikey/whatever. This article isn't suggesting that we get rid of passwords. It's suggesting that the energy we spend making sure that passwords are good would be better spent encouraging users to enable MFA. In other words, having two relatively weak authentication mechanisms that must be used in tandem is still better than having one strong authentication mechanism.
- Spivak 7y ago
  > Otherwise, that 99% goes down dramatically because I can just steal your phone/Yubikey/whatever. If this were true your car would probably get stolen a lot more often. You're less secure from targeted attacks from people who know you IRL but that's a lot rarer than the attacks you'll actually encounter.
  - danShumway 7y ago
    Eh... cars are really big. A better way of phrasing this is, "if this were true, your wallet/phone would get stolen a lot more often." But aren't wallet/phone thefts relatively common? > You're less secure from targeted attacks from people who know you IRL I'm also not completely certain this is true. If a YubiKey is the only thing securing most people's accounts, I don't need to target you. I can walk into a coffee shop, or locker room, or office and steal as many YubiKeys as I can find. And then I can check later whether or not any of them are linked to bank accounts. I don't know the stats; are most petty wallet/phone thefts targeted?
    - kortilla 7y ago
      A wallet is useful to a thief, a yubikey is not. There is little overlap between petty thieves and people trying to get into a particular target’s account.
      - 7y ago
methodover 7y ago
This is a good article. However, in regards to credential stuffing: > Some guidance says to ban all passwords on this list. Try that and see how successful your users are at choosing passwords at all. We're doing that. We don't let you choose any password that's been discovered in a prior breach. Did Microsoft implement the same thing and discover a high rate of users bouncing off the registration page?
- jessriedel 7y ago
  Do you guys specifically alert the user that the password has been exposed publicly? If I got that sort of message, I would be grateful to the website rather than annoyed I couldn't use my favorite password.
  - zaroth 7y ago
    Not the password for you, just that password, for someone, on some site, ever. If that’s happened thousands of times, sure, that’s the sign of a relatively common/weak password. If it’s happened once? I’d be frustrated if I was trying to pick something memorable and got stuck because of that.
    - jessriedel 7y ago
      Yes, I understand it was whether it's exposed anywhere, not just for this user. If it was someone else's password, I would still find it super valuable information to know I'm using something that's common enough to have been used by a stranger.
  - methodover 7y ago
    We do yeah. Here's the text: "This password has previously appeared in a data breach. Please choose a more secure alternative."
- mikekchar 7y ago
  Just idly wondering... I wonder how many AJAX style sites do password checking server side and send the password to the server in plain text...
oceliker 7y ago
This is somewhat unrelated, but I think the Microsoft 2FA (in Outlook, Skype, Xbox, etc.) has a lot of unnecessary friction. After entering my password, the app usually takes me to a second page where I am required to type out my email address. I'd much rather prefer that I get an email immediately, because the way things currently are, I won't be notified of any attempts that breach my password but not my 2FA. It provides no perceivable security benefit to me (and if someone did hijack my email account, then they know my address anyway). If I pick the text message option, then (after confirming my number the same way as above) I get a 7-digit code. For some odd reason, I find it much more difficult to remember a 7-digit code than a 6-digit one, which seems to be standard for most other companies. I don't see any extra security benefit in a longer 2FA code, but maybe there's a valid reason for this one. The issues above are mildly annoying on a PC. In an Xbox, however, with the onscreen keyboard, it honestly makes me want to throw my console out the window.
- will4274 7y ago
  > It provides no perceivable security benefit to me (and if someone did hijack my email account, then they know my address anyway). I think you're over focused on targeted attacks. Consider: some company gets hacked. Hackers take the credential list, try all the passwords for @outlook accounts against Microsoft using cloud VMs to avoid IP blocking. If Microsoft displayed the full email address without having the user re-type it, the attacker has now discovered the TFA email address and will try the same hacked password against that (usually Gmail) account. If Microsoft displays nothing, users with multiple emails get confused about which inbox to check. Displaying a starred out email address and asking for a re-type solves both problems. It also prevents Microsoft from having a huge SMS bill each time a big company gets hacked and the hackers try all the passwords. The solution for Xbox is really for Xbox to use a flow designed for low input devices, like the OAuth device flow which allows you to do all the typing on your computer of cell phone, not the Xbox controller.
  - oceliker 7y ago
    > Displaying a starred out email address and asking for a re-type solves both problems. Sure, but why not simply show the starred out email without asking for the re-type? I agree with the Xbox idea, that would perfectly solve the problem.
Someone1234 7y ago
The number one reason I don't turn on MFA has nothing to do with the effort in entering the MFA code/pressing a confirm button. The lifecycle of MFA is the problem. The backup/recovery options are just terrible. You either print out a sheet of "one time codes" (which I need to not lose forever), my phone simply needs to never break, or I need to configure an insecure recovery account (creating a whole chicken/egg problem). This is in no way mitigated by using physical keys either. Which can also be lost/broken/stolen/etc. You still need recovery/backup. Plus a ton of vendors allow customer support to trivially turn off MFA via social-engineering, so what is the point? If people want MFA to be more common, make the lifecycle better. Right now the backup/recovery situation is all over the place and frankly bad.
- deleted 7y ago
  [deleted]
- qot 7y ago
  Use an MFA app that supports exporting an encrypted backup, like Aegis.
- mquander 7y ago
  I was blown away when I discovered that there was no way for me to export my Google Authenticator TOTP secrets from my locked Android phone, since unlocking it wipes the disk. I guess I will not make the mistake of not immediately unlocking an Android phone again.
  - winrid 7y ago
    So what do you do? How did you get your account back?
    - paulie_a 7y ago
      I ran into a similar issue. I had 1100 dollars in an account secured by authenticator and did not save the recovery codes when I set it up. I had to jump through hoops to get it back, which is good. But I didnt realize I would have to reset up every single code on authenticator on the new phone. When you have a lot of accounts it's pretty obnoxious even with recovery codes. It didnt help that google support directly told me that they would be automatically be restored on the new phone along with the rest of the settings.
dillutedfixer 7y ago
In my opinion, Microsoft's implementation of MFA on Office 365 (at least our instance) is broken. SMS MFA is inadequate and should not be used, the SS7 network is apparently trivially hackable in some circles and text messages can be rerouted. So they want us to use MS Authenticator, great. However the 365 login screen always has the "Sign in another way" option in which I can just bypass the Authenticator app and use an SMS text. I cannot remove my mobile number from my profile to disable the option to SMS text because they are worried about me losing access to my app. I don't know if this is a limitation of Office 365 through our VAR or what, but it just seems pointless to offer an Authenticator app if there's an easy way to fall back to SMS and no way to disable SMS. If someone has my password and can reroute my text messages, a fancy shmancy Authenticator app is pointless. If this is not how it is for others with 365 I would love to know that, I hope it's not a limitation or policy put in place by our VAR.
- privateSFacct 7y ago
  This. I deal with relatively higher volumes of information that must remain secure. With google, I have hardware authentication device and 10 codes. Every 30 days or so it asks me to plug in the hardware device. Randomly it asks me more often - I have no idea why but no objection. My password is secure as well and only used on google but THANKFULLY I do not need to change it all the time and so I don't have to write it down. This feels like a reasonably secure approach. No SMS text option. The idea that your phone number is the key that allows you to reset all your passwords (no matter how complicated / securing no matter how much sensitive info) is ridiculous.
  - smitty1e 7y ago
    Any redundancy on that piece of hardware? "Two is one and one is none," as the Special Operations folks will explain. Sure, the math is squirrely; but the sentiment is real.
    - stouset 7y ago
      The recovery codes.
pier25 7y ago
> 500M is ½ a billion, home rigs can run 100B guesses a second – so that complete list just takes 5ms to try. 5ms? It would take more than that to just read the 500M passwords into memory, no?
- floo 7y ago
  Well yeah. But you, presumably, only have to do that once. After that you get 5ms per account, which seems to be the important takeaway.
  - pier25 7y ago
    But even then, 5ms seems extraordinarily fast on a home machine. A couple of years ago I tried to bruteforce my WPA wifi handshakes and also played a bit with Hydra and I don't think I got even close to such speed.
mquander 7y ago
I think the thesis of this article is rather forced. The actual claim is something like: "Passwords don't matter, as long as your password isn't in the top few dozen common ones, it's not in any credentials breach accessible to attackers, it's longer than 8 characters or so, and you don't reuse it." That was a lot of criteria that seemed to matter, if you ask me.
- padobson 7y ago
  And also "Passwords don't matter as long as you aren't important enough or connected to a person or organization important enough to try more than the most routine password vulnerabilities"
  - mikekchar 7y ago
    That would be a shocking statement to make. However, I don't see anything like that in the original article. Did I miss it somewhere?
    - H8crilA 7y ago
      Yes for example in password spray - attackers often try just < 20 passwords. If your account is high value they could try a lot more.
      - mikekchar 7y ago
        But the original article literally never says that. It doesn't talk about the "value" of different kinds of accounts at all (and I just reread the "Spray" section to make sure I didn't miss it). It would be incredibly naive to think that one account has significantly more value than another because once you are in the system, your ability to compromise it skyrockets -- no matter what kind of account you have. Sure, you're probably trying to work your way up to administrative account level, but there are so many more local attacks than remote attacks that it isn't even funny. I'm not sure there is an accusation that the article is being naive in this way or not (there seems to be some confusion). It would be really shocking to see a blog post from Microsoft talking about security that would say something so naive. But as far as I can tell, they didn't.
deleted 7y ago
[deleted]
rkagerer 7y ago
If you are using a password manager, use the maximum possible length – there’s no usability downside if you are already cutting and pasting. That's fine and dandy until you need to manually type it in somewhere (e.g. reading it from your phone, typing it in on another device). Has this guy ever even used a password manager? He understands how they work in theory, but in practice it's not always quite so clean. Humans will be human.
- sxates 7y ago
  The best is typing that 20 character mixed-case-plus-numbers-and-symbols password for Netflix into your TV app using an on screen keyboard and directional arrows...
  - dingo_bat 7y ago
    Netflix is needlessly hard on TV. Hotstar has an amazing system where it shows a 4 letter code. You open the website on your laptop or phone and enter the code. No typing in TV.
  - LeonB 7y ago
    Signing into some new tvs recently, the google account sign in experience was better than Netflix sign in, as it let you use your phone to sign in (once you’d scanned a QR code shown on screen).
  - war1025 7y ago
    I generate my passwords with: $ head -c 100 /dev/urandom | sha256sum Same pain as you any time I have to type the password in someplace I don't have my password manager installed, but with the advantage that its just [0-9a-f]. I figure with that many characters there's no need to use the full character set. Also honestly just tend to use weaker passwords on things I'll need to log into on other machines. Usually those are accounts I don't care as much about anyway.
  - function_seven 7y ago
    This is a huge benefit of AppleTV and having an iOS device. When the password is prompted for on the TV, my phone buzzes and I use the LastPass vault on the phone to paste the gibberish automatically. I'm sure there are similar schemes for other devices (Chromecast/FireTV?). But when the TV itself is "smart", I bet it's infuriating.
Thorrez 7y ago
The article seems to contradict itself. The table says password strength doesn't matter for brute force unless you're using an unusable password. But then in the conclusion it recommends you use a 9+ character password because that protects you from brute force.
- willvarfar 7y ago
  yeah. What the table needs is a column of how to mitigate each risk. Besides MFA, there's also all the things that the very first para says aren't important, e.g. avoiding password reuse (HIBP is now a Microsoft thing)
dusted 7y ago
Which is why we use hardware password managers and randomly generated unique passwords for every account. pets finalkey
mnm1 7y ago
This kind of shit coming from Microsoft is fucking rich. Then why do I have to change my password constantly on outlook and get routed to at least two different types of password change servers, one with rules stupider than another? Especially when I'm trying to use a password manager with a strong, long, random password and they are preventing me from doing so with their shitty UX and their limitation on characters? They should take their own fucking advice because you know what else reduces security? The stupid bullshit I described above. Now I just use a base password (that's probably been compromised) and increase the last digit by one each time. Insecure? You betcha. But it's for work and it was work's decision to use outlook so not my problem. Microsoft should either shut the fuck up about this shit or fix their own fucking systems. Of course it doesn't matter what password you use in such a shit system (outside of a password manager generated one). And they have intentionally created a situation that makes the passwords even less secure.
- codeulike 7y ago
  Sounds like the place where you work has assigned some dumb password policies, and has a clumsy federation setup for password changes.
  - mnm1 7y ago
    No, we have nothing custom set up. It's just Outlook 365. They send you to one password change page sometimes and another at other times. They both have different password policies. Microsoft is just shit as far as security is concerned. Or it could be a bug. Either way, it's garbage and it encourages not using a password manager and not using strong passwords since the length is limited. I just wish they would shut up with their fucking research into security if they won't bother to implement it themselves. Do as I say, not as I do. That's Microsoft and frankly, I'm fucking tired of their stupid bullshit.
Anonymous4C54D6 7y ago
This article is slightly inconsistent. All those arguments for why a password's strength doesn't matter because the attackers gets the exact one have one important conclusion: Don't reuse your password. And then there are a bunch of arguments that the strength mostly doesn't matter but the password shouldn't be too weak. So we end up with having to remember lot's of non-trivial passwords and now the conclusion should be to use a password manager and certainly not that your password "mostly doesn't matter". What sadly mostly still doesn't matter is MFA because it is a site-specific pain to set up and use.
kerng 7y ago
There is some very bad analysis or interpretation done here. Just with one or two minor tweaks the analysis falls flat. For instance, they seem to only look at mass scale script kiddie sprays, a targeted attack will likely not use the mentioned passwords. As one can come up with much better and more likely to succeed candidates. It also entirely misses attacks that come from a more privileged position (like in Windows directly authenticating to the domain controller) where an adversary can do millions of attempts in short time because of typical monitoring gaps.

182 points by deegles 7y ago

> Your password doesn’t matter, but MFA does! Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA. I'd be much more interested what that percentage is when you only consider people who use password managers. (Which is not to imply that MFA isn't good.)

q_queue 7y ago
Furthermore many sites make it difficult to use a password manager because it's hard to block automated password guessers and not interfere with password managers trying to enter passwords.
- RandomInteger4 7y ago
  The web developers that think like this are bad at web development, and likely security. Why would anyone trying to brute force your authentication portal care about using your UI?
  - gpm 7y ago
    This is giving me bad ideas about making the UI (and only way to log in) be to send the password 1 character at a time as it's typed, and then using some form of ml to try and identify probable bots. You'd probably mostly catch password managers and people copy-pasting passwords though. If you had per-user fingerprints also people typing on a new device...
    - gruez 7y ago
      >This is giving me bad ideas about making the UI (and only way to log in) be to send the password 1 character at a time as it's typed, and then using some form of ml to try and identify probable bots. at that point you might as well outsource that sort of fingerprinting/behavior analysis to some service like recaptcha.
      - gpm 7y ago
        I mean, I suppose my idea is basically "build a recaptcha competitor". Otoh in house recaptcha is "better" because - Hackers haven't spent time breaking it - It doesn't raise the same level of privacy concerns - You control the UI (though recaptcha3 gives you that) and have greater insight into what the score means and why
    - spydum 7y ago
      I’m pretty sure that would be unmanageable, but love to see it tried.. Are you thinking of each character acting more like a number in a combination lock and needing to be provided to the app sequentially to be checked? I dont get how you distinguish between password managers and bots or API dictionary attacks on the same interface?
      - jarfil 7y ago
        Isn't that essentially how the "I'm not a bot" captcha works though? And it seems to work pretty well.
    - q_queue 7y ago
      I think this is actually done, and I wish I could remember the godforsaken website I encountered it on.
    - RandomInteger4 7y ago
      Sounds like a great way to create a huge security flaw for your users and their passwords, or a nifty method by which your attackers can DoS your site. KISS.
- mr_toad 7y ago
  Trying to block automated password guessers on the client end is a fools errand anyway.
- neotek 7y ago
  My old bank used to "encrypt" your password as you typed it into the input field, on keydown it would take the character you typed and — and I'm not making this up — ROT13 it. This had the effect of making it impossible to paste anything into the input field since the script would capture your ctrl+v and replace it with the letter "i". The icing on the cake is that when I called to complain about it, the support agent insisted in very sombre tones that it was a measure to stop keyloggers. I don't use that bank any more.
  - gruez 7y ago
    >since the script would capture your ctrl+v and replace it with the letter "i". not an issue on firefox because you can toggle the dom.event.clipboardevents.enabled to false, and sites won't be able to hijack your pastes.
    - adjkant 7y ago
      My guess is if you did that and pasted "password" you would get "passworq" and then your password would be wrong according to their "encryption" method.
    - neotek 7y ago
      The only problem with that is that the stupid ROT13 step wouldn't be performed so the site would reject your login attempt anyway. It was one of the dumbest design decisions I've ever seen, honestly.
      - Zancarius 7y ago
        I'm guessing the solution would've then been to 1) disable the update event and 2) paste the ROT13'd password, either into the browser or into the input field value via the inspector. Like you, whenever I run into sites that do weird things like that, I always find it hard to shake a bit of suspicion about how their backend is implemented (or not, depending on the case). For instance, when they start rejecting characters like "%" or "'" which have special meaning in SQL. I can't help but wonder if they're storing things in plain text. I've run into at least two vendors I can think off the top of my head that limit what characters you can use for a password. That always makes me uneasy, and I don't buy anything from them on principle. Who knows what else they're doing that's not immediately obvious.
- deleted 7y ago
  [deleted]
jedberg 7y ago
It's hard to know who is using a password manager, but I'm sure the number is much lower, because if you're using a password manager, you are most likely smart enough to avoid phishing and some of the other attacks too (not always, but at least much more likely to be conscience about these things).

fuckMicrosoft 7y ago

No, Microsoft. Your password doesn't matter.

ListeningPie 7y ago

The conclusion of the article is the exact opposite of the title. As long as it is 9 and over characters and not on password list, it's safe. There is a rise in sim hacking and still MFA is not a solution if you lose your MFA device. We always go back to passwords, even password resets rely on a password protected email. Until quantum computers make passwords obsolete I have not seen a better solution.

DecoPerson 7y ago

If we start thinking passwords don't matter, we go back to single-factor authentication. What makes the "second" factor in 2FA more secure than the first? Is that it's usually a time-based generated key? Or is it that users usually use a physical device for this second key, hence removing a lot of internet-only attack vectors?

Latty 7y ago
Definitely your second point, although it's worth noting that mobile authentication apps are still weak (although not as weak as just a password) to remote phishing attacks where security keys aren't. Mobile authentication apps rely on the user only typing that code into the right website—and people suck at noticing if they are on the wrong site. Right now, this is mostly only a problem with spear-phishing as most don't bother, but if 2FA becomes too popular, they'll start to adapt. Security keys, on the other hand, get the host directly from the browser. This means they should be safe even if you fall for a phishing attack.
closeparen 7y ago
TOTP and U2F both perform a single authentication from a captive secret, rather than revealing a reusable secret. U2F does even better, and ensures you are authenticating to the right website, not an intermediary. If we eliminated passwords in favor of onboard U2F chips, we'd be much better off than today, though not as amazing as U2F + passwords.
- tialaramex 7y ago
  Arguably what's inside a U2F/ FIDO token isn't a secret but a private value. The TOTP secret is known to the authenticator, they calculate the same TOTP value as you to verify that yours is correct. In U2F / WebAuthn the device just proves it still knows a private asymmetric key that it can use to sign messages, the authenticator learns the _public_ key, but not the private one, it can authenticate these signatures but not produce its own. To deliver pseudonymity the device doesn't use a single public/private pair for everything but instead generates them randomly from a seed or key it knows and _this_ private value is what makes your FIDO Security Key different from my FIDO Security Key so that you can be authenticated, whilst not making it possible to fingerprint you and see where else you use these credentials. Single Factor FIDO is a thing, Microsoft offers it. The device takes a PIN (something you know) and incorporates that into the results, so that anyone who doesn't know the PIN now can't authenticate even if they've stolen your Security Key. You need a suitable device, the Yubikey Security Keys with a "2" emblazened are suitable.

TimTheTinker 7y ago

Note this is from the perspective of a security decision maker, like an IT administrator. Policy-wise, users can't be forced or trusted to create excellent passwords on their own. But as an individual, your passwords do matter. It makes a world of a difference to use a password manager and long, completely random passwords - such passwords are immune to all sorts of cracking attempts, and using them can often make MFA unnecessary/redundant (though using MFA always reduces your personal attack surface).

metildaa 7y ago
Rate-limiting & banning after repeat failed login attempts should be the baseline moat an IT admin or selfhosted infrastructure should have. Fail2ban rules like "after 5 failed logins, ban for 30min, 10 failed logins in a day (with no succesful login) is a permaban" will curtail most non-spear phishing attacks.
- deogeo 7y ago
  A permaban is an awful idea. A legitimate user who forgot their password can easily go through more than 10 failed attempts as they try variations of what they think their own password might be. "I know I used my usual password, but did it start lower or upper case? Or camel case... did I end it with a number? Did the service require a special symbol, so I added that to the end? Or to the beginning.." - banned.
  - Polyisoprene 7y ago
    Or getting your account banned after someone failed trying to brute force it and not being able to access it due to changes in security policies.
    - metildaa 7y ago
      Fail2ban bans an IP address or range of IPs, not specific users.

danShumway 7y ago

> Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA. An important thing to remember here is that MFA works with a password. Otherwise, that 99% goes down dramatically because I can just steal your phone/Yubikey/whatever. This article isn't suggesting that we get rid of passwords. It's suggesting that the energy we spend making sure that passwords are good would be better spent encouraging users to enable MFA. In other words, having two relatively weak authentication mechanisms that must be used in tandem is still better than having one strong authentication mechanism.

Spivak 7y ago
> Otherwise, that 99% goes down dramatically because I can just steal your phone/Yubikey/whatever. If this were true your car would probably get stolen a lot more often. You're less secure from targeted attacks from people who know you IRL but that's a lot rarer than the attacks you'll actually encounter.
- danShumway 7y ago
  Eh... cars are really big. A better way of phrasing this is, "if this were true, your wallet/phone would get stolen a lot more often." But aren't wallet/phone thefts relatively common? > You're less secure from targeted attacks from people who know you IRL I'm also not completely certain this is true. If a YubiKey is the only thing securing most people's accounts, I don't need to target you. I can walk into a coffee shop, or locker room, or office and steal as many YubiKeys as I can find. And then I can check later whether or not any of them are linked to bank accounts. I don't know the stats; are most petty wallet/phone thefts targeted?
  - kortilla 7y ago
    A wallet is useful to a thief, a yubikey is not. There is little overlap between petty thieves and people trying to get into a particular target’s account.
    - 7y ago

methodover 7y ago

This is a good article. However, in regards to credential stuffing: > Some guidance says to ban all passwords on this list. Try that and see how successful your users are at choosing passwords at all. We're doing that. We don't let you choose any password that's been discovered in a prior breach. Did Microsoft implement the same thing and discover a high rate of users bouncing off the registration page?

jessriedel 7y ago
Do you guys specifically alert the user that the password has been exposed publicly? If I got that sort of message, I would be grateful to the website rather than annoyed I couldn't use my favorite password.
- zaroth 7y ago
  Not the password for you, just that password, for someone, on some site, ever. If that’s happened thousands of times, sure, that’s the sign of a relatively common/weak password. If it’s happened once? I’d be frustrated if I was trying to pick something memorable and got stuck because of that.
  - jessriedel 7y ago
    Yes, I understand it was whether it's exposed anywhere, not just for this user. If it was someone else's password, I would still find it super valuable information to know I'm using something that's common enough to have been used by a stranger.
- methodover 7y ago
  We do yeah. Here's the text: "This password has previously appeared in a data breach. Please choose a more secure alternative."
mikekchar 7y ago
Just idly wondering... I wonder how many AJAX style sites do password checking server side and send the password to the server in plain text...

oceliker 7y ago

This is somewhat unrelated, but I think the Microsoft 2FA (in Outlook, Skype, Xbox, etc.) has a lot of unnecessary friction. After entering my password, the app usually takes me to a second page where I am required to type out my email address. I'd much rather prefer that I get an email immediately, because the way things currently are, I won't be notified of any attempts that breach my password but not my 2FA. It provides no perceivable security benefit to me (and if someone did hijack my email account, then they know my address anyway). If I pick the text message option, then (after confirming my number the same way as above) I get a 7-digit code. For some odd reason, I find it much more difficult to remember a 7-digit code than a 6-digit one, which seems to be standard for most other companies. I don't see any extra security benefit in a longer 2FA code, but maybe there's a valid reason for this one. The issues above are mildly annoying on a PC. In an Xbox, however, with the onscreen keyboard, it honestly makes me want to throw my console out the window.

will4274 7y ago
> It provides no perceivable security benefit to me (and if someone did hijack my email account, then they know my address anyway). I think you're over focused on targeted attacks. Consider: some company gets hacked. Hackers take the credential list, try all the passwords for @outlook accounts against Microsoft using cloud VMs to avoid IP blocking. If Microsoft displayed the full email address without having the user re-type it, the attacker has now discovered the TFA email address and will try the same hacked password against that (usually Gmail) account. If Microsoft displays nothing, users with multiple emails get confused about which inbox to check. Displaying a starred out email address and asking for a re-type solves both problems. It also prevents Microsoft from having a huge SMS bill each time a big company gets hacked and the hackers try all the passwords. The solution for Xbox is really for Xbox to use a flow designed for low input devices, like the OAuth device flow which allows you to do all the typing on your computer of cell phone, not the Xbox controller.
- oceliker 7y ago
  > Displaying a starred out email address and asking for a re-type solves both problems. Sure, but why not simply show the starred out email without asking for the re-type? I agree with the Xbox idea, that would perfectly solve the problem.

Someone1234 7y ago

The number one reason I don't turn on MFA has nothing to do with the effort in entering the MFA code/pressing a confirm button. The lifecycle of MFA is the problem. The backup/recovery options are just terrible. You either print out a sheet of "one time codes" (which I need to not lose forever), my phone simply needs to never break, or I need to configure an insecure recovery account (creating a whole chicken/egg problem). This is in no way mitigated by using physical keys either. Which can also be lost/broken/stolen/etc. You still need recovery/backup. Plus a ton of vendors allow customer support to trivially turn off MFA via social-engineering, so what is the point? If people want MFA to be more common, make the lifecycle better. Right now the backup/recovery situation is all over the place and frankly bad.

deleted 7y ago
[deleted]
qot 7y ago
Use an MFA app that supports exporting an encrypted backup, like Aegis.
mquander 7y ago
I was blown away when I discovered that there was no way for me to export my Google Authenticator TOTP secrets from my locked Android phone, since unlocking it wipes the disk. I guess I will not make the mistake of not immediately unlocking an Android phone again.
- winrid 7y ago
  So what do you do? How did you get your account back?
  - paulie_a 7y ago
    I ran into a similar issue. I had 1100 dollars in an account secured by authenticator and did not save the recovery codes when I set it up. I had to jump through hoops to get it back, which is good. But I didnt realize I would have to reset up every single code on authenticator on the new phone. When you have a lot of accounts it's pretty obnoxious even with recovery codes. It didnt help that google support directly told me that they would be automatically be restored on the new phone along with the rest of the settings.

dillutedfixer 7y ago

In my opinion, Microsoft's implementation of MFA on Office 365 (at least our instance) is broken. SMS MFA is inadequate and should not be used, the SS7 network is apparently trivially hackable in some circles and text messages can be rerouted. So they want us to use MS Authenticator, great. However the 365 login screen always has the "Sign in another way" option in which I can just bypass the Authenticator app and use an SMS text. I cannot remove my mobile number from my profile to disable the option to SMS text because they are worried about me losing access to my app. I don't know if this is a limitation of Office 365 through our VAR or what, but it just seems pointless to offer an Authenticator app if there's an easy way to fall back to SMS and no way to disable SMS. If someone has my password and can reroute my text messages, a fancy shmancy Authenticator app is pointless. If this is not how it is for others with 365 I would love to know that, I hope it's not a limitation or policy put in place by our VAR.

privateSFacct 7y ago
This. I deal with relatively higher volumes of information that must remain secure. With google, I have hardware authentication device and 10 codes. Every 30 days or so it asks me to plug in the hardware device. Randomly it asks me more often - I have no idea why but no objection. My password is secure as well and only used on google but THANKFULLY I do not need to change it all the time and so I don't have to write it down. This feels like a reasonably secure approach. No SMS text option. The idea that your phone number is the key that allows you to reset all your passwords (no matter how complicated / securing no matter how much sensitive info) is ridiculous.
- smitty1e 7y ago
  Any redundancy on that piece of hardware? "Two is one and one is none," as the Special Operations folks will explain. Sure, the math is squirrely; but the sentiment is real.
  - stouset 7y ago
    The recovery codes.

pier25 7y ago

> 500M is ½ a billion, home rigs can run 100B guesses a second – so that complete list just takes 5ms to try. 5ms? It would take more than that to just read the 500M passwords into memory, no?

floo 7y ago
Well yeah. But you, presumably, only have to do that once. After that you get 5ms per account, which seems to be the important takeaway.
- pier25 7y ago
  But even then, 5ms seems extraordinarily fast on a home machine. A couple of years ago I tried to bruteforce my WPA wifi handshakes and also played a bit with Hydra and I don't think I got even close to such speed.

mquander 7y ago

I think the thesis of this article is rather forced. The actual claim is something like: "Passwords don't matter, as long as your password isn't in the top few dozen common ones, it's not in any credentials breach accessible to attackers, it's longer than 8 characters or so, and you don't reuse it." That was a lot of criteria that seemed to matter, if you ask me.

padobson 7y ago
And also "Passwords don't matter as long as you aren't important enough or connected to a person or organization important enough to try more than the most routine password vulnerabilities"
- mikekchar 7y ago
  That would be a shocking statement to make. However, I don't see anything like that in the original article. Did I miss it somewhere?
  - H8crilA 7y ago
    Yes for example in password spray - attackers often try just < 20 passwords. If your account is high value they could try a lot more.
    - mikekchar 7y ago
      But the original article literally never says that. It doesn't talk about the "value" of different kinds of accounts at all (and I just reread the "Spray" section to make sure I didn't miss it). It would be incredibly naive to think that one account has significantly more value than another because once you are in the system, your ability to compromise it skyrockets -- no matter what kind of account you have. Sure, you're probably trying to work your way up to administrative account level, but there are so many more local attacks than remote attacks that it isn't even funny. I'm not sure there is an accusation that the article is being naive in this way or not (there seems to be some confusion). It would be really shocking to see a blog post from Microsoft talking about security that would say something so naive. But as far as I can tell, they didn't.

deleted 7y ago

[deleted]

rkagerer 7y ago

If you are using a password manager, use the maximum possible length – there’s no usability downside if you are already cutting and pasting. That's fine and dandy until you need to manually type it in somewhere (e.g. reading it from your phone, typing it in on another device). Has this guy ever even used a password manager? He understands how they work in theory, but in practice it's not always quite so clean. Humans will be human.

sxates 7y ago
The best is typing that 20 character mixed-case-plus-numbers-and-symbols password for Netflix into your TV app using an on screen keyboard and directional arrows...
- dingo_bat 7y ago
  Netflix is needlessly hard on TV. Hotstar has an amazing system where it shows a 4 letter code. You open the website on your laptop or phone and enter the code. No typing in TV.
- LeonB 7y ago
  Signing into some new tvs recently, the google account sign in experience was better than Netflix sign in, as it let you use your phone to sign in (once you’d scanned a QR code shown on screen).
- war1025 7y ago
  I generate my passwords with: $ head -c 100 /dev/urandom | sha256sum Same pain as you any time I have to type the password in someplace I don't have my password manager installed, but with the advantage that its just [0-9a-f]. I figure with that many characters there's no need to use the full character set. Also honestly just tend to use weaker passwords on things I'll need to log into on other machines. Usually those are accounts I don't care as much about anyway.
- function_seven 7y ago
  This is a huge benefit of AppleTV and having an iOS device. When the password is prompted for on the TV, my phone buzzes and I use the LastPass vault on the phone to paste the gibberish automatically. I'm sure there are similar schemes for other devices (Chromecast/FireTV?). But when the TV itself is "smart", I bet it's infuriating.

Thorrez 7y ago

The article seems to contradict itself. The table says password strength doesn't matter for brute force unless you're using an unusable password. But then in the conclusion it recommends you use a 9+ character password because that protects you from brute force.

willvarfar 7y ago
yeah. What the table needs is a column of how to mitigate each risk. Besides MFA, there's also all the things that the very first para says aren't important, e.g. avoiding password reuse (HIBP is now a Microsoft thing)

dusted 7y ago

Which is why we use hardware password managers and randomly generated unique passwords for every account. pets finalkey

mnm1 7y ago

This kind of shit coming from Microsoft is fucking rich. Then why do I have to change my password constantly on outlook and get routed to at least two different types of password change servers, one with rules stupider than another? Especially when I'm trying to use a password manager with a strong, long, random password and they are preventing me from doing so with their shitty UX and their limitation on characters? They should take their own fucking advice because you know what else reduces security? The stupid bullshit I described above. Now I just use a base password (that's probably been compromised) and increase the last digit by one each time. Insecure? You betcha. But it's for work and it was work's decision to use outlook so not my problem. Microsoft should either shut the fuck up about this shit or fix their own fucking systems. Of course it doesn't matter what password you use in such a shit system (outside of a password manager generated one). And they have intentionally created a situation that makes the passwords even less secure.

codeulike 7y ago
Sounds like the place where you work has assigned some dumb password policies, and has a clumsy federation setup for password changes.
- mnm1 7y ago
  No, we have nothing custom set up. It's just Outlook 365. They send you to one password change page sometimes and another at other times. They both have different password policies. Microsoft is just shit as far as security is concerned. Or it could be a bug. Either way, it's garbage and it encourages not using a password manager and not using strong passwords since the length is limited. I just wish they would shut up with their fucking research into security if they won't bother to implement it themselves. Do as I say, not as I do. That's Microsoft and frankly, I'm fucking tired of their stupid bullshit.

Anonymous4C54D6 7y ago

This article is slightly inconsistent. All those arguments for why a password's strength doesn't matter because the attackers gets the exact one have one important conclusion: Don't reuse your password. And then there are a bunch of arguments that the strength mostly doesn't matter but the password shouldn't be too weak. So we end up with having to remember lot's of non-trivial passwords and now the conclusion should be to use a password manager and certainly not that your password "mostly doesn't matter". What sadly mostly still doesn't matter is MFA because it is a site-specific pain to set up and use.

kerng 7y ago

There is some very bad analysis or interpretation done here. Just with one or two minor tweaks the analysis falls flat. For instance, they seem to only look at mass scale script kiddie sprays, a targeted attack will likely not use the mentioned passwords. As one can come up with much better and more likely to succeed candidates. It also entirely misses attacks that come from a more privileged position (like in Windows directly authenticating to the domain controller) where an adversary can do millions of attempts in short time because of typical monitoring gaps.