6 ms·

Note this is from the perspective of a security decision maker, like an IT administrator. Policy-wise, users can't be forced or trusted to create excellent pass

Note this is from the perspective of a security decision maker, like an IT administrator. Policy-wise, users can't be forced or trusted to create excellent passwords on their own. But as an individual, your passwords do matter. It makes a world of a difference to use a password manager and long, completely random passwords - such passwords are immune to all sorts of cracking attempts, and using them can often make MFA unnecessary/redundant (though using MFA always reduces your personal attack surface).

metildaa 7y ago
Rate-limiting & banning after repeat failed login attempts should be the baseline moat an IT admin or selfhosted infrastructure should have. Fail2ban rules like "after 5 failed logins, ban for 30min, 10 failed logins in a day (with no succesful login) is a permaban" will curtail most non-spear phishing attacks.
- deogeo 7y ago
  A permaban is an awful idea. A legitimate user who forgot their password can easily go through more than 10 failed attempts as they try variations of what they think their own password might be. "I know I used my usual password, but did it start lower or upper case? Or camel case... did I end it with a number? Did the service require a special symbol, so I added that to the end? Or to the beginning.." - banned.
  - Polyisoprene 7y ago
    Or getting your account banned after someone failed trying to brute force it and not being able to access it due to changes in security policies.
    - metildaa 7y ago
      Fail2ban bans an IP address or range of IPs, not specific users.
      - hombre_fatal 7y ago
        That advice is pretty antiquated. The reality is that, these days, I rent $5 worth of botnet time and make {user,password} combo login attempts from thousands of residential IP addresses. You might think your advice is a good "might as well" elementary, but generally if people want to curl your /login page from their laptop, then they are also buying $5 scripts off Hack-Forums that automate botnet cred stuffing against your service as well. And you'll need a better gameplan than fail2ban.
  - metildaa 7y ago
    Hence following current NIST guidelines which do not require regular password changes, capitals, special characters or numbers in passwords: https://www.enzoic.com/surprising-new-password-guidelines-nist/ https://www.enzoic.com/surprising-new-password-guidelines-ni... Don't be a PITA to your users, and you've eliminated most of the "guess what password you used" game.
- tialaramex 7y ago
  Use something like random token buckets not simple rate limiting. If a user fails credential checks (e.g. password), track it, if their current failure rate is N, tell them they tried too many wrong credentials, come back later. Every random(1,T) seconds any failed users get their failure count reduced by one until it's zero and you stop tracking it for now. By choosing N and T you can give users a relatively large number of "goes" to remember their password after a long period away, but not give attackers too many chances to guess a not-awful password by brute force. For example if N is 10 and T is 7200 then a user can try ten passwords, then an average of 24 more attempts per day but exactly when they can make another attempt is random. This allows your good guys to have a fair chance against any bad guys smashing the "retry" button to try to lock them out. If the bad guys give up and go away, the user quickly returns to having ten attempts.
smacktoward 7y ago
The point of the article is that many common attacks work just as well against completely random, unique passwords as they do against weak/reused ones. If you get phished, it doesn't matter if your password is strong. If your machine has a keylogger on it, it doesn't matter if your password is strong. Etc. Lots of attacks boil down to the attacker convincing you to unknowingly divulge your password, and if that password is the only thing securing your account, you're boned no matter how strong it is.
- TimTheTinker 7y ago
  > unknowingly divulge your password What's to keep you from unknowingly divulging your MFA token's current generated code? You're right that being phished/keylogged pwns a password-only account no matter how strong the password, but MFA isn't immune to phishing/keylogging/clipboard stealing either. Yes, the generated code will only give them access for 30 seconds (or whatever the algorithm's time window), but that's more than enough time for an attacker to get substantial work done. I maintain that strong passwords in a password manager are probably good enough for security-conscious/appropriately skeptical people. For folks like that, MFA likely isn't worth the trouble - at least not quite yet.
  - jarfil 7y ago
    My main gripe with MFA, is that once you have 20+ services each one with a different token, it becomes tedious to sift through them to find the right one. I'd much rather have some MFA app capable of detecting where you're logging in, and a "click to authorize" option. That wouldn't completely stop someone from being able to steal the token, but it would thwart most simple keyloggers.
    - TimTheTinker 7y ago
      1Password has that :-) So if you auto-fill on a login page, it will place your username, password, and 2FA codegen into the site's authentication fields. It will not auto-suggest a login if you're not on the site it originated from - which is often enough to cause people to take a second look at the URL (which really helps thwart phishing). Plus, it sends your authentication info to the browser via a secure connection to the 1Password browser extension, so (a) your credentials can't be keylogged, and (b) they never touch the clipboard, so they can't be stolen from there either. But all of that is also true of non-MFA logins from 1Password. So again, I don't see the added benefit of MFA if you're already using 1Password with long random passwords.
Falkon1313 7y ago
>using MFA always reduces your personal attack surface Actually it increases it. In theory it makes attacks more difficult even with the increased attack surface, but in practice, it may make it easier. Some places let you reset a password if you have the MFA. And if the MFA was on a phone, which also has your email, which is how you'd normally reset your password, then of course it's equally vulnerable.
- TimTheTinker 7y ago
  > Some places let you reset a password if you have the MFA. I wasn’t aware of that - that’s horrifying but not surprising. Well, in that case, disable/remove MFA! On that note, if an account requires “security questions”, consider using 1Password’s password generator, but set to 4 random words separated by spaces. That can help reduce the increased attack surface from fraudulent account recovery - use words to avoid someone saying “oh it’s just a bunch of gibberish” over the phone.

metildaa 7y ago

Rate-limiting & banning after repeat failed login attempts should be the baseline moat an IT admin or selfhosted infrastructure should have. Fail2ban rules like "after 5 failed logins, ban for 30min, 10 failed logins in a day (with no succesful login) is a permaban" will curtail most non-spear phishing attacks.

deogeo 7y ago
A permaban is an awful idea. A legitimate user who forgot their password can easily go through more than 10 failed attempts as they try variations of what they think their own password might be. "I know I used my usual password, but did it start lower or upper case? Or camel case... did I end it with a number? Did the service require a special symbol, so I added that to the end? Or to the beginning.." - banned.
- Polyisoprene 7y ago
  Or getting your account banned after someone failed trying to brute force it and not being able to access it due to changes in security policies.
  - metildaa 7y ago
    Fail2ban bans an IP address or range of IPs, not specific users.
    - hombre_fatal 7y ago
      That advice is pretty antiquated. The reality is that, these days, I rent $5 worth of botnet time and make {user,password} combo login attempts from thousands of residential IP addresses. You might think your advice is a good "might as well" elementary, but generally if people want to curl your /login page from their laptop, then they are also buying $5 scripts off Hack-Forums that automate botnet cred stuffing against your service as well. And you'll need a better gameplan than fail2ban.
- metildaa 7y ago
  Hence following current NIST guidelines which do not require regular password changes, capitals, special characters or numbers in passwords: https://www.enzoic.com/surprising-new-password-guidelines-nist/ https://www.enzoic.com/surprising-new-password-guidelines-ni... Don't be a PITA to your users, and you've eliminated most of the "guess what password you used" game.
tialaramex 7y ago
Use something like random token buckets not simple rate limiting. If a user fails credential checks (e.g. password), track it, if their current failure rate is N, tell them they tried too many wrong credentials, come back later. Every random(1,T) seconds any failed users get their failure count reduced by one until it's zero and you stop tracking it for now. By choosing N and T you can give users a relatively large number of "goes" to remember their password after a long period away, but not give attackers too many chances to guess a not-awful password by brute force. For example if N is 10 and T is 7200 then a user can try ten passwords, then an average of 24 more attempts per day but exactly when they can make another attempt is random. This allows your good guys to have a fair chance against any bad guys smashing the "retry" button to try to lock them out. If the bad guys give up and go away, the user quickly returns to having ten attempts.

smacktoward 7y ago

The point of the article is that many common attacks work just as well against completely random, unique passwords as they do against weak/reused ones. If you get phished, it doesn't matter if your password is strong. If your machine has a keylogger on it, it doesn't matter if your password is strong. Etc. Lots of attacks boil down to the attacker convincing you to unknowingly divulge your password, and if that password is the only thing securing your account, you're boned no matter how strong it is.

TimTheTinker 7y ago
> unknowingly divulge your password What's to keep you from unknowingly divulging your MFA token's current generated code? You're right that being phished/keylogged pwns a password-only account no matter how strong the password, but MFA isn't immune to phishing/keylogging/clipboard stealing either. Yes, the generated code will only give them access for 30 seconds (or whatever the algorithm's time window), but that's more than enough time for an attacker to get substantial work done. I maintain that strong passwords in a password manager are probably good enough for security-conscious/appropriately skeptical people. For folks like that, MFA likely isn't worth the trouble - at least not quite yet.
- jarfil 7y ago
  My main gripe with MFA, is that once you have 20+ services each one with a different token, it becomes tedious to sift through them to find the right one. I'd much rather have some MFA app capable of detecting where you're logging in, and a "click to authorize" option. That wouldn't completely stop someone from being able to steal the token, but it would thwart most simple keyloggers.
  - TimTheTinker 7y ago
    1Password has that :-) So if you auto-fill on a login page, it will place your username, password, and 2FA codegen into the site's authentication fields. It will not auto-suggest a login if you're not on the site it originated from - which is often enough to cause people to take a second look at the URL (which really helps thwart phishing). Plus, it sends your authentication info to the browser via a secure connection to the 1Password browser extension, so (a) your credentials can't be keylogged, and (b) they never touch the clipboard, so they can't be stolen from there either. But all of that is also true of non-MFA logins from 1Password. So again, I don't see the added benefit of MFA if you're already using 1Password with long random passwords.

Falkon1313 7y ago

>using MFA always reduces your personal attack surface Actually it increases it. In theory it makes attacks more difficult even with the increased attack surface, but in practice, it may make it easier. Some places let you reset a password if you have the MFA. And if the MFA was on a phone, which also has your email, which is how you'd normally reset your password, then of course it's equally vulnerable.

TimTheTinker 7y ago
> Some places let you reset a password if you have the MFA. I wasn’t aware of that - that’s horrifying but not surprising. Well, in that case, disable/remove MFA! On that note, if an account requires “security questions”, consider using 1Password’s password generator, but set to 4 random words separated by spaces. That can help reduce the increased attack surface from fraudulent account recovery - use words to avoid someone saying “oh it’s just a bunch of gibberish” over the phone.