5 ms·

The point of the article is that many common attacks work just as well against completely random, unique passwords as they do against weak/reused ones. If you g

The point of the article is that many common attacks work just as well against completely random, unique passwords as they do against weak/reused ones. If you get phished, it doesn't matter if your password is strong. If your machine has a keylogger on it, it doesn't matter if your password is strong. Etc. Lots of attacks boil down to the attacker convincing you to unknowingly divulge your password, and if that password is the only thing securing your account, you're boned no matter how strong it is.

TimTheTinker 7y ago
> unknowingly divulge your password What's to keep you from unknowingly divulging your MFA token's current generated code? You're right that being phished/keylogged pwns a password-only account no matter how strong the password, but MFA isn't immune to phishing/keylogging/clipboard stealing either. Yes, the generated code will only give them access for 30 seconds (or whatever the algorithm's time window), but that's more than enough time for an attacker to get substantial work done. I maintain that strong passwords in a password manager are probably good enough for security-conscious/appropriately skeptical people. For folks like that, MFA likely isn't worth the trouble - at least not quite yet.
- jarfil 7y ago
  My main gripe with MFA, is that once you have 20+ services each one with a different token, it becomes tedious to sift through them to find the right one. I'd much rather have some MFA app capable of detecting where you're logging in, and a "click to authorize" option. That wouldn't completely stop someone from being able to steal the token, but it would thwart most simple keyloggers.
  - TimTheTinker 7y ago
    1Password has that :-) So if you auto-fill on a login page, it will place your username, password, and 2FA codegen into the site's authentication fields. It will not auto-suggest a login if you're not on the site it originated from - which is often enough to cause people to take a second look at the URL (which really helps thwart phishing). Plus, it sends your authentication info to the browser via a secure connection to the 1Password browser extension, so (a) your credentials can't be keylogged, and (b) they never touch the clipboard, so they can't be stolen from there either. But all of that is also true of non-MFA logins from 1Password. So again, I don't see the added benefit of MFA if you're already using 1Password with long random passwords.
- tialaramex 7y ago
  WebAuthn/ U2F are, in fact, immmune to phishing, keylogging, clipboard stealing etcetera. Google reports attacks on their employees are 0% effective for systems where they were able to deploy U2F. If you try to phish it, you get credentials that are useless, because the credentials are bound to the FQDN, it will cheerfully hand over credentials for https://fakebank.example/ https://fakebank.example/ but they aren't the goodbank.example credentials, so it's futile for breaking into your goodbank account. There is no keyboard entry, so nothing for a keyboard logger or clipboard thief. If you've completely taken over the user's hardware I guess all bets are off, but that's a big step up from what you're talking about.
shmerl 7y ago
I don't agree that the conclusion from that is that it makes no difference whether your password is weak or strong. It does make a difference, just not for attacks that don't depend on password's length. I.e. make your passwords strong either way. It will be only worse if you won't.
tempestn 7y ago
The point of the article is that strong passwords are mostly useless, but unique passwords are very important. The article doesn't emphasize this, nor does it point out that this is the primary benefit of password managers. However, the very first attack they describe, which is listed as very high frequency and very easy, is credential stuffing—ie, trying credentials from a breach in other places. Unique passwords completely prevent this common attack.
- TimTheTinker 7y ago
  I disagree with the article on that. Password strength derives from uniqueness and entropy -- nothing else. By this definition, strong passwords are very useful. It's a bad but common security error to equate password strength with matching an arbitrary schema - so yes, by that definition, so-called "strong" passwords are often useless. When a "strong" password is required, most people will unfortunately take a low-entropy word/phrase and perform single additions/substitutions until it clears the bar. Such passwords are indeed nearly worthless.

TimTheTinker 7y ago

> unknowingly divulge your password What's to keep you from unknowingly divulging your MFA token's current generated code? You're right that being phished/keylogged pwns a password-only account no matter how strong the password, but MFA isn't immune to phishing/keylogging/clipboard stealing either. Yes, the generated code will only give them access for 30 seconds (or whatever the algorithm's time window), but that's more than enough time for an attacker to get substantial work done. I maintain that strong passwords in a password manager are probably good enough for security-conscious/appropriately skeptical people. For folks like that, MFA likely isn't worth the trouble - at least not quite yet.

jarfil 7y ago
My main gripe with MFA, is that once you have 20+ services each one with a different token, it becomes tedious to sift through them to find the right one. I'd much rather have some MFA app capable of detecting where you're logging in, and a "click to authorize" option. That wouldn't completely stop someone from being able to steal the token, but it would thwart most simple keyloggers.
- TimTheTinker 7y ago
  1Password has that :-) So if you auto-fill on a login page, it will place your username, password, and 2FA codegen into the site's authentication fields. It will not auto-suggest a login if you're not on the site it originated from - which is often enough to cause people to take a second look at the URL (which really helps thwart phishing). Plus, it sends your authentication info to the browser via a secure connection to the 1Password browser extension, so (a) your credentials can't be keylogged, and (b) they never touch the clipboard, so they can't be stolen from there either. But all of that is also true of non-MFA logins from 1Password. So again, I don't see the added benefit of MFA if you're already using 1Password with long random passwords.
tialaramex 7y ago
WebAuthn/ U2F are, in fact, immmune to phishing, keylogging, clipboard stealing etcetera. Google reports attacks on their employees are 0% effective for systems where they were able to deploy U2F. If you try to phish it, you get credentials that are useless, because the credentials are bound to the FQDN, it will cheerfully hand over credentials for https://fakebank.example/ https://fakebank.example/ but they aren't the goodbank.example credentials, so it's futile for breaking into your goodbank account. There is no keyboard entry, so nothing for a keyboard logger or clipboard thief. If you've completely taken over the user's hardware I guess all bets are off, but that's a big step up from what you're talking about.

shmerl 7y ago

I don't agree that the conclusion from that is that it makes no difference whether your password is weak or strong. It does make a difference, just not for attacks that don't depend on password's length. I.e. make your passwords strong either way. It will be only worse if you won't.

tempestn 7y ago

The point of the article is that strong passwords are mostly useless, but unique passwords are very important. The article doesn't emphasize this, nor does it point out that this is the primary benefit of password managers. However, the very first attack they describe, which is listed as very high frequency and very easy, is credential stuffing—ie, trying credentials from a breach in other places. Unique passwords completely prevent this common attack.

TimTheTinker 7y ago
I disagree with the article on that. Password strength derives from uniqueness and entropy -- nothing else. By this definition, strong passwords are very useful. It's a bad but common security error to equate password strength with matching an arbitrary schema - so yes, by that definition, so-called "strong" passwords are often useless. When a "strong" password is required, most people will unfortunately take a low-entropy word/phrase and perform single additions/substitutions until it clears the bar. Such passwords are indeed nearly worthless.