4 ms·

Guy Who Invented Annoying Password Rules Now Regrets Wasting Your Time (2017)

28 points by rahuldottech 7y ago

tomohawk 7y ago
> He certainly wasn’t a security expert. Yep - when the government performs a function, you get whatever GS 12 or 13 employee is in that seat making decisions with little or no accountability. Good, bad, or indifferent - mostly indifferent.
kerkeslager 7y ago
In theory, the idea is correct, but making it a metric falls prey to Goodhart's Law: When a measure becomes a target, it ceases to be a good measure. Using a wide range of characters is good, but when you make that a rule for users who don't grok that the point of that is to create more entropy, they use those characters in ways that create less entropy, like l33tSp3@k, incrementing a number at the end, name and birthday to get numbers, etc. Still, just letting users set their password to "password" isn't acceptable. We have a responsibility to protect our users from hacking, even if they don't know how to select a good password. Minimum password lengths might be a start, but leaves room for a lot of issues. My feel is that users don't know how to select passwords, so in 2019 we should be selecting secure passwords for users. My ISP does this: our wireless router came with a randomly generated password. They allow you to change the password (and you can change it to something insecure like "password") but most users, I suspect, won't change the password if the existing one is something easy to remember (in the style of "correct horse battery staple"). One could lock this down further by generating new passwords on password reset, instead of allowing users to set a password. This is a bit heavy-handed, but it prevents all the common attacks against passwords that I can think of.
- rasz 7y ago
  >My ISP does this: our wireless router came with a randomly generated password. yeah, about that https://www.usenix.org/system/files/conference/woot15/woot15-paper-lorente.pdf https://www.usenix.org/system/files/conference/woot15/woot15... "With no exceptions, all WPA2 default key generating algorithms that were recovered during our experiments use either the router’s MAC address or serial number, or both, as input."
  - kerkeslager 7y ago
    That's true, but the solution is simple: don't do that. :)
- LeifCarrotson 7y ago
  One simple way to help make sure your employees are selecting good passwords without a mountain of rules is to run your users' password file against a tool like john, perhaps adding details like company name and their personal info to the dictionary. If the password stands up to a few minutes of brute force and dictionary attacks, that by no means makes you secure against hours or days of attacks but does rule out Password1 and the like.
  - kerkeslager 7y ago
    Frankly, this technique is security theater and doesn't deserve mention. As you mentioned, it is a fairly weak defense against dictionary attacks, and it does nothing to prevent possibly the most common attack: users re-using passwords they've used on other sites, and those sites leaking passwords.
jolmg 7y ago
> Inevitably, you have to wonder if Bill not only feels regretful but also a little embarrassed. I can't avoid imagining Bill reading this sentence, implying that he should feel embarrassed too. There's no reason to say that. It's a completely redundant sentence. It only seems to serve to put him down.

28 points by rahuldottech 7y ago

> He certainly wasn’t a security expert. Yep - when the government performs a function, you get whatever GS 12 or 13 employee is in that seat making decisions with little or no accountability. Good, bad, or indifferent - mostly indifferent.

kerkeslager 7y ago

In theory, the idea is correct, but making it a metric falls prey to Goodhart's Law: When a measure becomes a target, it ceases to be a good measure. Using a wide range of characters is good, but when you make that a rule for users who don't grok that the point of that is to create more entropy, they use those characters in ways that create less entropy, like l33tSp3@k, incrementing a number at the end, name and birthday to get numbers, etc. Still, just letting users set their password to "password" isn't acceptable. We have a responsibility to protect our users from hacking, even if they don't know how to select a good password. Minimum password lengths might be a start, but leaves room for a lot of issues. My feel is that users don't know how to select passwords, so in 2019 we should be selecting secure passwords for users. My ISP does this: our wireless router came with a randomly generated password. They allow you to change the password (and you can change it to something insecure like "password") but most users, I suspect, won't change the password if the existing one is something easy to remember (in the style of "correct horse battery staple"). One could lock this down further by generating new passwords on password reset, instead of allowing users to set a password. This is a bit heavy-handed, but it prevents all the common attacks against passwords that I can think of.

rasz 7y ago
>My ISP does this: our wireless router came with a randomly generated password. yeah, about that https://www.usenix.org/system/files/conference/woot15/woot15-paper-lorente.pdf https://www.usenix.org/system/files/conference/woot15/woot15... "With no exceptions, all WPA2 default key generating algorithms that were recovered during our experiments use either the router’s MAC address or serial number, or both, as input."
- kerkeslager 7y ago
  That's true, but the solution is simple: don't do that. :)
LeifCarrotson 7y ago
One simple way to help make sure your employees are selecting good passwords without a mountain of rules is to run your users' password file against a tool like john, perhaps adding details like company name and their personal info to the dictionary. If the password stands up to a few minutes of brute force and dictionary attacks, that by no means makes you secure against hours or days of attacks but does rule out Password1 and the like.
- kerkeslager 7y ago
  Frankly, this technique is security theater and doesn't deserve mention. As you mentioned, it is a fairly weak defense against dictionary attacks, and it does nothing to prevent possibly the most common attack: users re-using passwords they've used on other sites, and those sites leaking passwords.

jolmg 7y ago

> Inevitably, you have to wonder if Bill not only feels regretful but also a little embarrassed. I can't avoid imagining Bill reading this sentence, implying that he should feel embarrassed too. There's no reason to say that. It's a completely redundant sentence. It only seems to serve to put him down.