4 ms·

6 characters in length seems a bit shoddy.

by 6LLvveMx2koXfwn 5y ago

wccrawford 5y ago
Yeah, bump that to 8 and it's more reasonable. And if it's already required to be randomly chosen, why not 10?
- deleted 5y ago
  [deleted]
- xboxnolifes 5y ago
  It's not 10 because it still needs to be memorized.
  - bombcar 5y ago
    That’s the key people are missing. There’s a trade-off (though people can easily memorize phone numbers for example) when the password gets to complicated and you have to write it down.
  - jihadjihad 5y ago
    I know it's hard to imagine, but before we all held supercomputers in our pockets we all used to have dozens of ten-digit numbers memorized. I still remember my grade school friends' phone numbers.
    - adventured 5y ago
      You were an extreme outlier if you bothered to memorize dozens of ten digit phone numbers in the era before everyone had a cellphone. The average person doesn't even have ten good friends, much less a need to memorize dozens of phone numbers. They would buy address books / contact books to write down dozens of numbers, not memorize numbers they very rarely use.
      - dylan604 5y ago
        Or even more niche in your outlier status if you could remember IPs of the commonly used servers without a DNS in place. Most of the time, local networked IPs all start with the same values for the first 3 octets (maybe 2 if VLAN but then usually only one digit diff). The same was true for most people's local phone number memorized registry. Those of us old enough, we only had to dial 5 digits using (70s) the last number of the prefix before eventually moving to 7 digits to include the full prefix (80s). The world suddenly changed when we had to dial the entire area code as well (90s).
      - karaterobot 5y ago
        I think "dozens" is an overstatement, but 10-20 wasn't unusual. In college, I could have given you the number for a dozen delivery restaurants, easily. Not proud of it, just saying. That's not counting family, friends, services like taxi companies and movie theaters, and work.
        vel0city 5y ago
        How many different area codes did those dozen delivery restaurants and taxi companies have? How many different exchanges? Was each one a unique area code, each a unique exchange? If not, then you're not really remembering unique 10 digit numbers. There's going to be a lot of repeated numbers in there.
    - Semaphor 5y ago
      I remember 2 out of the 3 landline numbers (one is my parents, still using that) I used to know, my 2 ICQ numbers, and my mobile phone number (which is still the same now, 20 years later). I never felt the need to remember a ton of numbers, that’s what phone books (digital or analog) are for and why I now use a password manager ;)
    - KennyBlanken 5y ago
      You didn't memorize ten random digits. Area code, exchange, four digit extension is six things... Area code was likely all the same, maybe 2-3 tops, and associated both with the following exchange and geography, and used extensively. Exchange, also likely all the same, maybe 6 at most, and again likely associated with geography.
      - vel0city 5y ago
        On top of that, in many areas in the US the time between moving to ten-digit dialing and the time of cell phones becoming even somewhat popular is really only a few years or less. Some places in the US are only finally being forced to move to ten digit dialing with some places still supporting seven digit dialing. https://www.kcbd.com/2021/10/12/new-10-digit-dialing-procedure-mandatory-texas-customers-806-area-code/ https://www.kcbd.com/2021/10/12/new-10-digit-dialing-procedu... Note the date on this: Oct 2021! > Starting on Monday, October 25, 2021, Texans with phone numbers in the 254, 361, 409, 806, 830, 915 and 940 area codes must dial 10-digits (area code + telephone number) for all local calls.
    - dwighttk 5y ago
      Sure but for most of them it was only ~ the last 5 digits that differed. Unless you were more cosmopolitan and made lots of long distance calls.
tempnow987 5y ago
Rate limit the requests. Do an account lockout with an email click to re-enable after 10 guesses, do 2FA on new devices and you get pretty good security. For many systems, users can memorize 6 digits easily. The reality is, whatever your password reset flow is is enough. If you can reset your password with a 6 digit number via text, then that is maximum needed for actual password as well in most cases.
- marcosdumay 5y ago
  None of that will help you if your hash database leaks. But I'm ok with letting the decision with the user.
  - tempnow987 5y ago
    Interesting. In most cases if hash database leaks, the ability to crack depends on two factors, not one (password and hash difficulty) assuming you are salting properly. You can specify pretty high difficulty with argon2id etc. Ie, shoot for a one second runtime with a very high memory requirement (you can go to GB range even). So I'm not sure all is always necessarily lost

6 characters in length seems a bit shoddy.

wccrawford 5y ago

Yeah, bump that to 8 and it's more reasonable. And if it's already required to be randomly chosen, why not 10?

deleted 5y ago
[deleted]
xboxnolifes 5y ago
It's not 10 because it still needs to be memorized.
- bombcar 5y ago
  That’s the key people are missing. There’s a trade-off (though people can easily memorize phone numbers for example) when the password gets to complicated and you have to write it down.
- jihadjihad 5y ago
  I know it's hard to imagine, but before we all held supercomputers in our pockets we all used to have dozens of ten-digit numbers memorized. I still remember my grade school friends' phone numbers.
  - adventured 5y ago
    You were an extreme outlier if you bothered to memorize dozens of ten digit phone numbers in the era before everyone had a cellphone. The average person doesn't even have ten good friends, much less a need to memorize dozens of phone numbers. They would buy address books / contact books to write down dozens of numbers, not memorize numbers they very rarely use.
    - dylan604 5y ago
      Or even more niche in your outlier status if you could remember IPs of the commonly used servers without a DNS in place. Most of the time, local networked IPs all start with the same values for the first 3 octets (maybe 2 if VLAN but then usually only one digit diff). The same was true for most people's local phone number memorized registry. Those of us old enough, we only had to dial 5 digits using (70s) the last number of the prefix before eventually moving to 7 digits to include the full prefix (80s). The world suddenly changed when we had to dial the entire area code as well (90s).
    - karaterobot 5y ago
      I think "dozens" is an overstatement, but 10-20 wasn't unusual. In college, I could have given you the number for a dozen delivery restaurants, easily. Not proud of it, just saying. That's not counting family, friends, services like taxi companies and movie theaters, and work.
      - vel0city 5y ago
        How many different area codes did those dozen delivery restaurants and taxi companies have? How many different exchanges? Was each one a unique area code, each a unique exchange? If not, then you're not really remembering unique 10 digit numbers. There's going to be a lot of repeated numbers in there.
  - Semaphor 5y ago
    I remember 2 out of the 3 landline numbers (one is my parents, still using that) I used to know, my 2 ICQ numbers, and my mobile phone number (which is still the same now, 20 years later). I never felt the need to remember a ton of numbers, that’s what phone books (digital or analog) are for and why I now use a password manager ;)
  - KennyBlanken 5y ago
    You didn't memorize ten random digits. Area code, exchange, four digit extension is six things... Area code was likely all the same, maybe 2-3 tops, and associated both with the following exchange and geography, and used extensively. Exchange, also likely all the same, maybe 6 at most, and again likely associated with geography.
    - vel0city 5y ago
      On top of that, in many areas in the US the time between moving to ten-digit dialing and the time of cell phones becoming even somewhat popular is really only a few years or less. Some places in the US are only finally being forced to move to ten digit dialing with some places still supporting seven digit dialing. https://www.kcbd.com/2021/10/12/new-10-digit-dialing-procedure-mandatory-texas-customers-806-area-code/ https://www.kcbd.com/2021/10/12/new-10-digit-dialing-procedu... Note the date on this: Oct 2021! > Starting on Monday, October 25, 2021, Texans with phone numbers in the 254, 361, 409, 806, 830, 915 and 940 area codes must dial 10-digits (area code + telephone number) for all local calls.
  - dwighttk 5y ago
    Sure but for most of them it was only ~ the last 5 digits that differed. Unless you were more cosmopolitan and made lots of long distance calls.

tempnow987 5y ago

Rate limit the requests. Do an account lockout with an email click to re-enable after 10 guesses, do 2FA on new devices and you get pretty good security. For many systems, users can memorize 6 digits easily. The reality is, whatever your password reset flow is is enough. If you can reset your password with a 6 digit number via text, then that is maximum needed for actual password as well in most cases.

marcosdumay 5y ago
None of that will help you if your hash database leaks. But I'm ok with letting the decision with the user.
- tempnow987 5y ago
  Interesting. In most cases if hash database leaks, the ability to crack depends on two factors, not one (password and hash difficulty) assuming you are salting properly. You can specify pretty high difficulty with argon2id etc. Ie, shoot for a one second runtime with a very high memory requirement (you can go to GB range even). So I'm not sure all is always necessarily lost