Passwords, why not 2 or 3 little ones instead of 1 big one

[Carson Dyle]

I came up with a set of rules that worked for every system. I think it was 7-8 characters (on had an 8 char max) with one symbol (specific symbols as one unix system didn't like a specific set) and one number/cap.

That's pretty much what I do - use a rule based system for creating passwords - for probably a couple hundred passwords. The most critical ones (i.e. those that could actually cost me money if cracked, rather than just a minor inconvenience) use a more complex set of rules.

If any system prompted me to change, I force reset ALL of them. It took around an hour, 1/month. It was the only thing I could do to remain sane.

The rules need to be such that if someone can see one of your passwords, then they would be very unlikely (or totally unable) to figure out your password on other sites. Otherwise, you may as well use the same password on every site.

 

[Phoenix86]

.........I have no idea why I accidentally typed "friend5@aSS" without even thinking about it.

Phoenix, I guess I had some encrypted things to tell you...

I guess I'm lucky it wasn't "friend2@aSS" or "friend4@aSS"?

'Cause that might have been awkward!

 

[Phoenix86]

That's pretty much what I do - use a rule based system for creating passwords - for probably a couple hundred passwords. The most critical ones (i.e. those that could actually cost me money if cracked, rather than just a minor inconvenience) use a more complex set of rules.

In my position I had the ear of people who could have enforced some level of system wide changes, standards or, ya know, FUCKING SSO. Lots of systems had the option, but all the admins were too lazy to enable it. To be fair, with the complex security in place there were tons of firewall/routing rules on top of system limits and it would have taken at least 4 people to make it happen, but again, lazy.

Not my systems, so screw you if I play by the rules you put in place.

The rules need to be such that if someone can see one of your passwords, then they would be very unlikely (or totally unable) to figure out your password on other sites. Otherwise, you may as well use the same password on every site.

That's kind of how I handle things, but with tiers of passwords. My password here isn't super complex and if you guessed it you'd have some idea how my lowest tier is formed. For shit that actually matters it's as complex and random as the system allows. Good luck guessing anything financial, I don't even know those passwords per say. Hold a gun to my head and I couldn't log into my bank if I don't have access to something else.

 

[Jeff7]

That's pretty much what I do - use a rule based system for creating passwords - for probably a couple hundred passwords. The most critical ones (i.e. those that could actually cost me money if cracked, rather than just a minor inconvenience) use a more complex set of rules.

The rules need to be such that if someone can see one of your passwords, then they would be very unlikely (or totally unable) to figure out your password on other sites. Otherwise, you may as well use the same password on every site.

At that point, the system approaches the level of "use random characters."


(Good god, a few hundred passwords?! )

 

[John Connor]

Perhaps all devices and browsers should employ the same technology as what PWDhash does. https://www.pwdhash.com/ I have been using the addon in Firefox and now Pale Moon since I don't know when. There are a few instances where it can't be used or it doesn't function correctly and in that case you just have to click in the password field and then hit the F2 key. But I imagine that if a hash mechanism were employed in computers and devices this wouldn't be an issue. I do use keepass for the other crap I couldn't use PWDhash for. Like cPanel and FTP. And the Keepass database is encrypted with a 7Z SFX archive using AES 256 and a long complicated password and backed up to no less then four locations. God forbid I lose those passwords.

As to website databases, perhaps they should just use the simple, yet secure Bcrypt hash. My own phpBB forum uses that and I added a plugin to my WordPress blog that updated the database and all current passwords to Bcrypt. Speaking of WP. Sometime this last summer I added a blog post about me reading an article on hackers at DEFCON who had one hell of a time cracking Bcrypt passwords. Now if the password is simple it more than likely will be cracked. But I'm willing to bet that something that's at least 10 digits long with at least one symbol or number that is Bcrypted would be a real bitch to crack. At least for now with current GPUs. By that time a new hash will come about.

So with that, mandate a 10 digit password with at least a number or symbol and Bcrypt the damn thing. Come to think of it, I don't think it's so much of a weak database issue as it is a type of side channel attack. What I mean by that is some kind of malware that copies your password and sends it to the hacker's computer. But then again you hear about password databases being ripped off all the time and then you here about it in the news three damn months latter. Such was the case with ebay. Now if computers and devices used that PWD hash type mechanism, the passwords would be complicated as hell combined with Bcrypt.


I think computers are now using some kind of RNG to make passwords as well. I can't remember what that was all about.

 

[Dr. Zaus]

I made this argument with my wife, but it came up short.

 

[John Connor]

Good luck guessing anything financial, I don't even know those passwords per say. Hold a gun to my head and I couldn't log into my bank if I don't have access to something else.

Just have to. What if I hold a gun...no, drill to your head and tell you to tell me what mechanism you used to get into your precious Cayman account? :sneaky:

So now were gonna need some plausible deniability with high level accounts. Make the organized crime jackass think the funds are being transferred to another account.

 

[John Connor]

https://www.youtube.com/watch?v=yzGzB-yYKcc

LMAO!

 

[destrekor]

Yes. Let's create an authentication system where once you can fool it with copied data, we can *never* fix it, and you can impersonate an individual forever on all accounts they possess!




edit: "Excuse me Dr, I need you to change my fingerprints and the pattern of my retinas. My information got leaked."

Yeah biometric and retina scan sounds cool because it's so futeristic, but reality is, it's basically a password that never changes, at all. It would also encourage violence, as people who really want your info would just hack your fingers off if you don't give them access. I could actually see courts do this, they already get so mad because they can't recover encrypted iphones. If they could just cut someone's finger off they would.

Notice I did still say multifactor.

As for the copying bit: if we used retina, you'd literally have to take an eyeball from someone; if we used fingerprints, copying a fingerprint is not exactly easy. Regardless. The added step is multifactor authentication.

While it is still technically a type of password, chip and pin work great too. The military and government swear by it, and it is freaking awesome once you get over the fact that it makes life a little more cumbersome with regards to how you access data out of the office.

Use public/private certificate/key pairs, along with a numerical pin. Stupid simple and yet incredibly difficult for an attacker to do anything other than steal your card. Military systems utilize a safeguard for that: after so many incorrect PIN attempts, your account is locked, that card will do no good until you physically take it in to a place to unlock it (and you need documentation, IIRC).

Again, cumbersome, but in this age of data insecurity due to stupid passwords all around (to include IS sysadmins!), it may be the only way forward.

Point being, the password as it stands needs to be eradicated. Even your 40 character sentence password is still accessible in the event of a data breach.

A nice bonus of public key cryptography, at least as implemented by the government, is the availability of digital signatures. Now you can digitally sign documents (super easy in Acrobat Reader if a signature block was drawn) instead of printing and scanning or drawing a hand-made version on screen.

After doing this for so long, I find it laughable that digital signatures on web forms can sometimes be as simple as: "Please type your name to sign the form." Seriously? lol A bot can do that, let alone any would-be criminal.

 

[John Connor]

 

[Gryz]

This is like people 100 years ago discussing if mechanical horses should be made of wood or iron.

In the eighties and nineties there was a project at MIT that was called "Kerberos".

From the wiki-page: "Kerberos /ˈkərbərəs/ is a computer network authentication protocol which works on the basis of 'tickets' to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner".

The goal is very simple.
When you log into your computer, you type your password once. Your computer talks to a Kerberos-server, and gets a ticket. A ticket is cryptographic information that is used when you authenticate to other computers or services. Suppose you want to log in into a website, cryptographic information is exchanged between your computer, your Kerberos-server, the website and the website's Kerberos-server. All done in an encypted way, that can not be replayed, etc. Basically once logged in, you can access all services you are entitled to, without ever having to retype your password. (Unless specifically asked).

I used to think this was the direction we were moving in. But it turns out we have made zero progress towards better and easier authentication. Microsoft has used Kerberos for their Windows authentication. (And I must admit, I hate Windows authentication. But not because of the underlying architecture, but probably because of the implementation and terrible documentation and UI). But besides Microsoft, I don't think Kerberos didn't go anywhere. And there do not seem to be new projects that have a similar goal. Such a shame.

In the nineties we developed protocols for the Internet.
Protocols that could be used for free by all people in the world, and all companies in the world.
I think this is the basis for the success of the net.
Those days are over.
Nowadays we only see individual companies developing their own service and product.

A few become successful (facebook, twitter). Most fail. But in all cases, the technology and the protocols are owned by individual companies. It might seem cool that you can post a twitter message. But in fact, technology-wise we are regressing back into the dark ages.

 

[mikeymikec]

Multiple passwords for a single account are silly. Account security systems should be more diverse than that.

Something you know (e.g. password), something you are (e.g. biometric security), something you have (e.g. card reader with number generator).

Some sites I've encountered go one further so the site you're communicating with also goes some way to prove its authenticity to you, you agree that the site is going to show you a chosen image (or piece of text) each time you log in, so if that item isn't present when you go to log in, you have cause for concern.

 

[BurnItDwn]

Just use easy to remember passwords. Something like qwerty or 12345. Also, please share what bank you go to, and also any account numbers so we can "test them" for security

 

[Strk]

Just use easy to remember passwords. Something like qwerty or 12345. Also, please share what bank you go to, and also any account numbers so we can "test them" for security

That sounds like the combination an idiot would have on his luggage!

 

[z1ggy]

Everything needs to just become biometric. Within the next decade, I'm guessing the majority of cell phone and computer users will have a device capable of this.

Even locks on doors should have finger print sensors on them at the bare min. It would obviously be expensive technology at first, but much more secure.

 

[BurnItDwn]

Everything needs to just become biometric. Within the next decade, I'm guessing the majority of cell phone and computer users will have a device capable of this.

Even locks on doors should have finger print sensors on them at the bare min. It would obviously be expensive technology at first, but much more secure.

And the majority of unsavory people will have some simple method to defeat it....

 

[lxskllr]

And the majority of unsavory people will have some simple method to defeat it....

The government can compel you to release a biometric lock. The same isn't true of passwords.

 

[Phoenix86]

12345

That's the combinations to my luggage!

 

[BurnItDwn]

That sounds like the combination an idiot would have on his luggage!

That's the combinations to my luggage!

I love it I love it I love it!!!!

You know I always drink coffee when I look at the Radar!!!!

HOT


TOOO HOT


Man, I love that movie so much!

 

[ViviTheMage]

just 2 factor to my phone for everything.... that'd a much better solution.

 

[KeithP]

So it would load a page like

Login: *****

Password 1: ***

Password 2: ****

Why have a "login" at all? It is pointless. Just have two passwords.

-KeithP

 

[SagaLore]

What's the difference between:
password1: asdf2
password2: ty7eu

And a single password: asdf2ty7eu??

It just forces the user to build out pass phrases which will end up stronger than what the typical user uses for a single password.

 

[SagaLore]

The first 2 are easier to brute force.

We just need encrypted QR codes for all.

Not at all. You'd combine the passwords as part of the salting and hashing process before storing/validating.

This password is actually not strong at all by today's standards:

"aN@ndt3ch"

This password is very strong:

"anandtech1 forums off-topic."

 

[s0me0nesmind1]

"It's a riddle! 'Speak 'friend5@aSS1' and enter.'"


At that point, what is it then?
friend5@aSS1
friend5@aSS2
friend5@aSS3
friend5@aSS4
...
friend5@aSS9
friend6@aSS0




.........I have no idea why I accidentally typed "friend5@aSS" without even thinking about it.

Phoenix, I guess I had some encrypted things to tell you...

I never understand the logic of required password changes. There 98% of people are GUARANTEED going to just add 1 to their passwords. No question. The human brain can't keep up with a new worded password every 60 days, in addition to adding it to the HUGE vault of different password requirements that they already have to remember.

 

[s0me0nesmind1]

Not at all. You'd combine the passwords as part of the salting and hashing process before storing/validating.

This password is actually not strong at all by today's standards:

"aN@ndt3ch"

This password is very strong:

"anandtech1 forums off-topic."

Whats your logic behind that? Most brute-forcing is done through dictionary attacking, hence, aN@ndt3ch wouldn't be in a given word list, IN ADDITION to the variation in caps.

It wouldn't be very hard to use a dictionary attack in which it takes a group of words and attacks with all word on the lists in variations of 3-6 words per guess.