Communities

Writing
Writing
Codidact Meta
Codidact Meta
The Great Outdoors
The Great Outdoors
Photography & Video
Photography & Video
Scientific Speculation
Scientific Speculation
Cooking
Cooking
Electrical Engineering
Electrical Engineering
Judaism
Judaism
Languages & Linguistics
Languages & Linguistics
Software Development
Software Development
Mathematics
Mathematics
Christianity
Christianity
Code Golf
Code Golf
Music
Music
Physics
Physics
Linux Systems
Linux Systems
Power Users
Power Users
Tabletop RPGs
Tabletop RPGs
Community Proposals
Community Proposals
tag:snake search within a tag
answers:0 unanswered questions
user:xxxx search by author id
score:0.5 posts with 0.5+ score
"snake oil" exact phrase
votes:4 posts with 4+ votes
created:<1w created < 1 week ago
post_type:xxxx type of post
Search help
Notifications
Mark all as read See all your notifications »
Q&A

Welcome to Software Development on Codidact!

Will you help us build our independent community of developers helping developers? We're small and trying to grow. We welcome questions about all aspects of software development, from design to code to QA and more. Got questions? Got answers? Got code you'd like someone to review? Please join us.

Are "strong passwords" at all meaningful?

+10
−0

Whenever registering to diverse sites on the net, you are often forced to enter a so called "strong password", which would ideally contain both upper case letters, lower case letters, digits, and some other character like punctuation. As hard to remember as possible.

What I don't understand from a software development point of view is how these characters would make that much of a difference.

All of it seems to assume that a hacker trying to break a password would utilize so-called brute force. That is: try "A", try "B" ... "try AA" and so on. The more variations, the longer it takes to execute the brute force algorithm.

If I have a password of up to 10 capital letters A to Z plus "empty", that's 27 combinations, for a total of 2710 combinations.

As opposed to having a 10 letter password in the whole UTF8/ASCII 7 bit range, 127 combinations - 32 non-printable + 1 empty = 96, for a total of 9610 combinations.

Sure, a significant difference, astronomical even. But... if they would execute a brute force across TCP/IP they can maybe try one combination every millisecond or something, assuming great bandwidth. Worst case scenario for the 2710 scenario is then 57 days. Some 4 weeks on average. Assuming there's no big latency or packet drop for a significant lower bandwidth, in which case this isn't really feasible at all.

I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever... it is already too much of an obstacle. Unless they hope to get lucky on the initial bunch permutations, which can of course happen.

Assuming that brute force is actually what's used, which sounds quite unlikely to me. Instead of something else entirely: keyword logging, packet sniffing, the human factor ("Hi this is your bank please send us your password") etc etc.

So is the usefulness of this whole "strong password" thing just an urban legend, where companies force us to memorize ridiculously hard to remember passwords for no real gain? Why is the number of symbol table combinations in the password oh so important on almost any Internet site these days?

History
Why does this post require moderator attention?
You might want to add some details to your flag.
Why should this post be closed?

5 comment threads

Relevant XKCD: https://xkcd.com/936/ (3 comments)
See also: SE thread "What is your way to create good passwords that can actually be remembered?" (1 comment)
I think the question becomes more interesting in the context of most popular services (and most workp... (1 comment)
Off-topic (5 comments)
Security theater (2 comments)

5 answers

+8
−0

Passwords are annoying. That's why there are so many "The End of Passwords" articles. I'm looking forward to that day, but in the meantime it's the most common way to do authentication anywhere with a computer.

With that out of the way, let me rate the worst passwords to use by category:

Bad Passwords

I'm going to elaborate on the regions of the chart below.

Venn diagram

Worst

One of the top-used passwords

Think abcdef, 123456, iloveyou, Pa$$w0rd, etc. Most of these fall afoul of any website with criteria, but some of them are concocted specifically to get past the "rules."

A leaked password of yours

Remember that forum you signed up for that was later hacked? You better hope you never used that password with that email address anywhere else.

It's an incredibly common attack to find an email/password pair and just try that everywhere. And anyone can try that combination out once it is public.[1]

Bad

Any leaked password

Consider this to be the next step down of "One of the top-used passwords." Brute-forcing may as well try these first. It's going to try them eventually, and there's evidence that real humans used these sequences.

Some web services have recently started reacting to this. I've heard of some that refuse to set your password to the 10,000 most common things they've found in password dumps. I look forward to more of this.

Any password of yours

This is a hedge against those services getting hacked in the future (or already hacked, but no one knows yet). This also includes cute password "schemes" like n79bx4ccb-facebook, n79bx4ccb-microsoft, and so on. Don't do that.

Stuff about you

In all likelihood, this is already covered by "Any leaked password." But just in case, I'm adding the "movie detective" style passwords where they try your daughter's birthday, your favorite poet, or whatever.

Not good

Easy to brute force

Now we're getting to your real question. Like tarhalda implies, this is the place where attacks typically fall into two modes:

Full database exfiltration

Sometimes the attacker gets the whole database. This wouldn't be because of your password (unless you're an administrator). It may be a hack of the server. It may be a backup stored improperly. Credentials accidentally included in public source code. All these have happened.

  • If the Important Stuff™ is not encrypted, you've already lost it. Sorry.

  • If the Important Stuff™ is encrypted, a good place for the attacker to start would be to crack the password hashes and see if those creds still work on the live system.

    • This is a real thing that real attackers do.
    • Sometimes they sell the hashes to other bad people before they're even cracked.
    • Cracking gets faster all the time, and it's already really fast.
    • The first place they're going to try the password is on this system, but they're going to try it anywhere else you might have an account, too.

Vulnerable web service

XKCD posits a badly designed web service that doesn't throttle password guesses or lock you out after enough bad attempts.[2] That's where the math comes in from Lundin, tarhalda, and the XKCD comic.

Historically, the way that security policies defended against this kind of attack was to expire your password and make you change it. In theory, that still works. You could set a kind-of-hard password that doesn't make any of the "worst" or "bad" mistakes and change it every 3 2 1 0.5 months.

But that's a terrible user experience. NIST, a US government standards body, changed its longstanding recommendations[3] to suggest longer, easier-to-remember passwords instead of forced expiration. Not to mention: people will just make their password jimmyjohn-2023Q4 or something and advance it each time. Computers are not great at figuring out the pattern someone used from a single data point.[4]

I haven't seen anyone doing this, but I think it is reasonable for the service to randomly generate a diceware password and offer that as an alternative to following the "X letters, Y numbers, Z symbols" rules. It's basically the same as how services make a fully random "app password" for computer-to-computer credentials and force you to use it. If someone wants to devise their own password, they can fulfill all the password requirements just like before.

The only nice thing about a vulnerable web service is that the attacker probably doesn't care about your data on this site, whatever site it is. If it doesn't restrict suspicious logins, we desperately hope that it's not that critical a website.

What the attacker probably wants is your credentials to try them on GMail, Apple, Amazon, your national taxation system, your work accounts, etc. If you've avoided password re-use, you're probably somewhat safe.

Upshot

  • You don't want to use anything that can be tied to you.
  • You don't want to use anything known to be in use by anyone.
  • You want to have a system for picking passwords that is expensive and hard to crack. Ideally, this is totally random, but it can be random within interesting bounds (assuming there isn't a length limit on your password[5]).

Use something that is genuinely random and does not require you to remember all the passwords. This could be a password manager from a reputable source. It could be a FIDO key (please have a backup). It could be a password card. It could be a physical notebook.

Be safe!


  1. There are free services where you can check your email address(es) or register to be notified if any of them is discovered in a password dump. The original one was called Have I Been Pwned?, but there are others now, too. ↩︎

  2. If you run a web service, please prevent rapid or repeated login abuse, both per-account and per-IP or other ways of identifying abusive attempts. ↩︎

  3. Between 2003 and 2017, NIST had the 90-day expiration and letters / numbers / symbols recommendations that you may be familiar with. It has nominally repudiated all of those guidelines, and the guy wrote them says he was wrong. ↩︎

  4. The server can't look directly at your old passwords to compare with the new one you're setting since they old ones are hashed. You may protest that the "change password" page says "Old password / New password / Retype new password." Yes, that's true. Let me introduce you to the "Forgot my password" page that only uses a new password. Annoying Clever users will just use that page instead.

    To catch someone using an unsafe scheme, the server has to speculatively invent all old passwords they might have used for their last password and hash each of them. That's designed to be expensive since it's basically an attempt to crack the server's own password database. You can't compete with the bad guys' bespoke hardware on operations like this. ↩︎

  5. There is a special InfoSec hell for anyone who designed a password field for no more than 16 characters. NIST says to allow at least 64 characters. ↩︎

History
Why does this post require moderator attention?
You might want to add some details to your flag.

0 comment threads

+5
−0

The assumption of 1k attempts/s is wishful thinking, as is the idea that a hacker will go on mail.google.com and try to guess your login (they would get a captcha after like 5 failed attempts).

Password security comes into play when someone steals the whole table of all accounts and password hashes from the website operator, and then they start trying to hash different putative passwords to see if any of them match. This is very similar in principle to cryptocurrency mining, so it's probably fair to say that about $1000 can get you hardware that can do about 1 billion password hashes/s.

When the website discovers their hashes are stolen and offered for sale on black market, the reasonable thing to do is invalidate all current passwords so that all users will be forced to reset password (using phone, email...) at next login. This will make the hashes useless. However, it will take some time for them to find out, so if you have a very easy password the cracker could find it very quickly, use it and do some harm. If your password takes at least a few weeks, there's a good chance that by the time the cracker solves it, it will not be valid. I think this is the main reason why they require strong passwords.

By strong here I am thinking of 16 random chars A-Za-z0-9. This is about 95 bits, and even if you had a year you would need to try 10^15/s which is not feasible with today's tech. If/when better techs comes out the website admins would switch to a harder hash type, which would still take long even on the newer hardware.

companies force us to memorize ridiculously hard to remember passwords

They assume you will use a password manager, rather than memorizing it.

I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever

A Gmail account is probably very valuable, because it can be used to send a lot of spam that will be treated as legitimate because it's coming from Gmail, and also people usually have Gmail set up for password recovery in other accounts so you can gain access to those from the Gmail. However, Google uses MFA, so just knowing the password won't be enough to gain access to it.

History
Why does this post require moderator attention?
You might want to add some details to your flag.

1 comment thread

Rainbow tables become useless if every password is hashed with its own random hash. (3 comments)
+4
−0

Disclaimer: I am not a security expert nor a security professional.

There is, of course, a relevant XKCD comic for this:

XKCD comic about how short passwords with special symbols and numbers are less secure and harder to remember than long passwords with only alphabetic characters

The entropy numbers appear to be accurate based on this security.stackexchange post. It actually assumes a dictionary attack, which involves checking for common words in passwords and is sometimes used to discredit the "correcthorsebatterystaple" method of password generation. However, when password checkers are looking at password strength, they usually are comparing passwords of equal lengths. An 8 character password with only alphabetic characters will be weaker than an 8 character password with digits, special symbols, and alphabetic characters. If you assume that people will use the shortest password they can get away with, then forcing them to include more variety makes sense. It also allows the site to use less database storage space while forcing better passwords than just 8 alphabetic characters.

In my personal experience, security professionals assume people will use some kind of password storage program. They don't seem to consider the difficulty of remembering the sheer number of passwords required for various necessary accounts. None of the various security seminars I have participated in for work offered any solutions. Password requirements are based on site security for that site alone; they don't take into account how users are supposed to handle 50 sites with difficult to remember passwords.

To answer your question about attacks per second: attackers aren't necessarily trying to attack over the internet. They will use copies of databases full of hashed passwords and run hundreds of attacks per second on them. Once they have a plaintext password, they can try that on other sites such as banks (people reuse passwords enough for this to be worth it). So the password strength really can matter, especially if you reuse passwords.

History
Why does this post require moderator attention?
You might want to add some details to your flag.

1 comment thread

Password managers are a consequence, not a reason (1 comment)
+3
−0

NIST Special Publication 800-63 says that "strong" password requirements are not only useless but counterproductive. They recommend only a minimum length requirement and a small blacklist of common passwords.

Length and complexity requirements beyond those recommended here significantly increase the difficulty of memorized secrets and increase user frustration. As a result, users often work around these restrictions in a way that is counterproductive. Furthermore, other mitigations such as blocklists, secure hashed storage, and rate limiting are more effective at preventing modern brute-force attacks. Therefore, no additional complexity requirements are imposed.

This has been NIST's recommendation for at least the several years that I've been paying attention. It's painful to watch naive companies hiring naive developers pushing outdated practices like "strong" passwords and even "security questions" (encountered yesterday on an Arizona government site!)

History
Why does this post require moderator attention?
You might want to add some details to your flag.

1 comment thread

Only since 2017 (3 comments)
+0
−1

For as long as I can remember, this has been the guideline from NIST. It hurts to see how ignorant businesses employ ignorant programmers who advocate for antiquated security measures like "strong" passwords and "security questions" and doodle jump (I saw this on a government website in Arizona yesterday!).

History
Why does this post require moderator attention?
You might want to add some details to your flag.

1 comment thread

What is "this"? (1 comment)

Sign up to answer this question »