Hacker News Reader

Comment by gregmac | Hacker News Reader

> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character.

This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do?

I use a password manager and generate 30-ish character long passwords, and I still occasionally run into sites that tell me it's too long. No big deal, I just generate one at the max length they support, save it, and move on. It literally makes no difference to me, other than I scoff at the ineptitude of the people that built the site and have to click a couple more times to get a new shorter password.

View on HN

  * Your password must be between 7 and 20 characters
  * Your password must contain  
    * At least one number
    * At least one upper-case letter  
    * At least one symbol from this list (!@#$%*)  
  * Your password must be changed every 30 days

Plus this: https://blog.mamota.net/resources/img/wat_2.gif

Heh, our HR system had a following requirement:

- password must be between 7 and 8 characters long

- has to include one number

- has to include one of the following: $#!*, no other special characters are allowed

It was so horrendously bad it's not even funny.

I hope you chose pa$sw0rd.

The NHS online booking system my GP uses has rules like this. Pretty much guaranteed to prevent old people from being able to login.

> password must be between 7 and 8 characters long

How do you enter a fractional character?

ranges in english (and probably other human languages) are usually inclusive on both sides.

If there is a way, UTF-8 probably does it, incorrectly.

The "must be changed every 30 days" always annoys me to no end.

A system I use not only has that requirement (along with a very insane set of requirements like "no patterns like 123 or ABC"), but they also NEVER let you reuse a password.

Which means they have a database of every password I've ever used on a machine somewhere, hashed or otherwise.

So the annoying workaround is to append year+month on the end of each password (which I was basically told to do when first setting up my account). So combined with a "maximum 10 characters" leaves 6 for my actual password...

> So the annoying workaround is to append year+month on the end of each password (which I was basically told to do when first setting up my account). So combined with a "maximum 10 characters" leaves 6 for my actual password...

Or do <password>, <password>1, <password>2, ...

Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords". In particular, the US military won't let you set a password that is similar to the last ten of your passwords. What constitutes "too similar"? It seems that your new password can't have more than a three-character substring from your old passwords.

> Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords".

(╯°□°）╯︵ ┻━┻

I don't know how people who don't use password managers are able to deal with this kind of crap at all.

  ┬─┬ノ(º_ºノ) calm down, take it easy.

they do not deal with it, they reuse passwords increasing the degree if the problem

If a website warns me about this, I immediately remove my account. Because if they can tell how similar my new password is to my old password, it means they store information about my password.

I do use a password manager however, so I don’t really notice.

So how do they know it's similar ? Is there a distance that could be calculated between 2 hashes and tell if they are similar ?

I don't think so... So are your old passwords stored in plain text somewhere so they can compare ?

Scary...

> Is there a distance that could be calculated between 2 hashes and tell if they are similar ?

Yes, maybe: https://en.wikipedia.org/wiki/Locality-preserving_hashing

> So are your old passwords stored in plain text somewhere so they can compare?

You betcha!

Thanks for your answers :)

That is not always feasible. There are also requirements like your passwords should be different in atleast 3 places.

If they're able to detect that, then it's basically guaranteed that they're not hashing their passwords.

And: "Must be four characters different than your last password" (this from a particular state's health insurance system). What does this mean? That four characters from the previous password must not appear in the new one at all, or only not in the same position? (fans of the little game Mastermind suffer deja-vu) What if the previous password contained all of the must have set of alternate symbols, then you've got a direct contradiction.

I can't think of a way to do that without actually storing the plain text password. If it is in fact plain text, the irony is that by enforcing such "strong" password requirements, they've actually made the overall system less secure.

N choose 4 permutations of hashes could do it

Nah, that is only the character position sets to change, you also have to permutate the characters (which would be 2^(4*8) if we consider byte characters)

Or did I misunderstand you?

I was counting the number of hashes to store; im not sure why the size of each character would matter?

But now that Im writing it out, I was clearly wrong anyways

I thinking something along the lines of taking every substring of 4 characters, and then for all permutations of those 4-tuples, plug it back into the string hash and store. Assuming the goal is to not share any 4-substring with the new string

So I think (N-4) + 1 gives you the number of 4-character windows

4! for the number of permutations of that 4-char window

So 4!*(n-3) total hashes

Which I guess is actually the same work you'd have to do anyways if you stored the plaintext; just without storing each variant

You can permutate all possible character positions for combinations of four changed characters, and for _each_ permutation permutate all four characters and then compare the hash, and if the hash is the same you do not accept the password (even though of course you could have false positives with hashes). It is of course much slower than the change of one character which is only 256 iterations if you mutate the underlying bytes and not Unicode characters.

But I would guess they use plain text :-(

Password change dialogs generally have entries for:

    Previous Password:
    New Password:
    Confirm New Password:

They don't need to store the plaintext password, as you're giving the old password plaintext to them in the same dialog. Now, if such rules were against "any of your last 4 passwords" instead of just the last password, then that's much more difficult to do. (Obviously nobody is going to cooperate with a form requiring the person to submit their last 4 passwords as part of the password change dialog.)

Give each user a random salt. Hash each subsection of the password with their salt and store that. No need for plaintext.

How often do you find yourself in a situation where you need to enter a password, but you don't have the password manager on that device?

Algorithms have their downside, sure, but for someone like me who is often working on other computers that aren't mine, managers are a non starter.

You have a phone, don't you? Just look up your passwords on there.

You can even use something like InputStick to auto-type the password into the other computer if you'd rather not do it manually.

Hmm... InputStick, that's a cool little gadget, never heard of that.

Working on computers that aren't yours and remaining secure is quite challenging.

I would recommend you to use any password, but rotate the credentials every time you enter them in one of these.

Consider some portable password manager stored on a usb drive.

Logging into a system that doesn't support your password manager, such as games consoles, shared computers, restricted work machines etc.

Copying over a really long generated password is much harder than an algo you can perform in your head.

Even worse - entering a password into a device without keyboard. Smart TVs, streaming sticks, consoles, etc. Extra fun when every input character is immediately masked.

use KeyPassXC - it supports generating word based or readable passwords and you can set it as the default

Almost never. I do have it synchronized across a few devices, including my phone (which is PIN protected, plus my password manager has its own different PIN, and requires passphrase after a reboot).

For the couple passwords I have to enter on other devices (like Netflix) I often just create them by hand, and choose something easy to type on an on-screen keyboard, and then store it in my password manager. For example: "assdeeeerffghhhjuiop". If the keyboard is sorted alphabetically instead of QWERTY, I'll adapt to that.

I generally only have to type this in once or twice a year so it's not a huge deal.

And what about a decentralized passwords manager. Just enter the platform name, your master key and a PIN and boum ! You got your password back :-)

It's free, fast and secure. Try ANPM:

https://teddybear06.github.io/ANPM/

> I use a password manager and generate 30-ish character long passwords

Do note that you don't need anything more than 22 random mixed-case letters & digits: 26 lower-case letters plus 26 upper-case letters plus ten digits is 62, and 62²² ≈ 2¹²⁸.

Completely agree re. the ineptitude of the developers of sites that try to limit one to less than that.

diceware.com

This says that "alger klm curry blond puck" is easy to remember. I would forget that very quickly.

Yeah, the default word list is pretty terrible. Try one of the ones from the EFF: https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...

ugh, the actual wordlist is a single hyperlinked sentence in the center of a thousand word essay.

Here's a direct link: https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt

There are multiple word lists mentioned in that article, accompanied by an explanation of what types of words they include. Depending on your personal preferences, you might want to use a different list. That's why I linked the blog post and not the word lists directly.

There are alternative lists you can look at.

You need a mental picture/narrative to remember passphrases.

Try to make a (short) story/idea connecting those random words. Stories, something with sense and meaning, are easier to remember. correct horse battery staple is the usual example about this.

It's funny, I just came back to HN and saw your comment. I have absolutely no idea what that password was and I'm sure I would have forgotten the short story. Maybe that story would work for one main password on a password manager, but I don't think it would work for me at least for more than one or two passwords.

Diceware encourages reuse of a single password on multiple sites. It's also much more time consuming than just clicking the "randomly generate password" button and having it spit out a 30 char password. That, and a randomly generated password of, say, 16 chars is much much more secure than a diceware generated password of 4 or 5 words, IIRC. And I'd still need a password manager, because reusing passwords on different sites / accounts is a big no-no.

Diceware is good for encryption passkeys or for master passwords for password managers.

It is awful for actual third-party passwords.

I also find Diceware-style wordlists useful for those "security questions" that are really "backup passwords for use over the phone". Instead of "real" answers to "What's the maiden name of my third grade elementary school teacher?" I try to roll a passphrase, store it in key/value section of the password manager. The Diceware might give "weird" words, but they are all at least pronounceable/describable to a human on the other end of a phone, which still matters in some cases.

I have BANKS and INSURANCE companies require CASE SENSITIVE, alphanumeric only passwords. It's pure insanity.

> I have BANKS and INSURANCE companies require CASE SENSITIVE, alphanumeric only passwords. It's pure insanity.

Of course passwords would be case sensitive, why wouldn't they be?

I meant case INSENSITIVE.

Apparently everyone thinks I'm a fuckin' retard over that of a typo.

Great audience. 10/10, would post again.

Reply on news.ycombinator.com