When passwords attack: the problem with aggressive password policies | Hacker News Reader

When passwords attack: the problem with aggressive password policies

arstechnica.com

45 pointsshawndumas25 comments

Good article, though the whole premise of people being forced to manage passwords is screwed. We are working hard at Mepin - www.mepin.com - to get rid of passwords one by one. Our premise is that people are much more capable of managing a key - a physical key like a phone or a USB key. Care to agree?

Yes, people are good at managing physical things. The issue I'm guessing you'll run up against is the implementation. You have to convince every developer to adopt a new mechanism for authentication. I don't think passwords will be displaced very soon; they are just too easy to implement.

We currently support OpenID, so any site/service supporting OpenID works with the Mepin keys. Sadly there are a lot of shaky OpenID implementations out there, so yes the implementation is a challenge. And I do also agree that we will never get rid of all the passwords.

Not necessarily. All you need is browser extensions that mimic the built-in remember password functionality, and a hardware-encrypted USB key that serves as a data store for the browser extensions.

That does reduce the USB key to a single point of failure though. That risk could be mitigated with a proprietary key copier.

A standard way to generate key pairs for authentication would be a lot better though. (Really, there's no reason we couldn't use SSH private keys with some simple client and server plugins.)

Any physical key that is easily copied is too easily compromised to be a serious alternative to passwords. Just think of the last time you left your phone on a desk or something while going to the bathroom.

Our USB key cannot be easily, if at all, copied. It's based on smartcard technology used by banks and governments around the world. It's not a memory stick.

Our USB key cannot be easily, if at all, copied. It's based on smartcard technology used by banks and governments around the world.

There's an implied 'because' between these two sentences, which I think is problematic, since the first sentence does not necessarily follow from the second.

I couldn't care less about the second part, but the first is a great idea. When I visit the website in your profile, though, I don't see any mention of hardware, just software.

Is there more information available somewhere?

You are right. The sentences were hastily written.

The hardware key is in private beta and will be publicly available soon. We have evaluated half a dozen smartcard technology vendors and are partnering with a couple of them, so we can deliver a key with or without FIPS certification depending on your cost consciousness and security requirements. Please e-mail me for additional info.

USB keys aka dedicated devices are dead. Noone wants to carry around yet another gadget. Reuse a phone instead. Much more pervasive.

We all carry keys. I use a key to get into my house, my car, my business. Keys aren't dead. A memory stick is certainly not secure, but one with the right smart card is relatively secure.

I'm not saying the device can't be secure. It' the inconvenience due to the physical impact and the fact that eventually you have to carry around a whole key chain.

I agree with you and I made it so the iPhone you carry around everyday can be your password manager.

I'm honestly not trying to spam HN with links to my product but since it's on topic I'll just mention that I developed an iPhone app called KEYBOX ( http://www.jayfuerstenberg.com/keybox/ ). It securely manages passwords and other secrets without dongles or other devices.

USB keys are a good idea from a convenience perspective but what makes it convenient for you makes it equally so for a hacker (the nefarious kind) to break into whatever system you're trying to make secure.

I'm obviously biased as I created KEYBOX, an iPhone app for easily managing passwords, amongst a whole host of other secrets.

So take my below answer with a grain of salt...

I'm surprised by all the attempts to replace the password with non-secret keys be they facial recognition (face prints?), fingerprints, or other...

I can login to your facial recognition screen just by holding up your photo. Fingerprints are little more difficult but the technology exists.

But if I am not in possession of your password I'm going to be spending a lifetime cracking it.

Conclusion: Keys are not secrets and can be easily copied. Passwords ARE secrets.

Yes, passwords can be difficult to remember but that's a different problem.

If you want to see secret/password management done right check my website ( http://www.jayfuerstenberg.com )

Umm ... your conclusion is kind of funny and wrong. You might not be familiar with cryptography, modern smartcard technologies, and how those can actually keep a secret.

I agree with your assessment on facial recognition and fingerprints, though the biggest problems with the fingerprint authentication are the lack of ubiquitous sensors and privacy issues.

But password manager software is better than nothing ;)

I'm quite familiar with cryptography and the principles of secret keeping. I am not as knowledgable about smartcards I admit.

Is there something that makes a smartcard based USB key work differently when held by a person other than its rightful owner?

My impression of them, perhaps incorrect, is that they are akin to Hanko ( http://en.wikipedia.org/wiki/Hanko_(stamp)#Japanese_usage ). Basically a system of using possession combined with a fairly unique set of data as a means of distinguishing and authenticating its owner. But in practice its far less than perfect.

Good smartcard in general cannot be copied and it will not work without the user's pin code. It can also lock itself if the pin code is entered wrong too many times. But most importantly, the keys/certificates inside the smartcard can be revoked remotely if the smartcard is lost. So even if the wrongful holder of the key has somehow got hold of the pin code, he cannot use the key for long.

Nothing is perfect of course. The risk/threat is very similar to someone stealing your phone and has somehow gotten to know your master password to your password management software. However, password management does not really solve neither the usability or the security problems of usernames and passwords ... although a good piece of software can certainly help.

Thanks for the thorough reply! It sounds promising.

I hope you give a couple of prototypes to Richard Clark for testing.

(http://www.cl.cam.ac.uk/~rnc1/)

(http://www.lightbluetouchpaper.org/)

Richard CLAYTON, not clark.

Where I work we have a plethora of username/passwords for everything from benefits to paystub management to expense reporting, not to mention desktop logins. I gave up long ago trying to remember/write down them all, save for my desktop. I just initiate a password reset whenever I use them. Unfortunately, a lot of these services are outsourced so I could see the complication in setting up some kind of single sign in.

What are the risks of a password attack?

  * Someone can watch you type in the password
  * Someone can receive/sniff/keylog you typing in the password
  * Someone can find the password database and crack it
  * You might tell the wrong person the password
  * If you wrote the password down, someone might find it
  * More i'm not thinking of (probably)

There is some kind of attack that will work to get your password, I guarantee it. So stop obsessing over it. Just make one difficult password, keep it for a long time (as suggested in the article) and make use of a second authentication factor.

Use a keyfob from PayPal or Verisign combined with OpenID ($5-$40; there are other cheap keyfobs out there too). Soft keyfobs are free and (while not impenetrable) present a new mandatory additional attack vector that increases complexity. It's less secure, but you can also use an SMS-based system for another free and cross-platform alternative.

Phishing is the biggest risk/threat. An average user is typing in his username and password if presented with a decently familiar login form no matter what the browser address bar or the rest of the web page says. Unfortunately the PayPal and Verisign keyfob security codes can also be phished.

This is regrettably very true.

Yes, but most authentication mechanisms I know of don't deal with phishing. There's probably some challenge-response authentication system you could use, like... a browser plug-in that talks to the keyfob smart card and does a couple challenges to verify the server is for real... but i'm talking out my ass because i'm not a crypto guy. Anyway, dual auth is still much better than just a password, assuming your user understands what phishing is or how to spot it.

I'm really happy with Google Authenticator at the moment. Like SMS this falls into the "soft keyfob" category, so it's less secure than a dedicated keyfob, but it wins in convenience not having to lug around a separate keyfob for every service...

Reply on news.ycombinator.com