Password rules stupid

[rjh01]

Just worked out something amazing. When creating passwords you are often told that you need to use upper, lower case, special characters and numbers as part of the password. I have just worked out that this does NOT add much security at all. Much better to have a longer password.

Calculations.
Case 1. Use a random combination of all character keys (that is keys like enter do not count) on the keyboard plus the above holding the shift key for upper case. Have a length of 12 characters. This gives a combination of 94^12 = 4.7592E+23 possible passwords.
Case 2. Only use the lower case letters a-z. Have a password of 17 characters. This gives 26^17 = 1.13383E+24 possible passwords.

Just by making the password 5 extra characters longer, you can make the password even more secure. This does assume you are using random letters. Having a password of 123456 is an open invitation to be hacked.

Any thoughts on the issue?

 

[theprestige]

I won't bother digging up the relevant xkcd.

The password rules are a holdover from a simpler time, when people would use obvious values like birthdays or common words, and bad actors would mostly just guess based on simple assumptions about human psychology.

The rules short circuit the psychology and force people to come up with a password that's not easily guess able by another human.

But nowadays the bigger risk is more powerful computers brute force guessing all possible passwords of a given length. So now, longer, simpler passwords are better.

"Correct horse battery staple" is both easier for a human to remember, and harder for a computer to guess, than "*$=?7/!P-w>“

 

[Little 10 Toes]

4.7592E+23 = 4,759,200,000,000,000,000,000,000,000

If I use 100,000 computers, I only need to make 4,759,200,000,000,000,000,000 attempts.

If I am able to make 100,000 attempts per second, I only need 4,759,200,000,000,000 seconds.

4,759,200,000,000,000 seconds = 150,000,000 years rounded down.

By that time, who cares?

If you want security, why stop at a 17 character password? Have a 100 character long password, and a 17 step physical access steps?

Obviously, I'm acting like a jerk. I remember seeing somewhere that you have to consider convenience and accessibility when designing security. For most, 8 characters is fine. Now with 2FA, things are getting more convenient while keeping the security.

Edit: https://xkcd.com/936/

 

[rjh01]

<snip>
"Correct horse battery staple" is both easier for a human to remember, and harder for a computer to guess, than "*$=?7/!P-w>“

That may not be 100% true. Give a computer a 2,000 word dictionary and tell a computer to use it to guess the password it would need a maximum of 2000^4 = 1.6E+13 guesses. Your 11 character password would need 6.38239E+21 guesses.

 

[rjh01]

4.7592E+23 = 4,759,200,000,000,000,000,000,000,000

If I use 100,000 computers, I only need to make 4,759,200,000,000,000,000,000 attempts.

If I am able to make 100,000 attempts per second, I only need 4,759,200,000,000,000 seconds.

4,759,200,000,000,000 seconds = 150,000,000 years rounded down.

By that time, who cares?

If you want security, why stop at a 17 character password? Have a 100 character long password, and a 17 step physical access steps?

Obviously, I'm acting like a jerk. I remember seeing somewhere that you have to consider convenience and accessibility when designing security. For most, 8 characters is fine. Now with 2FA, things are getting more convenient while keeping the security.

Edit: https://xkcd.com/936/

A good computer can do far more than 100,000 attempts per second. Six years ago the figure was 10,000,000 per second. That only used four graphics cards. Now get a good mining computer (think bitcoin) that would be able to do several orders of magnitude more.

See this for what I mean. This video is six years old.


Anyone who does not have a password manager should be scared.

Edit. In the video it took the computer 1 second to guess every 7-character password that had only lower case letters.

 

[Little 10 Toes]

2,000 word limit? Why use 94 characters and 4 words?

The internet says average English word length is either 5 or 6. 20 character password length.

 

[arthwollipot]

Yes, password rules are almost universally acknowledged among those that know a bit about It security to be stupid.

 

[Childlike Empress]

Even the most simple sort of web software accounts for repeatedly entered wrong passwords. Brute force attacks take a long time because of that. Of course using upper case and special characters will be helpful to prevent those attacks.

 

[rjh01]

Even the most simple sort of web software accounts for repeatedly entered wrong passwords. Brute force attacks take a long time because of that. Of course using upper case and special characters will be helpful to prevent those attacks.

The problem arises when a database containing usernames and passwords hashes is stolen. Then the people can have as many guesses as they like and as fast as their hardware will allow. If the rules were sensible and the password hash was complex including using a salt then it would require a huge effort to crack just a few passwords.

 

[Childlike Empress]

The problem arises when a database containing usernames and passwords hashes is stolen. Then the people can have as many guesses as they like and as fast as their hardware will allow. If the rules were sensible and the password hash was complex including using a salt then it would require a huge effort to crack just a few passwords.

Frankly, this is complete nonsense. If you have unlimited access to a password, which isn't the realistic scenario, you can brute force it in a couple of seconds, "salt" or not. But that (hopefully) isn't a realistic scenario.

 

[rjh01]

Frankly, this is complete nonsense. If you have unlimited access to a password, which isn't the realistic scenario, you can brute force it in a couple of seconds, "salt" or not. But that (hopefully) isn't a realistic scenario.

No. Watch the video I linked to above and you will understand.

 

[Childlike Empress]

No. Watch the video I linked to above and you will understand.

Why would I watch a six years old video when you can't tell me why I'm wrong on basic principles in a simple sentence?

 

[rjh01]

Why would I watch a six years old video when you can't tell me why I'm wrong on basic principles in a simple sentence?

For starters I suggest you read this post. It explains why it would take more than a few seconds to work out what a password is given that you know the hash of a password.

And remember it is not up to me to give you a basic education. You should have that already. Your post does not demonstrate your basic education.

4.7592E+23 = 4,759,200,000,000,000,000,000,000,000

If I use 100,000 computers, I only need to make 4,759,200,000,000,000,000,000 attempts.

If I am able to make 100,000 attempts per second, I only need 4,759,200,000,000,000 seconds.

4,759,200,000,000,000 seconds = 150,000,000 years rounded down.

By that time, who cares?

If you want security, why stop at a 17 character password? Have a 100 character long password, and a 17 step physical access steps?

Obviously, I'm acting like a jerk. I remember seeing somewhere that you have to consider convenience and accessibility when designing security. For most, 8 characters is fine. Now with 2FA, things are getting more convenient while keeping the security.

Edit: https://xkcd.com/936/

 

[gnome]

Frankly, this is complete nonsense. If you have unlimited access to a password, which isn't the realistic scenario, you can brute force it in a couple of seconds, "salt" or not. But that (hopefully) isn't a realistic scenario.

Why isn't that realistic? IIRC password files get compromised all the time.

 

[bruto]

That may not be 100% true. Give a computer a 2,000 word dictionary and tell a computer to use it to guess the password it would need a maximum of 2000^4 = 1.6E+13 guesses. Your 11 character password would need 6.38239E+21 guesses.

A dictionary would be fooled, though, if you included a misspelling or a nonsense word, though, I think. I would expect a long passphrase with some easily remembered mistake or family joke would be pretty hard to crack.

 

[JoeMorgue]

Again I'm very much of the idea that there's been sort of an elephant in the room for a very long while now that we passed the "security/convivence" risk/reward point for passwords at some point long ago and the IT industry simply doesn't have a way to address it.

Any password that is laughably easily for homebrew software, to say nothing of the high level stuff, to crack is too long for a user to remember.

 

[SpuriusMaximus]

A dictionary would be fooled, though, if you included a misspelling or a nonsense word, though, I think. I would expect a long passphrase with some easily remembered mistake or family joke would be pretty hard to crack.

Well, yes, but we were talking about XKCD's idea taken verbatim. It is in fact wrong, and it's quite trivial to prove it wrong. It's actually harder for the user, since now you have to correctly type 30 characters (slightly rounded up) blind, but many orders of magnitude easier to crack by a computer. Which is the literal polar opposite of the comic's claim.

Sure, you could include mis-spellings, punctuation, and whatnot, but that's not what the comic said. And frankly at that point you're just back to requiring that the user has a 30 character password that has some spaces in it. And possibly with those other restrictions thrown in too.

 

[SpuriusMaximus]

Again I'm very much of the idea that there's been sort of an elephant in the room for a very long while now that we passed the "security/convivence" risk/reward point for passwords at some point long ago and the IT industry simply doesn't have a way to address it.

Any password that is laughably easily for homebrew software, to say nothing of the high level stuff, to crack is too long for a user to remember.

Well, actually it's not quite that trivial. But the thing is, though,

1. Virtually nobody goes after an individual user's password. Unless you're Biden or Elon Musk, nobody is specifically interested in hacking YOU. It's basically less of a case of someone having a bullet with your name on it, and more like a case of someone having a million bullets addressed "to whomever it may concern."

2. Virtually nobody actually tries to guess individual passwords, and wasn't even back when we didn't get required to have a bajillion character passwords that include a long prime, the name of a powerful demon in demonic runes (and backwards), and the dying bleats of a sacrificial goat. It's more like one of the following:

A. just send phishing emails and/or the new "We're from Microsoft, your computer is virused" phone calls, and hope someone tells theirs, or

B. get them to download and install some keylogger or rootkit or such, or

C. they got a hold of your database and are trying to get a collision with random strings, against any of the thousands or millions of hashed passwords in it.

And in case C you have bigger problems than the passwords. You probably didn't hash the house address and credit card number of those users. More importantly, you probably neither did you encrypt the security questions that let a user ask your support for a new password. Nobody needs to actually brute-force my password when they can call pretending to be Hans and go "yeah, my mom's maiden name is Alhazred. And my primary school was the Scholomance. Now can you give me a new login for this laptop?"

3. Yeah, those security questions... I've even run into places where I can't even enter my own BS, like "what was the true name of the first demon I attempted to summon?" I must select one from a drop-down of like 5 choices, ranging from mom's maiden name to my primary school. If I answer correctly -- and most people will; if nothing else then you don't have it effectively become another password you'll forget -- my brother could impersonate me without any problems. And so could anyone who's done their homework.

 

[theprestige]

That may not be 100% true. Give a computer a 2,000 word dictionary and tell a computer to use it to guess the password it would need a maximum of 2000^4 = 1.6E+13 guesses. Your 11 character password would need 6.38239E+21 guesses.

The actual example password is "correcthorsebatterystaple". I just didn't feel like going back and clearing the spaces. But even "correct horse battery staple" isn't in any dictionary of common words. You're not asking the computer to guess four common words in order. You're asking the computer to guess a single 14-character string.

 

[Hellbound]

A dictionary would be fooled, though, if you included a misspelling or a nonsense word, though, I think. I would expect a long passphrase with some easily remembered mistake or family joke would be pretty hard to crack.

A dictionary attack doesn’t just use a regular dictionary as is. The “dictionary” used will be a file of common passwords or words commonly used in passwords, and the attack software is often programmed to provide substitutions (like 3 for E, @ for a, etc).

The type of attack being discussed here is what’s often called s Rainbow attack. If you can get a list of password hashes, either from compromising an authentication server or wire sniffing, you essentially de-couple cracking attempts from the live password policies on things like number of tries and lock outs. Salting passwords does help to make these harder, but it’s not foolproof.


Sent from my volcanic island lair using carrier pigeon.