Technology

58303 readers

23 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

[email protected]

547

NIST proposes barring some of the most nonsensical password rules (arstechnica.com)

submitted 3 weeks ago by [email protected] to c/[email protected]

152 comments fedilink hide all child comments

Here is the text of the NIST sp800-63b Digital Identity Guidelines.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 1 points 3 weeks ago* (last edited 3 weeks ago) (1 children)

I think it's pretty idiotic to

Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.

They might mean well, but the reason we require a special character and number is to ensure the amount of possible characters are increased.

If a website doesn't enforce it, people are just going to do a password like password

password is a totally valid password under this rule. Any 8 letter word is valid. hopsital for example.

These passwords can be cracked in ~~seconds~~ under 10 minutes, and have their hashes checked for in leaks in no time if the salt is also exposed in the hack.

Edit: Below

Numbers from a calculator with 8 characters using sha2 (ignoring that crackers will try obvious fill ins like 0 for o and words before random characters, this is just for example)

hospital 5m 23s

Hospital 10m 47s

Hospita! 39m 12s

Moving beyond 8

Hospita!r - 19h 49m

Hospita!ro 3w 4d

Hospita!roo 2y 1m

Hospita!room 66 years

The suggestion of multiple random words makes not needing the characters but you have to enforce a longer limit then, not 8.

At least with 11 characters with upper case and special characters if it was all random you get about 2 years after a breach to do something instead of mere weeks. If it was 11 characters all lower case nothing special you'd only get 2 months and we are rarely notified that fast.

[–] [email protected] 3 points 3 weeks ago (1 children)

They might mean well, but the reason we require a special character and number is to ensure the amount of possible characters are increased.

The problem with this sort of requirement is that most people will solve it the laziest way. In this case, "ah, I can't use «hospital»? Mkay, «Hospital1» it is! Yay it's accepted!". And then there's zero additional entropy - because the first char still has 26 states, and the additional char has one state.

Someone could of course "solve" this by inserting even further rules, like "you must have at least one number and one capital letter inside the password", but then you get users annotating the password in a .txt file because it's too hard to remember where they capitalised it or did their 1337.

Instead just skip all those silly rules. If offline attacks are such a concern, increase the min pass length. Using both lengths provided by the guidelines:

8 chars, mixing:minuscules, capitals, digits, and any 20 special chars of your choice, for a total of 82 states per char. 82⁸ = 2*10¹⁵ states per password.
15 chars, using only minuscules, for a total of 26 states per char. Number of states: 26¹⁵ = 1.7*10²¹ states per password.

[–] [email protected] 1 points 3 weeks ago* (last edited 3 weeks ago) (1 children)

But they mess that up with their 8 char rule

Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length.

I'd they'd just said shall require 15 but not require special chars then that's okay, but they didn't.

Then you end up with the typical shitty manager who sees this, and says they recommend 8 and no special chars, and that's what it becomes.

[–] [email protected] 1 points 3 weeks ago (1 children)

I don't think that the entity should be blamed for the shitty manager. Specially given that the document has a full section (appendix A.2) talking about pass length.

[–] [email protected] 2 points 3 weeks ago* (last edited 3 weeks ago) (1 children)

The entity knows people will follow what they say for minimums. There's already someone in the comment section saying they're now fighting what these lax rules allow.

Edit: stupid product managers will jump at anything that makes it easier for their users and dropping it to 8, no special characters, and no resets is the new thing now.

[–] [email protected] 1 points 3 weeks ago

What you're proposing is effectively the same as "they should publish inaccurate guidelines that do not actually represent their informed views on the matter, misleading everybody, to pretend that they can prevent the stupid from being stupid." It defeats the very reason why guidelines exist - to guide you towards the optimal approach in a given situation.

And sometimes the optimal approach is not a bigger min length. Convenience and possible vectors of attack play a huge role; if

due to some input specificity, typing out the password is cumbersome, and
there's no reasonable way to set up a password manager in that device, and
your blocklist of compromised passwords is fairly solid, and
you're reasonably sure that offline attacks won't work against you, then

min 8 chars is probably better. Even if that shitty manager, too dumb to understand that he shouldn't contradict the "SHOULD [NOT]" points without a good reason to do so, screws it up. (He's likely also violating the "SHALL [NOT]" points, since he used the printed copy of the guidelines as toilet paper.)