<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-9">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<blockquote class="quotableTextTraining" style="border-left: 3px solid rgb(200, 200, 200); border-top-color: rgb(200, 200, 200); border-right-color: rgb(200, 200, 200); border-bottom-color: rgb(200, 200, 200); padding-left: 1ex; margin-left: 0.8ex; color: rgb(102, 102, 102);">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>Gönderen:</b> cryptography-request@metzdowd.com <cryptography-request@metzdowd.com> adına cryptography <cryptography-bounces+bizbucaliyiz=hotmail.com@metzdowd.com><br>
<b>Gönderildi:</b> 20 Kasım 2020 Cuma 20:00<br>
<b>Kime:</b> cryptography@metzdowd.com <cryptography@metzdowd.com><br>
<b>Konu:</b> cryptography Digest, Vol 91, Issue 19</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText"><br>
Message: 2<br>
Date: Thu, 19 Nov 2020 11:56:04 -0800<br>
From: Kent Borg <kentborg@borg.org><br>
To: Phillip Hallam-Baker <phill@hallambaker.com><br>
Cc: Arnold Reinhold <agr@me.com>, iang <iang@iang.org>, Cryptography<br>
List <cryptography@metzdowd.com>, Peter Gutmann<br>
<pgut001@cs.auckland.ac.nz><br>
Subject: Re: [Cryptography] Possible reason why password usage rules<br>
are such a mess<br>
Message-ID: <25fcca8f-90b8-2afe-d343-b3419ae61279@borg.org><br>
Content-Type: text/plain; charset="utf-8"; Format="flowed"<br>
<br>
On 11/19/20 2:46 AM, Phillip Hallam-Baker wrote:<br>
> Sure, nobody leaves the front door open on the password file any more. <br>
> But breaches occur regularly and the password files leak...<br>
<br>
You are optimizing for a very specific case:<br>
<br>
(1) A site uses password hashes,<br>
(2) for passwords that are allowed to be long,<br>
(3) and are honored in their entire length*,<br>
(4) is broken into and they don't tell me,<br>
(5) the breakin doesn't include general admin powers but just supplies <br>
that one file,<br>
(6) the attacker bothers to crack the hash for my password, and<br>
(7) it does any good for the attacker to have that password.<br>
<br>
* Even Linux is willing to let you use long passwords where anything <br>
past 8-characters are quietly ignored?if you set things up wrong. I've <br>
twice discovered this where I didn't set it up that way, a system <br>
installation script did.<br>
<br>
If I don't recycle passwords, getting all the way to #7 lets the <br>
attacker impersonate me only on this one iffy site, which the attacker <br>
already has some backdoor access to. By insisting on unmanageably long <br>
passwords for everything, you do avoid this one narrow circumstance.<br>
<br>
But there are a lot of ways for people to get security wrong, by the <br>
time they let their password data leak you need to assume things are <br>
very broken.<br>
<br>
What makes you think there is any hashing going on at random site?<br>
<br>
I have a large collection of plain-text passwords that have publicly <br>
leaked, where did I get those? That doesn't smell like hashing to me. <br>
Why do so many sites have password length and severe password content <br>
restrictions? That doesn't smell like hashing to me.<br>
<br>
As long as my password even approaches a couple dozen-ish bits of real <br>
entropy, if I haven't given away copies (by recycling), my password is <br>
not going to be the weak link.<br>
<br>
Do you have an ATM card? Well, if someone finds a way into your bank's <br>
computers that isn't via your PIN, then it didn't happen because your <br>
PIN was too short. And if you have to change your PIN as part of the <br>
cleanup, your new one doesn't have to be any longer than was your old <br>
one. The PIN wasn't the problem.<br>
<br>
<br>
By telling people that every password has to be unmanageably long, you <br>
are effectively discouraging people from using difficult passphrases <br>
when it really does matter: for encryption.<br>
<br>
<br>
-kb<br>
</div>
</span></font></div>
</blockquote>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText"><br>
</div>
<div class="PlainText">An addition to that, I believe that we don't need long/unmanageable passwords for having a good account security. Instead we should enforce additionaly security checks like 2FA or e-mail notice upon signing up on a new device/browser/IP
address. </div>
<div class="PlainText"><br>
</div>
<div class="PlainText">I believe the issue is not how websites store the password files (which they should be storing in hashed format) but how that information could be used. If my password is leaked from a website A, the attacker won't be able to do anything
with that information, unless they can sign in to that website or other websites where I might be using the same password. If the applications restrict such suspicious activities, and inform the user, leaks won't be an issue. </div>
<div class="PlainText"><br>
</div>
<div class="PlainText">Passwords were a way to authenticate user actions in the past but now we have different options to ease the process. Just like how you call your bank and they ask various security questions before sharing any information with you about
your account, websites and all apps that require authentication should utilize those secondary authentication methods. Then we won't have any problem in terms of password security.</div>
</span></font></div>
</div>
</body>
</html>