Guy who thinks passwords are outdated, setting a new password for his bank app: Hmm, how about Christmas123!, just like all my other logins so I don't have to worry about forgetting it!
this post was submitted on 04 Dec 2023
100 points (100.0% liked)
the_dunk_tank
15859 readers
27 users here now
It's the dunk tank.
This is where you come to post big-brained hot takes by chuds, libs, or even fellow leftists, and tear them to itty-bitty pieces with precision dunkstrikes.
Rule 1: All posts must include links to the subject matter, and no identifying information should be redacted.
Rule 2: If your source is a reactionary website, please use archive.is instead of linking directly.
Rule 3: No sectarianism.
Rule 4: TERF/SWERFs Not Welcome
Rule 5: No ableism of any kind (that includes stuff like libt*rd)
Rule 6: Do not post fellow hexbears.
Rule 7: Do not individually target other instances' admins or moderators.
Rule 8: The subject of a post cannot be low hanging fruit, that is comments/posts made by a private person that have low amount of upvotes/likes/views. Comments/Posts made on other instances that are accessible from hexbear are an exception to this. Posts that do not meet this requirement can be posted to [email protected]
Rule 9: if you post ironic rage bait im going to make a personal visit to your house to make sure you never make this mistake again
founded 4 years ago
MODERATORS
just like how every one of my work passwords that i never set but just came with the IT gear i use is "season two digit number"
A fundamental problem with passwords is that you either have a "secure" selection of large, distinct, constantly rotating codes that you have to keep track of on paper/in an app (insecure!) or a single memorable code that - once it is cracked - exposes all affiliated systems (insecure!)
There's a serious argument to the effect that a physical id tied to a digitally managed rotating set of large arcane codes is at least as secure as the paper/app-based list of hard codes. The big problem with this technology is that it requires a more complex hardware interface with more attendant IT support. So you're talking about $$$ that people don't want to spend for additional technical security.
Two-factor authentication is cheaper and easier than biometrics. So we've settled on that instead.
Every 'passwordless' solution to passwords always ends up being the informational equivalent of 'passwords, but the method is changed'. Biometrics are just a once-in-a-lifetime password that's entered differently, password managers are just all your passwords, but behind one big password.
Even 2FA is just "password you know" and "password your device knows".
Not saying these solutions don't have value, but to say passwords are outdated is a bit silly.
load more comments
(2 replies)
fingerprints, face scanning... my OnePlus just keeps asking for pics of my asshole before I can unlock it. Is this just a China thing?
As a fellow OnePlus haver, I have LineageOS (which is privacy-focused) installed and am not asked for pics of my asshole
I also use lineageos but still send them pictures of my asshole since I don't want them to feel left out
I tip my landlord in butthole pics (he does not like them)
It's like a thumbprint, but more secure because you don't typically rub it on every surface. 
you don't typically rub it on every surface
I don't think you're using your asshole right
Please drink the Diet Mountain Dew Verification Can.
"The way forward" and not "more secure" because cops usually don't need a warrant to use your own biometrics to unlock your phone
I simply use the fingerprint scanner with my balls. They'd never think to check there.
CW: pretty gross even by my standards
I use my butthole and make sure to get a new hemorrhoid every 120 days to reduce my vulnerability to butthole database leaks
If they do think to check there, I'd see that as a net win.
Passwords are outdated in the sense that the current best practice is to use a password manager that automatically generates a unique high entropy password (read: completely garbled mess no human would ever remember) for every website or service you use. Most of the replacement for them, however, are less secure garbage that can easily be obtained either through social engineering or by the authorities, so you know.
Even then, you're better off with a passphrase as they are longer, easier to remember, and are harder to brute force. It's like a dictionary resistant password.
depending on what you mean by passphrase, "dictionary resistant" is kind of the opposite of how I'd describe them. Sure they'll be long and unique but an english language dictionary will surely make bruteforcing them a lot easier
multiple language passphrase and proper nouns 
that's why you use pig latin
I'll stick with 1337 5P33K
that's very common, widely understood and easy to replicate, i.e., not that great
make up your own 1337 5p33k with 3 characters changed
I simply become the zodiac and convert my pass phrase to a cipher
load more comments
(1 replies)
From what I understand it doesn't help at all. I'm not a crypto (cool crypto, not fake banking) guy but from what I know passphrases generate much entropy. That said, I stick with passwords that are easier to enter, but still pretty high entropy
load more comments
(1 replies)
A randomly-generated password can be a lot shorter than an equivalent-strength passphrase, actually:
If you have a dictionary with 25,000 words in it, and you randomly select 5 of them, your passphrase will have a strength of about 73 bits of entropy, which is decent (but actually less than the NIST recommendation of 80 bits, as it happens; to get there, you'd need 6 words).
A similar-strength randomly-generated password consisting of letters (upper- and lower-case), numbers, and a selection of 10 possible symbol characters (so, a total spread of 26 + 26 + 10 + 10 = 72 possible characters) would only need to be 12 characters long (and would have a strength of about 74 bits of entropy--13 characters would top 80 bits).
The passphrase would take over 300 years to brute-force at 1 trillion guesses per second, but the extra bit of entropy in the 12-character password means it would take 600 years to guess that one at the same rate.
I use randomly generated passphrases that do use symbols and integers. It's easier to type if I'm copying it from my manager manually. I really dislike the focus some services have on maximum length.
My argument would be that 300 years vs 600 years is meaningless when the human lifespan is so much shorter. At that point, who gives a shit? I'll personally take a passphrase I can easily remember over doubling the already insanely long amount of time it would take to brute force the phrase.
Most people pick bad passwords because it's easier to remember. Why not encourage them to use something that is both easy to remember AND more secure than the original?
The other aspect is the actual hashing algorithm used for storing and validating the input. Using a system that allows for artificially inflating the amount of time required (bcrypt rounds for example) makes it easier to mitigate a brute force attack. If the service is using an algorithm that is ready "broken" then it really doesn't matter what you used as the input.
The goal is not to reach the most secure system, rather to increase overall security by getting as many people to use things that are better than before while balancing usability. There's a reason not everyone uses 2FA, or has physical devices for it.
Well, I used 1 trillion guesses a second here. 10 years ago I'd have used 10 billion. So length does matter. And 300 years drops to 1 year if a dedicated attacker is willing to spend a good bit more on hardware (which, in the era of cryptocurrency, could actually be worth it, even just for a criminal).
And yes, sites should use good hashing algorithms, but we users can't count on them doing so. Plus, even a technically-but-not-practically broken hashing algorithm isn't so broken as to be equivalent to plaintext storage (unless it's unsalted), so it's less about specific algorithm choices and more about overall design security.
Not saying passphrases are useless, but password managers are the better technological path, in my opinion, because they obviate the need to remember more than just one password, and allow to you skip typing in passwords too (in fact, a pw manager is better for passphrase users, because they they can still use memorable phrases but don't have to type them in all the time).
And as it happens, my master password for my pw manager was originally a 6-word passphrase, but has since been changed to a 20-character randomly-generated password, because it's a ton easier to type, particularly on mobile.
Absolutely agree on the usage of a password manager. And yes, as hardware increases in power we run into the issue of timelines being shorter. I disagree on MD5 being not totally broken, considering a collision can be found in seconds on even low end hardware these days. Even salted, a collision would still be viable.
Again, the real problem overall is adoption. Getting people to use better passwords/phrases that are less likely to be brute forced. Everyone should be using non-SMS 2FA, ideally with an authenticator app or physical key. As well, password length should only be limited by a minimum value rather than being in a small range. Services should be using algorithms that are recent, well audited, and have the ability to artificially inflate the time taken to get the result for future-proofing. SSO is also an option, since services without IT departments or people with the ability to handle passwords should offload it to a service that can. SSO as a service provider is very appealing, as you no longer have the responsibility of storing sensitive hashes and account information.
Was not aware of the latest efforts on MD5, in all honesty; I take back what I said before.
I agree with everything you said there 100% except the bit about SSO. SSO is great for people working in managed environments (I wish my workplace would make broader use of it, honestly), but expanding it to everyone as a whole creates some serious issues (putting everyone's eggs in the same basket is a security risk, and worse, having a centralized third party notified of every login request totally undermines user privacy).
load more comments
(1 replies)
The absolute best practice is to add random spaces that don't correspond to syllables. A 10 character password can go from taking a few seconds to crack to several hundred years with a few well placed spaces.
That said, there are databases out there that don't like spaces, and for some reason lots of financial institutions are this way.
I just hate fucking sites that tell me it has to be under 16 characters. Like wtf
Fucking ridiculous in 2023. If I want to have a 300 character password, that's my business, hate these arbitrary rules of a max number, no special characters...
That’s why stuff like webauthn is better; if we’re going to maintain a list of garbled text, let’s make it secure one-way encrypted keys instead, which are way stronger.
You’re still only as secure as your password manager, but no one’s gonna decrypt your private key from a stolen database of public keys unless some really monumental exploit is discovered - and if that happens we’ve got MUCH bigger problems.
I was talking to a schoolteacher the other day who was getting re-fingerprinted for the Nth time. Their last fingerprinting was two years ago. Same job, same county, etc. Everyone was justifying it because of "privacy." But, like, it's all going to the same database, where the same people have access. Are they destroying the records every two years (
), or did the authorities just forget their own passwords?
If you get into the reaaaaaaaaaaaal nitty gritty of security regarding biometric factors shit turns real weird eventually. Like "How do we know that fingerprint is still attached to a living person?" type stuff.
I'd be sure as hell this isn't what happened here, just sort of a fun fact. Also why I think thinking biometric factors as safe is fucking insane, exactly because they're fairly immuteable. You get one data leak on your fingerprint-security-database and now you can never use that shit again if you're taking it seriously. And if you don't expect nation-state-level actors as a threat vector, why the fuck are you taking fingerprints?
It's mostly just technologically illiterate people falling for it imo
Mmm.
I should go print a silicon printer that can make fake fingers based on, idk, someone's fabvorite ice cream flavor or something. Really hasten the slide in to the security abyss.
Either way, I still use passwords for everything, and every password is unique. Biometrics my right tit they don't even have t beat that out of you, then can just cut something off. At least with the password manager it has to either have a vulnerability or they need access to state-level legal muscle to force the people who designed it to open the lock. Plus if one password gets compromized nothing else is unless it's the master, and even with the master they still need access to the password locker to do anything with it.
I should go print a silicon printer that can make fake fingers based on, idk, someone's fabvorite ice cream flavor or something. Really hasten the slide in to the security abyss.
Pretty much everytime you look into this type of stuff "good print of fingerprint" does the job just fine, you don't even have to get that fancy with it.
Biometric security is better understood as a convenience product.
load more comments
(3 replies)
I’ve asked the county clerk this once when I had to get my fingerprints done just because I was working in a different building 3 blocks away, but basically every time you renew certain trainings or certificates it’s required regardless of how many times you’ve done it before
I did some googling and this was the best explanation I could find. (Most everything else was just "because that's the requirement.")
Maybe I'm too paranoid but I still think the feds would figure out how to fuck with me, if they wanted to, based on the prints I had taken for a job I held >10 years ago.
That would require the labyrinthine hostile intermingling of state and federal bureaucracies to work together, so you’re probably fine 
I feel like this is a very Chief Wiggum moment in the sense that it wouldn't help to prove you got your bike stolen but it would help to pinpoint you at the scene of some crime
Yes I love getting an email every single time I log in to a website. Great UX, nothing obnoxious about it.
Me just sitting here installing a pin tumbler lock on my computer that I need to turn every time I want to log in to a website
There's plenty of valid "password less" auth that would be great to have. SQRL by GRC is pretty much perfect, just needs adoption. Physical tokens and such are also very secure.
Passwords are fine with two factor authentication right? Like I have two factor authentication on my phone for pretty much everything either through text or a full on authenticator app.
load more comments
(4 replies)
My password is 
Why is this in dunk tank?
Im really hoping it wound up here as to allude to Okta's massive securty breach that happened last week.
Is it bad I couldn't tell if this was going to be that breach, which probably wouldn't have been disclosured if one of their customers hadn't reported it, or a new one?
view more: next ›