Tag Info

New answers tagged

1

That sounds normal for a vm. You don't typically worry unless available entropy drops below that 100-200 average. The key measure is the sequences that come out of that entropy. You should use the ent program to test your random sequences. You worry when you start seeing tests fail here. This site has a good process for testing randomness. We can ...


0

There is the hardware based RDRAND instruction on IvyBridge Intel processors. If that is availabe (ie chip has instuction and does not have the RDRAND hardware bug cover-up) then I think Linux does automatically use it. Meaning you should get very large amounts of true random numbers very fast.


9

Entropy is required in the following sense: if a PRNG has only n bits of entropy, then this means that it has (conceptually) only 2n possible internal states, and thus could be broken through brutal enumeration of these 2n states, provided that n is low enough for such a brute force attack to be feasible. Then things become complex, because the "entropy ...


0

Ok passwords suck. I actually have found more evidence of early password failure than well designed password systems when looking at passwords as an access control method prior to computers. There is unfortunately three methods I have seen to "address" the problem. cost risk analysis: Decide that the risk is small and the cost is large so do nothing ...


1

Although there are no guarantees, there are mathematical safety-measures against poor keys due to inappropriate random number generators. You could for example try some nice software tools to test the statistical entropy that your generator puts out: Dieharder TestU01 These tools come with a large number of statistical tests, but as RFC 4086 states: ...


0

When selecting the password for the user, you know the entropy, as opposed to placing some restrictions that may prevent them from using a low entropy scheme In order to have the best of both worlds, you could also compute the entropy (or whatever mechanism you deem appropriate) while they type their chosen password. This is the mechanism used on ...


9

One respondent touched on the right answer, but didn't expand on it enough, so I will. You are asking the question from a computer- or IT-centric perspective. But why does that IT exist? To serve the customer. Let me repeat this: The customer is not there to serve you, you are there to do what they need you to do. So with that in mind, let's revisit the ...


3

I don't pick my own passwords. I use a password manager that generates random passwords for me. However, most web sites are based on the idea that users will memorise their passwords. It's much easier for a user to memorize a password they picked themselves, rather than one assigned to them. In practice as well, users typically use the same password on ...


15

Organisations want users to be responsible. If the user chose the password, they can be blamed for choosing a bad one. Unfortunately, in the real world, organisations may have to be more concerned about seeming to take some of the responsibility for intrusions than about insuring they can't happen. Users want to choose something they can remember Many ...


2

In many situations, the user is expected to be their own security watchdog because the user of the system is not the threat to the system. The threats to the system are administrators and employee-grade operators that by virtue of position have elevated exposure and permissions/rights within the system. Without a seriously flawed system already, James ...


1

Other people have mentioned it before- but I feel that a user is expected to have control over the security of their account. That being said, I do agree that many passwords aren't very strong and should certainly should be checked by a client-side (so we're not sending raw passwords through the network) checker for complexity, and if the password doesn't ...


5

Think about it this way, if you choose the user's password for them, they will forget it, and have to use password reset systems. The 'forgot my password' is usually less secure than the password, so making the password more secure, but causing more password resets makes the entire system less secure as it would be harder to detect fraudulent 'forgot my ...


60

Why, indeed? Allow me to ignore that question for a moment, and answer your implied question: Should we? That is, should we continue to have users create their own password, which is often weak, instead of just having the system generate a strong password for them? Well, I am of the controversial opinion that there is a pretty strong trade-off here - ...


29

Getting the password to the user The only times I have seen systems that set the password for the user, it is send to the user via email (obviously in plaintext), which is obviously a bad idea[*] (and SMS, Mail, etc are not that much better). So that would leave displaying the password when creating the account (which might also be a bad idea because of ...


1

Say you use Diceware you can generate a memorable, secure passphrase. For the technically inclined, each word in your Diceware passphrase yields 12.9 bits of entropy, the way passphrase security is measured. If you want a passphrase to be uncrackable, ever, using today's technology (and the technology of the foreseeable future), you need 128 bits of ...


0

I gave this answer to another question, but I think it addresses your question as well (in a roundabout way). What is "password strength"? In most people's minds, it's the difficulty factor malicious actors would have when they are trying to guess your password. Password strength meters generally answer a slightly different question: how many iterations ...



Top 50 recent answers are included