New answers tagged

2

To answer your questions: Should all web applications implement such a security feature? This is just another good security feature to help the user so if the application can afford (resources not financially) to have this implanted in their system there is no reason not to. Is it desirable that companies store our historical passwords? Since ...


3

The need of creation and capturing acknowledgement of the policies depend upon various factors like present or expected to be done in future compliance audit, logging etc. The policies that any organization should take into consideration will be as below acceptable use policy change management policy critical technology usage policy data retention ...


4

I want to begin my answer by saying I work in IT Audit / Security and this answer derives from my profession. I assume that it's a good idea to supply the users of a system (or employees) with policies and agreements regarding information security. This is not only a good idea but essential to protecting your workplace. The benefits for implementing a ...


1

While @Anders answer is accurate, I want to extend his case for dropping "low entropy" passwords and I couldn't fit it in a comment. Firstly, I wanted to introduce a parallel. Many ciphers (e.g. DES) have weak keys, which make encryption behave suboptimally. This implies that there is no "flat keyspace" (one where all keys have the same "strength"). If ...


5

In general This depends on what information you are asuming that the attacker has. First, let's asume that the attacker is blind, and perhaps trying to crack a large dump of breached accounts, without knowing that you used that specific algorithm. Then you would be better protected if you discarded 123456 if it comes up, or more realistically, passwords ...


2

For systems where 2FA/MFA is "optional" such as Gmail or Outlook.com, the service has to balance the hassle factor of using the 2-factor method and the security it brings to their site. In a perfect world, users would have unique, complex passwords for every site, and always use 2FA when available, but in the real world, you're right - users will have the ...


0

There are two plausible attack scenarios here: Offline cracking Online Cracking In the offline cracking situation the paper still describes that strong cryptographic principles should be applied. This means there is no fuzzy logic. There is only the work required to compute the final hash knowing the salt and guessing at inputs. There is no real ...


5

In theory, yes, this is a possibility (provided the site implementing 2FA doesn't have any rate limiting or fraud detection of any kind, as pointed out by the other answers). In practice, there's the usability factor to think about, too. Imagine you built a login form that prompts a user for 2FA on every login attempt, only telling the user the attempt was ...


12

Full disclosure: I am one of the authors of the paper. An exact password checking system stores a standard salted, slow-to-compute hash of the password. When a password, such as password123, is registered with the authentication service, a random salt "sa" is selected (this should be 16 or more random bytes) and a slow-to-compute hash function H is applied: ...


9

So now the cracker may have access to all the user's accounts across the web, many of which probably don't have MFA implemented, leaving the user completely vulnerable to attacks. An attacker isn't going to try guessing a password on Google that they aren't also going to try for the bank or facebook or the like. Just because it's now been given away ...


116

If I'm understanding your question properly, the attack you are proposing is to brute-force passwords against a server like this, then once it shows you the MFA screen, go try that password on other websites that this user has accounts on. This is a great question! Good find! But you seem to be overlooking two points: This is no weaker than not having MFA,...


11

I think this is a non-issue. Multi-factor authentication isn't about preventing someone to guess your password, but to prevent anyone to sign in on your accounts.


1

In the big picture it may actually be more secure. When we computer people talk about security we talk about bit of entropy, hash algorithms, brute force attempts and the like. It's easy to forget one simple, unavoidable rule. People are stupid! All of that goes out the window when a user writes down their password, pin number, and security question/...


0

There are many password "managers" that works in that way. For example Masterpassword app is really close to your idea. The algorithm is open source so I disagree with @RonWayn. As long as you cannot reverse the algorithm and find the master password with a given used password this should be secure enough.


0

It's only as secure as the master password. Everything else relies on the the assumption, that the algorithm is not disclosed to an attacker aka security through obscurity. Oh, and you just disclosed your algorithm to the internet.


-1

According to the paper, there is zero security impact in the case of offline brute-force attacks. This is because there is no change to the database containing hashed passwords. Online checking of typos uses "exact checking," i.e., matching against a stored hash, as a subroutine.


1

Edit: This answer is not correct, see the top voted answer. In the appendix they referred to "secure sketches" but upon reading the paper closer I see that they do not recommend that method: In theory a secure sketch [17] could be used to correct some typos in the server side. However, the proven bounds for existing constructions are too weak to ...


1

it is not secure enough from global point of view. Think to have system trying to log to 100000 accounts, using one password number. Why many banks rely on it, is above my undertstanding. Even viewing your account (without ability to withdraw any money) can actually make harm (address, ballance,...). Another problem is that even locking your account can be ...


0

Yes its fine, but only if its part of multi-factor authentication* and includes a system of side-channel verification on user actions**. All less secure solutions are in my opinion not adequate in a modern internet bank and does not address infected computers, MIBs etc. *For example that you have to vouch for the computer you are using, through your ...


3

It seems like weak security, but in reality a brute force hack is not feasible for online banking. Banks use very robust fraud detection systems, and very rigorous monitoring. Account lockout typically requires a phone call to re-activate, unlike many other online systems which simply use a time-based lockout. They will also almost certainly be using anti-...


2

If as you pointed in notes: Someone entering my account is still not able to make a payment before it goes through another security mechanism (which we will assume to be good). Then it is likely that the only thing the 6-digit password protects is the account balance and history. For comparison: my Japanese bank sends me my account history printed, in ...


8

Contrary Opinion: Beware It is highly likely that you as the user have not been made aware of other security measures put in place by your bank in front of your PIN. I know that as for CapitalOne360, which has a similar 4 - 6 digit pin system, I was shocked! But after a while of using the PIN on the same computer, I finally needed to login on an alternate ...


6

Is a 6 digit numerical password secure enough for online banking? No, it is not, not just because of ability of a malicious user to break such an authentication mechanism, but because it violates PCI-DSS compliance standards and the FFIEC guidance on authentication. In addition, multi-factor authentication has been required by FFIEC guidance since 2006. I'...


59

Unusual? Yes. Crazy? No. Read on to understand why... I expect your bank has a strong lockout policy, for example, three incorrect login attempts locks the account for 24 hours. If that is the case, a 6-digit PIN is not as vulnerable as you might think. An attacker that tried three PINs every day for a whole year, would still only have about a 0.1% chance ...


5

I'm going to take a contrarian stance, and say yes, it's secure enough, for a bank. Banks usually have lots of money to recover from breaches Banks usually have lots of influence with the government, and can avoid class-action lawsuits (I'm from Canada, and we have only a few, large banks) Banks have lots of customers, and fewer support calls = more money ...


4

Compared to common practices in the sector, your conditions are not that unusual. My bank has similar policies, with two notable differences: the username is NOT my card number. I have received it by mail in a protected envelope, similar to one they used to send my PIN. It's not a real secret though, it can be found on some of the statements as well. my ...


63

A 6 digit numerical password doesn't do much. Why 6 Digits? Troy Hunt has an excellent blog about being forced to create weak passwords where he talks about various bad practices including forcing short numerical passwords and puts forward the often used excuse that “We want to allow people to use the same password on the telephone keypad” The only ...


16

Original answer This is a bad, bad policy. There are only 106 or a million different 6-digit numbers. That is so too little. It is almost impossible to prevent an offline brute force attack, no matter how slow a hashing algorithm you use. If one attempt takes 1 second, you will crack a password in 11 days. It may also be too little to completely stop a ...


0

Many registration forms prevent you from choosing a password ... Unfortunately, many registration forms have no idea how to tell good from bad passwords, and create almost arbitrary restrictions, including the truly ridiculous, such as a maximum password length, not being allowed to use special characters, etc. Passwords work in terms of entropy, where ...


1

Could a secure system be built that checked password updates against other people's passwords and rejected them if a password was too common? There are reasons not to do so, but if I were tasked with preventing passwords from being overused, I'd receive the password, Hash it, Store the hash in a table with no connection to any user nor even the text ...


0

I think the best thing to do is just checking for password weakness on server side, this can be an expensive operation (in example lookup from dictionaries). Also passwords commonly used or checked for attacks are a good bet. It is possible MS first try to hash the password and compare it with a list of unsecure passwords (that are actually not used by any ...


120

We, at Microsoft, are banning the passwords most commonly used in the attacks and nearby variants. We aren't basing this on our user populations, who (because of the system) don't share these passwords unless the attacks change. The attack lists generally derive from studying breaches. Attackers are smart enough to look at lists to figure out high ...


30

A system that checks existing account passwords before deciding to block a new user's password as "too common" would, in fact, be self-defeating. You would not only be letting a user or attacker know that in fact the password is valid for some accounts, but that's it's valid for a lot of accounts. Specifically, the commonality threshold value - 1 of them. ...



Top 50 recent answers are included