Timeline for Has password strength been an *actual* problem in a professional context? [closed]
Current License: CC BY-SA 3.0
13 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Mar 17, 2017 at 13:14 | history | edited | CommunityBot |
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
|
|
Jan 26, 2016 at 17:34 | comment | added | PwdRsch | As for your question about failure of decent passwords, there are a few examples that I can think of, but here's a pretty good one regarding bitcoin brainwallet cracking by Ryan Castellucci. If you look at page 33 of the slide PDF he lists a few examples of the passphrases he cracked, which I'd argue many people would believe most of them were secure, and yet there weren't strong enough in this case. | |
Jan 26, 2016 at 17:29 | comment | added | PwdRsch | Hey @fgysin this paper may not answer the part of your question about a weakly created password actually being exploited but it does provide insight on what password strengthening measures average people take that may not provide much security benefit. | |
Jan 26, 2016 at 15:44 | comment | added | Matthew | The problem is that very few breaches are dependent on a single factor, such as password policies being weak. Weak password policies won't cause database extraction. They won't help with poor password storage. However, the breaches you see which include passwords usually have both of these. There are other breaches, but if you can't crack the passwords, you can't assess the password strength. | |
Jan 26, 2016 at 15:38 | history | closed |
GdD Ohnana Xander Stephane Matthew |
Opinion-based | |
Jan 26, 2016 at 15:18 | comment | added | fgysin | Why the votes for close? Can someone suggest edit that would make this question more eligible? (I'm really asking for specific real world occurrences of failure of decent password policies - this seems answerable to me, if not necessarily obvious.) | |
Jan 26, 2016 at 15:18 | comment | added | Trey Blalock | I think another way to answer your question is to look at what has been found in public password dumps, specifically cases where the passwords were hashed and a large percentage were cracked. For example we do sometimes see different password techniques showing up in those large sets of "cracked passwords" which would imply that the users did attempt to do something beyond the basic level of passwords. I think the fact that these too occasionally get cracked means that teaching better password development techniques is in fact still relevant. | |
Jan 26, 2016 at 14:12 | comment | added | Steve Dodier-Lazaro | Agreing with @GdD here. I have unpublished research which explains why current password research might be a problem but I'm not willing to share that pre-peer-review. I can go on and on about why there might be issues, but if you want a somewhat objective account of the limitations of password policies on actual security... come back in 10-15 years, even the best researchers in our field aren't able to do that yet. Partly because we don't have good enough methods for measuring security outcomes in organisational contexts, at least yet. | |
Jan 26, 2016 at 14:01 | review | Close votes | |||
Jan 26, 2016 at 15:38 | |||||
Jan 26, 2016 at 13:39 | comment | added | GdD | I would love to answer this question, however it would be too based on opinion rather than fact. | |
Jan 26, 2016 at 13:38 | comment | added | fgysin | This is what I meant, really. Is it actually worth our time to still be discussing password policies when an exploit/backdoor/phishing/social engineering/... attack is so much more likely... | |
Jan 26, 2016 at 13:02 | comment | added | Steve Dodier-Lazaro | "I think we can all agree on the qualities good passwords need." not even close :D I personally think most research on the topic is deeply, deeply bogus. The strength of an individual password from an individual user means absolutely nothing in 2016. | |
Jan 26, 2016 at 12:47 | history | asked | fgysin | CC BY-SA 3.0 |