Timeline for Is using haveibeenpwned to validate password strength rational?
Current License: CC BY-SA 4.0
34 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 11, 2019 at 0:43 | answer | added | Luis Casillas | timeline score: 1 | |
| Jun 6, 2019 at 7:25 | answer | added | kutschkem | timeline score: 5 | |
| Jun 6, 2019 at 5:08 | answer | added | Geir Emblemsvag | timeline score: 1 | |
| Jun 5, 2019 at 23:15 | history | edited | Nacht | CC BY-SA 4.0 |
explain the motivation for my question
|
| Jun 5, 2019 at 22:53 | comment | added | Nacht | Many of you are thinking from the perspective of validating passwords for yourself. But that is not the only time you need to validate passwords - you may have to validate passwords for others, for instance users of your site, or of your organisation. In retrospect I should have made that more clear from my question that that was my case. Oh well it is too late now. | |
| Jun 5, 2019 at 16:16 | comment | added | Steve Sether | @Ray Then I agree with you. I'd only add that the strength meters I've seen tend to have this sort of definitive quality to them. People tend to want these sort of binary good/bad answers, so strength meters provide this overly simplistic world view. I'd be happier with a system like you describe, where the tool uses less definitive wording like "possible pattern detected", or "entropy guess". It puts the onus of truth back on the question asker rather than the tool.. Much like google search. Google doesn't really give you answers, it just asks you more questions. | |
| Jun 5, 2019 at 15:23 | comment | added | barbecue | @Neil_UK That's EXACTLY right. It's a way to filter out passwords that should never be used. | |
| Jun 5, 2019 at 14:49 | comment | added | Ray | @SteveSether I agree completely. I say only that the user should understand the reason why the password meter dislikes the candidate password. If it's a stupid reason, like in the "74nbtiMM1984Q5IB" example, the user is quite safe in ignoring the recommendation. I suppose that formally, what I'm saying is that the entropy to consider isn't just $-\sum_i P(password_i \mid generator) log(P(password_i \mid generator))$, but rather something like $-\sum_j \sum_i P(password_i \mid generator_j) P(generator_j) log(P(password_i \mid generator_j) P(generator_j))$. | |
| Jun 5, 2019 at 14:43 | comment | added | Steve Sether | @Ray While it's strictly true that randomly picking 12 printable ascii characters COULD generate something like "password1234", or some other common pattern, it's exceedingly unlikely to happen. Also, the problem with finding the pattern after the fact is that it's cherry picking. i.e. 74nbtiMM1984Q5IB DOES have the year 1984 in it. It's still a damn good password, but a dumb pattern matcher would say it has a "pattern" in it. If you use the fact you "found a date in it" and reduce the entropy appropriate for that pattern, it's cheating. See "texas sharpshooter" for more information. | |
| Jun 5, 2019 at 14:30 | comment | added | Ray | @SteveSether While I agree that password strength meters are usually garbage, if they see a pattern that isn't from the method you used to generate your password, that doesn't necessarily mean the pattern doesn't exist. It could mean that there exists some low-entropy generation method that is also capable of generating the same password as the high-entropy method you used. e.g. randomly picking 12 printable ASCII characters has an entropy of ~79, but "the password" is still terrible. A password meter shouldn't be trusted, but the user should understand why it thinks a password is bad. | |
| Jun 5, 2019 at 13:41 | answer | added | Firzen | timeline score: 1 | |
| Jun 5, 2019 at 10:00 | comment | added | Neil_UK | You're not using HIBP to validate a good password, you're using it to exclude bad ones. You have to use some other method to evaluate password strength. | |
| Jun 5, 2019 at 9:41 | comment | added | eckes | There is no need to trust external parties for production password, just use a random generated password and be done. You can certainly use external tools to validate samples and generation rules (although it’s not really needed or proofing anything). Also keep in mind that if you use unique random passwords there is no problem with password hacks as only the already compromised service would be affected. | |
| Jun 5, 2019 at 5:55 | vote | accept | Nacht | ||
| Jun 4, 2019 at 21:00 | history | tweeted | twitter.com/StackSecurity/status/1136014954690220035 | ||
| Jun 4, 2019 at 19:30 | answer | added | Kristopher Noronha | timeline score: 27 | |
| Jun 4, 2019 at 18:53 | comment | added | dwizum | I agree that's the truth. My comment was mostly in jest, to point out the weakness of "password strength" as a concept in general, since any attempt that tries to beat brute force is essentially based on assumptions about human behavior. | |
| Jun 4, 2019 at 17:52 | comment | added | Ghedipunk | @dwizum, the problem is, the users don't know there's a contest of wits at all. Users reuse passwords, plain and simple. There's no need for the attacker to be a mastermind of dizzying intellect. | |
| Jun 4, 2019 at 17:49 | comment | added | dwizum | Using or not using a password based on if it's on a leaked list seems like Vizzini's paradox from The Princess Bride. If the attacker expects everyone to not use passwords on the list, maybe they'll only attack passwords NOT on the list, meaning it might actually be better to only use passwords that ARE on the list. But if you think they think you'll think that, you might want to only use passwords NOT on the list. But if you think they'll think you'll think that they think you'll think that, then you might want to only use passwords that ARE on the list. But if you think they'll think... | |
| Jun 4, 2019 at 15:04 | comment | added | Steve Sether | @Nacht Password strength meters are just guesses, and often not particularly good ones. They can, and often do see patterns that don't actually exist, or miss patterns that do. As others have pointed out, the only way to know if you have a good password is to understand how much entropy the password generation method produces. Anything else is just a guess at the entropy. | |
| Jun 4, 2019 at 2:51 | comment | added | Lie Ryan | HIBP and pretty much any password strength meters including zxcvbn can tell you when a password is bad; they can't tell you that a password is strong. | |
| Jun 3, 2019 at 23:12 | comment | added | Nacht | @SteveSether I think the zxcvbn password strength meter does a pretty good job. Also the best thing HIBP seems to give the world is knowledge when your account has been compromised, not really anything to do with how good your password is. | |
| Jun 3, 2019 at 22:26 | answer | added | Ghedipunk | timeline score: 16 | |
| S Jun 3, 2019 at 20:09 | history | suggested | Charles Duffy | CC BY-SA 4.0 |
Remove "this" in title with a narrow, specific description
|
| Jun 3, 2019 at 19:52 | comment | added | Steve Sether | I'd say that if your password was able to be cracked using any hash, it's not a good password. I'd also say that your your password was revealed in plaintext, it's now in the cracking dictionary, and thus a bad password. But I certainly wouldn't say that NOT being in haveIBeenPwned.com means it's a good password. The website primarily exists to show how common account cracking is, and how BAD your password is. It's nearly impossible to show how good a password is, unless it can be demonstrated to have a sufficient amount of entropy by the method used to generate it. | |
| Jun 3, 2019 at 19:41 | answer | added | Josiah | timeline score: 29 | |
| Jun 3, 2019 at 19:22 | review | Suggested edits | |||
| S Jun 3, 2019 at 20:09 | |||||
| Jun 3, 2019 at 15:39 | history | became hot network question | |||
| Jun 3, 2019 at 10:30 | answer | added | bfloriang | timeline score: -2 | |
| Jun 3, 2019 at 9:30 | comment | added | reed | In brief, HIBP has a huge list of real passwords, including both strong and weak ones. It is possible that the strong ones are filtered and not used in bruteforce attacks, but it's also possible that it's not worth filtering the list (after all, passwords that look strong might actually be weak and used by more than one user). So attackers might just use the whole list for bruteforcing, and therefore every password on that list is going to be at risk. | |
| Jun 3, 2019 at 9:17 | answer | added | schroeder♦ | timeline score: 67 | |
| Jun 3, 2019 at 9:11 | comment | added | schroeder♦ | Can you cite a source saying HIBP "is a good way to check if a password is strong enough to use or not"? | |
| Jun 3, 2019 at 9:01 | answer | added | LVDV | timeline score: 2 | |
| Jun 3, 2019 at 7:39 | history | asked | Nacht | CC BY-SA 4.0 |