How to understand GitHub's password policy?

Question

Today I tried to change my password on GitHub, but the site rejected my new password:

The new password you provided has also been reported as compromised due to re-use of that password on another service by you or someone else. GitHub has not been compromised directly. Your password was not saved. Please choose a stronger password.

Do I understand correctly? GitHub would like me to choose a password that has never been used by anyone on any site at any time in the history of the internet. I see how that's more secure, but ...

Will more sites do this? What are the implications? Does it spell the end of human-memorable passwords?

GitHub suggest to use a randomly-generated password saved in a password manager. What about people who would prefer a memorable password? In my case, I use several computers and don't possess a smartphone.

---

In my case, GitHub eventually accepted a longer passphrase. My account is also protected by two-factor authentication with a U2F key.

Answer 1

GitHub would like me to choose a password that has never been used by anyone on any site at any time in the history of the internet.

That's the general idea, though I would rephrase as

GitHub would like me to choose a password that has never appeared on any list of cracked passwords for any user on any site in the history of the internet.

---

Rationale:

Each time a famous site gets its password database hacked, hackers eventually publish the list of username:email:passwords for all users on that site at the time of the attack. The site haveibeenpwned.com catalogs all username:passwords where the password is publicly-available. You should check here every month or two (or sign up for their notification service) to make sure you aren't on the list! This is just the username:email:passwords that are publicly known, I'm sure darkweb hacker groups have many many more than haveibeenpwned knows about.

This leads to a couple different types of attacks which github is probably trying to prevent with this password policy.

Password re-use attacks

Attackers trying to get into your account can look you up on social media and make a list of all the usernames / accounts that belong to you. Then they can look these up in the cracked password databases and get a short list of passwords that you have used in the past. We know that users tend to re-use the same password across different sites.

Github doesn't want to get into the game of trying to guess which accounts on other sites belong to you, so it's easier to say "anyone on any site at any time in the history of the internet".

Dictionary attacks

Attackers doing more general password cracking -- usually after they have stolen a database of hashed passwords -- can't guess every possible password because there are too many, so instead they will use dictionary-based approaches for which passwords to guess. Lists of cracked passwords (sorted most frequently used first) are a pretty good dictionary to use.

Given today's GPU speeds, if your password is one of the, say, billion most used passwords on those lists, then you're probably vulnerable.

Again, it's easiest for github to just ban all passwords on the cracked password lists.

---

You also ask:

What are the implications? Does it spell the end of human-memorable passwords?

Yup, probably. Over time the lists of cracked passwords will get longer and longer with fewer human-memorable (aka "weak") passwords available to choose from. This will probably hasten the demise of passwords, cause more R&D focus on making password managers / Yubikeys, etc more user-friendly and force people beyond tin-foil-hat security nerds to start using them. This is probably a good thing. I hope more sites do start doing this!

Answer 2

Do I understand correctly? GitHub would like me to choose a password that has never been used by anyone on any site at any time in the history of the internet.

Duh. That's password usage 101: choose a strong, unique password. Why would you ever want to pick a password that others know?

If Github knows that this password was used by someone else at any point in time, then apparently that password was cracked in the past. That means that attackers can also know this, and crack your account.

Since hacked accounts are not in Github's interest, they require you to use a secure password. That doesn't sound unreasonable to me.

What about people who would prefer a memorable password?

You can still use a strong password, though depending on how often you log in to Github, a unique one might be difficult. Generate a password randomly, write it down, and memorize it over the next few days. Then burn or shred the paper.

Sometimes a password manager is impossible. For example, you can't use your password manager when you're still at your login screen. So when I start a new job (or something else where you get a computer issued), I generate a password for my user account and write it down. Whenever I log in, I try to remember a few more characters. After a few days, I'm confident that I won't forget and I can destroy the note. When I stop working there, I will forget the password after a few months of disuse, but that is fine.

This doesn't work if you need a unique password for fifty websites, but that's why we invented password managers. They have all sorts of synchronisation options, so working on multiple computers is no excuse.

Answer 3

Yes, more sites will probably start doing this, because it has become a NIST recommendation to check new user passwords against existing password breaches. More importantly, there is now an easy publicly available resource for them to check passwords against. This is an attempt to prevent "credential stuffing" attacks as well as to make dictionary attacks against database breaches much harder. A good writeup of password policy guidance is available from Troy Hunt if you're interested in some of the reasoning, and some actions you as a user can take.

It doesn't spell the end of memorable passwords. There are techniques for generating a memorable (but still strong and unique) password which rely on randomness, such as diceware which uses 5-8 randomly selected words in a passphrase, random grammatically-correct passphrases of varying lengths, or pronounceable passwords which select syllables at random.

But remembering more than a few of these, and remembering which passsword goes with which service, is also hard. So the bottom line for you as a user, is that you should be using a password manager. Generate one super-strong but memorable password, remember that, use it as your master password, and you don't ever even need to see what your password is for Github or your bank or Facebook or whatever. Not having a smartphone isn't necessarily a problem even if you use multiple computers, because many password managers have a portable install option that you can put on a USB stick, or have a browser extension, or a website, that can give you access to your passwords.