Cybersecurity

10644 readers

1 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 3 years ago

MODERATORS

kid@sh.itjust.works

Lanky_Pomegranate530@midwest.social

The Password Paradox: Why Security Theater is Making Us Less Safe (jakubjirak.medium.com)

submitted 1 month ago by schipelblorp@sh.itjust.works to c/cybersecurity@sh.itjust.works

57 comments fedilink hide all child comments

Microsoft’s research team studied this extensively. They looked at what actually happens when you enforce complexity requirements. Users don’t create randomly generated passwords. They follow predictable patterns. Capital letter at the start. Numbers at the end. Exclamation point at the very end. The word “Password” appears in about eight percent of “complex” passwords. When you force rotation, users increment numbers. Summer2024 becomes Fall2024. Or they add exclamation points. Or they change a single character and call it done. The false sense of security is dangerous. IT departments see compliance numbers go up. Everyone is following the password policy. The auditors are happy. Meanwhile, actual security hasn’t improved at all.

you are viewing a single comment's thread
view the rest of the comments

[–] FineCoatMummy@sh.itjust.works 0 points 1 month ago (1 children)

Even NIST stopped recommending pw rotations.

To their credit, none of the businesses I have a pw for require changes anymore. Also, to their credit, I can use long pw's now. Some used to restrict to 8 chars max (!?) But against their credit, many still restrict the pw content, like you can't use non-letter symbols or w/e.

[–] ricecake@sh.itjust.works 0 points 1 month ago (1 children)

Very old operating systems used to have a method for password hashing built in that could only handle 8 characters max. The need for compatibility with it, or things that were too zealous in being compatible lingered for a very long time.

It's not good, but some services end up behind firewalls that reject inputs that look like SQL injection. Sometimes they decide it's better to prevent sql-ish passwords than risk some weird fluke.
Sometimes they just say |, I, and l all look too similar and our users are idiots. Which is awful practice.

My personal feeling is that password length should be capped with the length of input the system can handle. Plaintext copy of Alice in wonderland from project guttenberg? Go for it.

[–] FineCoatMummy@sh.itjust.works 0 points 1 month ago (1 children)

Don't most of those systems turn the user pw into a salted hash? I suppose that would limit the effective pw length, given random pw's. Like if the hash was 128 bits or w/e, lots of 256 bit pw's would hash to the same value.

But IDK how big those hashes are. Maybe they're huge?

[–] ricecake@sh.itjust.works 0 points 1 month ago

You would be correct. However, they would truncate the password to eight characters, and 7 bits per character. This allowed the password to fit inside a 56 bit block for a des based hashing scheme.

This is an old scheme, but it was very compatible so it lingered on and on.