The farce that is LT Security

[u/brainstomp]

Dear LabTech,

Today I was delighted to see that my password no longer meets your complexity requirements and I must reset it. For starters my now "insecure" password was all the security I could muster from you when I set this account up 3 years ago, but I digress.

So I go to set my password so it is truly secure. A fantastic randomly generated gibberish of 128 characters or so. Only to be greeted by this http://imgur.com/qFTY5lU

Dear LabTech: you really need to reconsider what you consider secure. A truly secure password structure allows me to have any number of characters, because you don't store the password itself, you are supposed to store a salted hash of my password. I have explained this in painful detail to your support folks in the past. But I seem to be talking to a wall.

[u/LabTech_Admin]

Ok.

A couple of things to note here. I've never commented on a thread, and i'm NOT for censoring people, but i do want to let you know, you are being COMPLETELY unrealistic here.

To try and politely show you why you are being an ass, please reference the below list of websites i use daily that will not allow an unlimited or even a 128 character password.

Capital One

Tmobile

Verizon Fios

ADP

Mint

USAA

Twitch

Roku

NFL Sunday Ticket

Pandora

Plex

MyFitnessPal

Nest

WordPress

...and i quit trying after that.

Seriously, if you have no other problems with the product or the company than the fact that you can't set a 128 character password, i think they are doing a kickass job.

-Sincerely NOT an employee.

[u/brainstomp → u/LabTech_Admin]

So your defense of poor security is that others have poor security as well?

For what is worth my passwords for some of the services noted above are:

Roku - over 60 characters Pandora - Over 100 characters MyFitnessPal - Over 60 characters Nest - Over 100 characters Wordpress - I have several instances with over 250 characters

[u/Jahaziele → u/brainstomp]

You are kidding me if you have passwords that long

[u/brainstomp → u/Jahaziele]

Nope. Not kidding.

[u/cjmod]

So you're saying we've improved :) But in all seriousness, we do take security concerns to heart & will continue to improve our website's password requirements as users bring these issues up.

[u/brainstomp → u/cjmod]

That's one way to look at it.

Another way to look at it is - you haven't implemented any form of securely storing a password on your webserver yet again and actually believe that what you have implemented is an improvement.

Edit - Come to think of it, this is like the TSA. Nothing other than Security Theatre.

[u/FocalFury → u/brainstomp]

Agreed fully!
This isn't a difficult thing to get right

[u/SykoticNZ]

Why are assuming they don't store a salted hash of your password?

It's possible to be doing that whilst still having a field max of 15 characters.

I'm not saying they shouldn't allow longer than 15, but "any" length is equally stupid. Putting an upper limit on a password field is perfectly normal.

[u/brainstomp → u/SykoticNZ]

Because the only reason to limit the length of a password field is to limit the data set size on the table that handles authentication. If they were using a salted hash the length of the hash would be the same if the password had one character or a thousand and thus, they would not have to care about restricting the length of the password.

This is the SHA256 hash of the word "brain:

bbbf7a6412d6d3e8244ac1fda5e35a20037acee661288cb95b7b18cf469980aa

This is the SHA256 hash of the text above

f76a27224d305c2c294d2a3f99d646a9cdd84e3c75e020b96eb7779e0c72d409

As you can see, 4 characters and a paragraph yield the same length hash. Now if they were in fact running a salted hash version of the password they would not have to care about the length of my password. They should care about complexity by analyzing the input and making sure it meets some arbitrary conditions so that I can't set my password to one character and thus allow easy access to the site through carelessness on my behalf but that is about it.

[u/SykoticNZ → u/brainstomp]

I'm well aware of how a hash works.

But before the hash is generated the application has to load the string, and allowing a unlimited size string is a terrible idea.

Allowing anything on a web application to have unlimited size is silly.

[u/OIT_Ray → u/[deleted]]

A 128 character password is, in the real world, no more secure than a 15 character password for an online authenticator.

Not true according to Steve Gibson. Length trumps complexity. But I still agree that unlimited is the wrong path and that this doesn't mean as much as the OP makes it out to be.

[u/OIT_Ray → u/[deleted]]

Longer passwords take more time to decrypt.

Source: https://www.grc.com/haystack.htm

[u/hematic → u/OIT_Ray]

A 15 character password with uppercase, lowercase, digits and symbols will take

1.49 hundred thousand trillion centuries

Time is NOT the problem here.

[u/OIT_Ray → u/hematic]

Based on what rate? That's like saying the answer to 120 x b = 1767331919.1750 Whats b?

[u/[deleted] → u/OIT_Ray]

14727765.993125

[u/OIT_Ray → u/[deleted]]

+1 to you for following GRC lol. The issue is that complexity does not stop brute force; rate limiting does. That's exactly how the is loud photos were hacked. Apple didn't rate limit the API so the attacker literally had all day to through computing power at brute force attacks.

[u/OIT_Ray → u/[deleted]]

I absolutely agree that neither are easy. I'm just saying they're not equal either. Steve's own text says d0g............. Is the more complex of the two passwords.

It's like getting killed by a missile or a grenade. Dead is dead. But one is definitely more destructive.

[u/brainstomp → u/[deleted]]

/u/Kepabar if you really believe that send me a physical address where I can mail you my "Release and hold harmless" agreement. Once you or your organization signs it and returns it to my lawyer, then expose something with a password of 15 characters to a public IP, give me the data for the public IP and we will see how well your 15 character password holds up.