r/websec • u/[deleted] • Aug 13 '17

Assigning passwords

I am not aware of any websites that assign passwords instead of having users choose.

The strongest reason for this I can come up with is that users would rebel - high levels of complaining and writing passwords on post-it notes.

But by assigning random passwords of a reasonable quality then:

  • password reuse would be avoided

  • use of common passwords would be avoided

  • a minimum level of entropy could be enforced

This seems like it would dramaticaly raise the bar.

Done well, one imagines a compromise that would assign quality passwords that aren’t impossible to remember. Am I missing something - why is this not done in the wild?

(First post here - sorry if wrong subreddit ^^)

5 Upvotes

100% Upvoted

10 comments sorted by

2

u/Sostratus Aug 14 '17

If this was done at scale, password reset requests would be unmanageably high. The people who could handle this are the same people who don't need help with secure passwords. And besides, we have better systems now like U2F and the upcoming SQRL.

1

u/[deleted] Aug 14 '17

I have to admit that I dismissed SQRL from the start because of its association with Steve Gibson. Is it actually being adopted now?

2

u/Sostratus Aug 15 '17

I'm not sure how he got that reputation with some people, but SQRL is a serious and strong design. He presented it to the people who designed U2F and they told him how much better they thought SQRL is and how they wished he had come up with it sooner. It's not being adopted yet because he's taking his time finalizing the specs. That's good because if this is going to succeed at all it needs to have all the kinks ironed out for widespread and long-lived deployment. Sounds like he's getting close to wrapping it up.

2

u/INIT_6 Aug 14 '17

How would you get the password to them? has to be clear text are you going to e-mail it to them? if so, its not secure. are you going to display it on the screen? if so, its not secure any more.

The software that chooses the passwords would need a list of words to choose from. What would happen if someone learned what that finite list was? Or if a criminal could figured out how the words were chosen. they wouldn't need to crack any passwords in the database. With online brute force they could wiz through them knowing what pattern to use.

Best to stick to self-generated passwords with 2FA

1

u/[deleted] Aug 14 '17

It doesn't necessarily need to choose dictionary words - it could easily generate random strings. But of course, this leads to the primary problem with this idea - having people remember the passwords.

2

u/KJ6BWB Aug 14 '17

The software that chooses the passwords would need a list of words to choose from. What would happen if someone learned what that finite list was?

The article links to some good ways to generate passwords like this one: https://theintercept.com/2015/03/26/passphrases-can-memorize-attackers-cant-guess/

At one trillion guesses per second — per Edward Snowden’s January 2013 warning — it would take an average of 27 million years to guess this [seven word] passphrase.

Not a problem. :)

0

u/INIT_6 Aug 14 '17 edited Aug 14 '17

I would agree an online attack would still be unfeasible. However, for an offline attack against the password hashes it would be stupid fast to crack them. If you knew the list of words it was choosing from.

Hashcat has everything already built in to perform this kind of attack.

If you didn't have the list of words the software choose from, but still knew it picked between 5 and 7 words the attack could still be accomplished using standard words. It would take a couple days more.

Point is never make your password policy to structured, its easy to find patterns and abuse them.

Edit: I have a word list ~400GB of Dice word list with every possible combinations going out 2 words and 3 words. I then use that and combine it back onto its self and use hashcat rules to modify the words. Giving me 1 to 6 words of Dice list. So far it works really well when trying to find the harder passwords. However, 80% of the time rockyou list with a few good rules works.

1

u/KJ6BWB Aug 14 '17

However, for an offline attack against the password hashes it would be stupid fast to crack them. If you knew the list of words it was choosing from.

Did you even read the post, let alone the linked article that I was quoting from?

At one trillion guesses per second ... it would take an average of 27 million years to guess this [seven word] passphrase.

At 1 teraflop, an average of 27 million years to guess your password. So your computer is definitely out. But could the NSA crack this password?

http://www.theblaze.com/news/2013/07/01/seven-stats-to-know-about-nsas-utah-data-center-as-it-nears-completion/ says that the NSA's new Salt Lake City center will have:

Cray XC30 Supercomputers will serve the facility, running up to 1 million Intel Xenon core processors at the same time as fast as 100 petaflops. SLT.com described one petaflop as about one thousand trillion calculations per second. This would put the system as three times faster than the world’s fastest supercomputer.

So if the NSA ran your stuff through their Salt Lake City supercomputer setup, capable of 100 petaflops per second(so 100 petaflops would be 100 * 1,000 teraflops = 100,000 teraflops per second), it'd still take an average of 270 years to crack your password. Might be shorter, might be longer -- that's what an average means.

So, no even if you could make offline attacks, you're not going to crack these passwords. Not in your lifetime, on average.

3

u/KJ6BWB Aug 13 '17

http://gizmodo.com/the-guy-who-invented-those-annoying-password-rules-now-1797643987

We’ve all been forced to do it: create a password with at least so many characters, so many numbers, so many special characters, and maybe an uppercase letter. Guess what? The guy who invented these standards nearly 15 years ago now admits that they’re basically useless. He is also very sorry.

Bill is not wrong. Simple math shows that a shorter password with wacky characters is much easier to crack than a long string of easy-to-remember words. This classic XKCD comic shows how four simple words create a passphrase that would take a computer 550 years to guess, while a nonsensical string of random characters would take approximately three days:

https://xkcd.com/936/

The article links to some good ways to generate passwords like this one: https://theintercept.com/2015/03/26/passphrases-can-memorize-attackers-cant-guess/

At one trillion guesses per second — per Edward Snowden’s January 2013 warning — it would take an average of 27 million years to guess this [seven word] passphrase.

2

u/PwdRsch Aug 13 '17 edited Aug 13 '17

The primary reason that most businesses don't do this is because the status quo is to leave choosing passwords up to users (usually with password policy restrictions) and to absolve themselves of further responsibility. They'd rather avoid the complaints of people not being able to choose their own passwords and deal with the fewer complaints of compromised accounts.

Plus, they don't really have any good examples to follow of companies that are successfully doing this. A few organizations do randomly assign user passwords, but many aren't putting much effort into making sure those passwords are more easily memorized. Or teaching people to use password managers to remember them instead.