McGill will double your password if you don’t do it first

Re:McGill will double your password if you don’t do it first by jasonj79 on Tuesday November 18, 2014 @09:08PM (#8627811)

A better way to do this would have been:

* hash current passwords with a salt, unique to each password entry, and throw away the plaintext entries.

* keep a history of hashes per user, to prevent changing to a past password

* ensure fair complexity of the incoming password

* once the deadline has been reached, force users who have not yet changed their password to do a password reset via an online form

* never, ever again think that doubling a password is a proper way to fix a security issue, ever...

[ Parent | on HN ]

Re:McGill will double your password if you don’t do it first by lukifer on Wednesday November 19, 2014 @01:50AM (#8628620)

> ensure fair complexity of the incoming password

As we all know, a typical password validator formula is a great way to encourage people to choose "Secr3t!", or something else equally bad.

I'd really like to see a password field that auto-generated pass phrases using full english words from a sufficiently large wordset (in the vein of "correct horse battery staple"), possibly even enforcing such phrases as the only valid type of password. Every user gets a strong password they can actually remember. (...although possibly a non-starter for mobile contexts.)

[ Parent | on HN ]

Re:McGill will double your password if you don’t do it first by reitanqild on Wednesday November 19, 2014 @03:58AM (#8628953)

Please don't enforce it. The moment you have a "sufficiently large wordset" in English you'd already added a whole lot of words that are hard to spell not only for non-native speakers.

Why not try to generate semi random pronounceable passwords? There's a clear decrease in entropy but brute force cracking against all pronounceable strings less than 20 chars will still be hard. (Of course your definition of pronounceability might differ.)

[ Parent | on HN ]

Re:McGill will double your password if you don’t do it first by ars on Tuesday November 18, 2014 @10:12PM (#8628012)

> never, ever again think that doubling a password is a proper way to fix a security issue, ever...

I don't think that's it, I think it's just to annoy people into changing it.

[ Parent | on HN ]

Re:McGill will double your password if you don’t do it first by jasonj79 on Wednesday November 19, 2014 @07:28AM (#8629607)

I wondered the same, but I'm not sure that doubling my password would annoy me into changing it, especially when the password was previously capped at 8 characters.

[ Parent | on HN ]