When using Discourse as a private repository of sensitive/confidential information, we care about password security. My question is: is enforcing unique characters in passwords a good practice or bad?
The Internet seems to have a consensus that:
Longer passwords are better, although technically speaking it reduces the search space. However, the trade-off seems to be accepted by most due to the fact that
humans are lazy, and will use short passwords if allowed to
the search space reduction is mostly in short passwords which is not significant compared to the entire search space
Passwords combining different character groups are better, although, again, technically speaking it reduces the search space. But again, humans are lazy and won’t use wierd/uppercase if they don’t have to.
A min number (usually at least 5 recommended) of unique characters are better. This is less certain. My question concerns this.
I am thinking that forcing unique characters may actually decrease security because:
Not many people will use strings of the same characters in passwords… for example, they’ll tend to type 12345 or qwert instead of 00000.
Limiting the ability to repeat characters SIGNIFICANTLY reduces the search space. Forgot where I read it, but I read it somewhere that it reduces the search space by more than half.
In general, not much advise on how much entropy is good for a password. It is understood that no entropy (i.e. all same letters) is bad (for ASCII). What about entropy of one? Meaning at least two different characters?
I’ll argue that no entropy for ASCII letters is bad, but no entropy for Unicode characters? Emoji? That cannot be too bad, right?
Entropy is just an expression of how many guesses it’ll take to brute-force a password. How much you need is dependent on the threat model (online vs offline attack, rate limiting and hashes, and a bunch of other things). Without knowing your threat model, it’s impossible to give a recommendation as to how much entropy is “good enough”.
Also, password entropy is, at best, a fairly hand-wavey measurement. It’s not a mathematical science. In many ways, there’s only two types of passwords: those that are in the attacker’s list of passwords to try, and secure passwords. All possible short strings will be in there, and a whole pile of “known” longer passwords. Everything else is OK to use.
I imagine it would not be that difficult to use recursive levenstein distance from knowns. A constant battle that my tinfoil hat self might think is intentional so everyone will be not only willing but anxious to give their personal visible and audible data over.
In more ways than one, password security reminds me of captchas. ie. the best that can be hoped for is a best guess compromise that’s flexible enough to adapt as needed.
You do know Discourse checks all new user passwords against the 10 million most common repeated passwords, yes? And prevents them from being used? That covers pretty much all the cases you are describing.
The only hole in that strategy was covered in one of the blog posts I linked: native languages differ.
It is many many millions, all the common password lists merged together. The reason the list isn’t very big is because of this graph… which was in the above blog posts.
I will leave understanding that, as an exercise for the reader…
Really, read those blog posts closely @schungx. You’re making me repeat myself over and over here for no good reason. All the info you need is there.
@codinghorror Those 3 (actual lifesaving articles) Made me change passwords almost everywhere including Bank, Social and Email Accounts with Immediate effect! … Thanks a Ton for saving the day.
Overall a good compromise with one exception: I don’t like to trust third-parties - especially Google, Facebook, etc - in property security solutions. I don’t like to install extra (black boxed) apps for very limited use cases.
