Hotmail To Ban Common Passwords

123456 by Anonymous Coward · 2011-07-15 06:37 · Score: 5, Funny

My luggage! Nooooo

Re:123456 by An+ominous+Cow+art · 2011-07-15 08:02 · Score: 1

Very funny, but what if your Int stat is 11 or less, and the only language you speak is Common?

Prediction by Anonymous Coward · 2011-07-15 06:38 · Score: 5, Insightful

By the time I post this, someone else will already have posted the "combination on my luggage" joke.

Re:Prediction by Em+Adespoton · 2011-07-15 07:09 · Score: 1

Sales will increase significantly for laptop users... as will a trail of sticky notes on every surface where they have placed their laptop.
Re:Prediction by Toe,+The · 2011-07-15 08:10 · Score: 2

That's horrible security practice!
What you're supposed to do is write all your passwords on one sheet of paper, clearly indicating which one is for what login. Then write the word PASSWORDS at the top in big letters and post it on the wall of your cubicle.
(Sadly, I really have seen this.)
Re:Prediction by thePowerOfGrayskull · 2011-07-15 08:26 · Score: 1

That's horrible security practice!
What you're supposed to do is write all your passwords on one sheet of paper, clearly indicating which one is for what login. Then write the word PASSWORDS at the top in big letters and post it on the wall of your cubicle.
(Sadly, I really have seen this.)
I remember that scene too. The password for this month is "pencil".
Re:Prediction by ZorinLynx · 2011-07-15 12:10 · Score: 3, Interesting

The funny thing is that in today's highly connected world, it's probably safer to write down your complex password at home than to use a simple one you can remember and don't need to write down.
A written-down password on a post-it note can only be read by those who have physical access. So if someone cracks your account due to it, it will likely be someone you know, such as family or a visitor. Whereas a simple password you remember can be guessed by anyone on the Internet.
Which is more likely to be compromised? If you trust those you allow into your home, it's more likely to be the simple password.
Re:Prediction by travdaddy · 2011-07-15 14:40 · Score: 1

How about "Baloney1? That's your password?"
"Well, used to be just baloney, but now they make you add number."

--
Adidas To Bring Back Sneakernet

I think the big story here is.... by Anonymous Coward · 2011-07-15 06:41 · Score: 1

That Hotmail still exists.

Re:I think the big story here is.... by Anonymous Coward · 2011-07-15 06:55 · Score: 1

Meh. I never saw the appeal of hotmail. I'm still using excite.com *pulls up onion belt*
Re:I think the big story here is.... by robogun · 2011-07-15 11:24 · Score: 1

I haven't checked it in a while since it doesn't render in Seamonkey (malformed XML error). Half the time it won't render in Firefox as they get cute with the MS only code. There are probably 2,500 unread spams in my account by now.

Meanwhile in 1999 by Chris+Down · 2011-07-15 06:42 · Score: 1

Oh man, I can't WAIT for the new millennium!

Moving Target by ZombieBraintrust · 2011-07-15 06:43 · Score: 1

Wont this just lead to new commonly used passwords while at the same time reducing the number of overall passwords possible. I would think they would need to regularly study what becomes common and ban those while unbanning old common passwords.

Re:Moving Target by YodasEvilTwin · 2011-07-15 06:51 · Score: 1

No. Occassionally new common passwords will pop up (perhaps "googleplus" on Google+ for example) and they'll ban it, but in general this action will force people to invent new passwords. The use of creativity will result in a broader set of passwords, not a different narrow set. As well, this is trivially automated. No need to do studies and manually ban.
Re:Moving Target by T_Tauri · 2011-07-15 07:02 · Score: 1

Hopefully pretty soon we will move away from using passwords to something else like one of those RSA key fobs and OpenID. Then people can remember a single password which combined with the dual factor makes a very strong proof of identity. OpenID gives you the same login everywhere which removes the other issue with secure passwords and trying to remember all of them, After all its better to trust a company that bases its business of dual factor authentication than a pile of post-it notes stuck to your monitor. They will take securing their servers seriously. Oh wait....
Re:Moving Target by PickyH3D · 2011-07-15 07:24 · Score: 1

Only if you had the entire list of passwords. And, even then, it's a predefined list of common passwords: why wouldn't a cracker try them?
Any password cracker absolutely would. A banned, "common" password will never be the best option. A long password phrase always will be.
Re:Moving Target by Em+Adespoton · 2011-07-15 07:33 · Score: 1

I've always wondered whether a system that compares your hash to a hashdb and rejects it if there's more than a certain percentage of matches would be a good idea.
This obviously wouldn't work for small populations, as the system could itself be used to identify passwords within the system... but for something the size of Hotmail's DB, it could work; especially if the feedback was a simple "you cannot use this password. Try again" for all collisions and blacklisted passwords.
The system could even prompt users to change their password if it started to become too common.
Re:Moving Target by thePowerOfGrayskull · 2011-07-15 08:28 · Score: 1

Any password cracker absolutely would. A banned, "common" password will never be the best option. A long password phrase always will be.
I've started doing this recently, it's great - passwords can be both rememebred easily.
However, it's ridiculous the number of sites that still disallow spaces in passwords. There's no excuse for that, unless you're storing passwords as old DOS file names.
User names often have the same ridiculous restriction.

fix brute force attack by index0 · 2011-07-15 06:56 · Score: 1

Why not limit the number of password tries in a given time unit?

Re:fix brute force attack by supernatendo · 2011-07-15 07:10 · Score: 2

Because when, not if, Hotmail servers are compromised either externally or internally and the account hashes are collected in bulk, one can brute force the hashes all day long since nothing can detect failed attempts once your just running hashes against a text file.
Re:fix brute force attack by magarity · 2011-07-15 07:15 · Score: 2

That only works when trying to hack a particular account. If you want to send spam to everyone in some random account's contact list, you don't care whose contact list. So if you know some percentage of the accounts use the same thing for their password, that's a lot of contact lists, mission successful at only one password attempt per account.

Prediction by SomewhatRandom · 2011-07-15 06:58 · Score: 1

3M's Post-It note division sales will increase, due to users writing down their passwords and storing them under their keyboards.

Re:Is there a list of the banned passwords? by Quirkz · 2011-07-15 06:58 · Score: 1

I don't know about banned passwords, but slashdot has stories quarterly about "most common passwords" -- often released as an analysis of hacked or exposed passwords on one site or another. The common passwords are common everywhere, and the crooks already know them. Publishing the list of most common ones can only help if it convinces a user their password is too simple.

I'll admit that a couple of passwords I thought were 'clever' have shown up on these lists, and it's convinced me to change them to something less common.

--
The Quirkz Handbook of Self-Improvement for People Who Are Already Pretty Okay

Password Encrypted? by BlindMaster · 2011-07-15 07:05 · Score: 1

I thought those passwords are encrypted, so how do they get the list of those common password? And isn't `recover your password` questions are common/flawed as having password in place?

Re:Password Encrypted? by DemonGenius · 2011-07-15 07:14 · Score: 1

I thought those passwords are encrypted, so how do they get the list of those common password?
Common password lists do exist, this has been studied to death. I would imagine that the password is compared with a list that exists on the server before it is encrypted.
Re:Password Encrypted? by pe1chl · 2011-07-15 07:17 · Score: 1

Whenever you type your password on the login form, it is available to them in plain text.
(of course it is transmitted encrypted over the internet, but then it is decrypted by their server)
If you are lucky they don't store your password in their database in plaintext, but each time you log in they have the opportunity to lookup your password in their insecure password list before encrypting it again to compare it with their database entry.
Re:Password Encrypted? by glwtta · 2011-07-15 07:50 · Score: 1

And yes, the recovery option is the side screen door to Fort Know that people seem to forget about. We really do need a better password recovery system.

We have one, it's "reset your password", and it's what every moderately well-run site uses. I haven't seen a password recovery option on any mildly popular site in years. (I'm sure someone will come up with an example, point is, it's rare).

--
sic transit gloria mundi
Re:Password Encrypted? by BlindMaster · 2011-07-15 07:57 · Score: 1

Yes, I assume they can sort by hashed password, and actually my question is how they ended up with "common password" if Hotmail encrypted the password. If there is a decrypt function, then I am curious how secure it is being hosted.
And I suppose they are here to study the pattern, which included related passwords, eg. 123456 qualify as linear f(x) = x, therefore 1234567 will also be categorized as the same thing for study, no?
If I am a hacker, I am interested in the pattern more than just common passwords, and for a security expert to counter hackers, would they be studying the pattern instead of general `common passwords`? Or provide suggestion on those pattern, instead of just some isolated password case?
Re:Password Encrypted? by bberens · 2011-07-15 08:02 · Score: 1

If you are lucky they don't store your password in their database in plaintext
If you're really lucky they run your password through a one-way hash and store *that* into the database. Then, theoretically, anyone who gets access to your hash can come up with a password that will get them into the compromised system.. that is a password that happens to have the same hash, but not necessarily your actual password.

--
Check out my lame java blog at www.javachopshop.com
Re:Password Encrypted? by bberens · 2011-07-15 08:04 · Score: 1

This one always gets me. People may be smart enough to have a strong password for their bank, but will have a weak password for their e-mail where the password recovery details will be sent to.

--
Check out my lame java blog at www.javachopshop.com
Re:Password Encrypted? by ZombieBraintrust · 2011-07-15 08:08 · Score: 1

No I think he was saying "reset your password" is the side screen door to Fort Knox. "Reset your password" generally involved security questions and emailing the password to a secure email location. So once you break their hotmail account you can "Reset your password" on your bank account or your WOW account. I wonder if there are any lists of common answers to security questions.
Re:Password Encrypted? by ZombieBraintrust · 2011-07-15 08:28 · Score: 1

They are using passwords from other sites. Sites that didn't do their security correct and stored passwords as plain text. The sample size of these exposed sites is large enough that they know what Americans currently choose as common passwords.
Re:Password Encrypted? by glwtta · 2011-07-15 08:38 · Score: 1

Hmm... I had a little problem parsing the original sentence (And isn't `recover your password` questions are common/flawed as having password in place?), you could be right.

Of course if you actually have their Hotmail login and password, chances are they are the same as the bank account.

--
sic transit gloria mundi
Re:Password Encrypted? by Ferzerp · 2011-07-15 08:49 · Score: 2

Not if properly salted it will not.
Re:Password Encrypted? by magarity · 2011-07-15 09:34 · Score: 1

Not if properly salted it will not.
It should be obvious that this isn't the case or this analysis would be impossible.
Re:Password Encrypted? by LordLimecat · 2011-07-15 09:37 · Score: 1

Microsoft has the salt, so they will be able to check certain passwords. Hash 123456, salt it, compare with the table.
The point of salt isnt to make the hashes impossible to do lookups on (otherwise you couldnt do logins), its to make existing rainbow tables worthless.
Re:Password Encrypted? by vux984 · 2011-07-15 10:28 · Score: 1

Microsoft has the salt, so they will be able to check certain passwords. Hash 123456, salt it, compare with the table.
But the salt isn't necessarily the same for every login.
Many login systems create random salt for EACH account, and store it with the hash.
The point of salt isnt to make the hashes impossible to do lookups on (otherwise you couldnt do logins),
Of course.
its to make existing rainbow tables worthless.
If your login database is stolen, and you use the same salt for each account, then its a fairly simple effort to generate new rainbow tables for your chosen salt.
This is one reason why unique salt for each account is preferable.
Re:Password Encrypted? by Ferzerp · 2011-07-15 10:32 · Score: 1

Yes, but all the proposed things I was replying to were rainbow table type analyses.
It's computationally cheap to compare a hash to a database of a few million hashes. It's much more difficult (not hard, but slow enough that it couldn't be used as an ad-hoc password rejector) to compare all passwords when a properly slow hashing algorithm with a unique salt per account is used.
Re:Password Encrypted? by Sheepy · 2011-07-15 22:58 · Score: 1

Many login systems create random salt for EACH account, and store it with the hash.

This is one reason why unique salt for each account is preferable.

It's better to generate a new salt for each password; i.e., a new salt should be generated whenever a password is modified. That way it is pointless to generate rainbow tables for a chosen account.
Re:Password Encrypted? by Hognoxious · 2011-07-16 01:56 · Score: 1

will have a weak password for their e-mail where the password recovery details will be sent to if the attacker can successfully answer the question(s).
FTFY.

--
Confucius say, "Find worm in apple - bad. Find half a worm - worse."

Common sense here... by mlts · 2011-07-15 07:08 · Score: 1

This is something that public access UNIX systems and universities with a ton of students learned ages ago, when all it took was a guy running Crack on /etc/passwd (before passwords were shadowed.)

Most operating systems have a small dictionary they check against so people using "12345" for something other than their luggage will be stopped immediately.

History just repeats itself... websites are now learning what operating system makers learned in the early 1990s -- keep the passwords well encrypted, and disallow obvious dictionary entries, so a brute force operation may take seconds to find a password rather than microseconds.

Re:Common sense here... by BlindMaster · 2011-07-15 07:14 · Score: 1

Therefore, keygen for SSH is OpenID?
Re:Common sense here... by toejam13 · 2011-07-15 08:12 · Score: 1

Hotmail could go one step further. As opposed to just checking against a blacklist of common passwords, they could use a whitelist of acceptable password types. Must be 8 or more characters in length, must be mixed case and must contain one or more digits. Then you run that against the blacklist to weed out people picking "Passw0rd" or "t1nkerB3ll".
Re:Common sense here... by Pope · 2011-07-15 08:20 · Score: 1

Yep, do both: blacklist the "bad" passwords, and add a strength requirement. Hell, all online services should have been doing this for YEARS already.

--
It doesn't mean much now, it's built for the future.
Re:Common sense here... by mlts · 2011-07-15 08:57 · Score: 1

The reason online services have not bothered is because until now, it really didn't matter. Having security is expensive, and the PHBs believe anything security related has no ROI, so it doesn't get done.
Now that attackers have snarfed password databases and made them public, online services are starting to actually bother with some security such as using salts and hashing passwords, enforcing basic password measures, and adding anti-brute force attack provisions, such as locking out IPs, tarpitting (where the replies get slower and slower, or they remain the same speed, except any passwords guessed get completely ignored), or locking out the account.
The ironic thing... online services are just discovering this... this functionality has been in AIX, Solaris, and various Linux distros since the early 1990s.
Seems like we are reinventing the wheel. Now all we need are websites to have a standard form of two-factor authentication, with multiple devices on the list (so if one loses their phone, they can use a SecurID card to still get in, or even a printed TAN list as a last resort, similar to how Google's authentication does it.)

I am not using hotmail, but maybe my friend is... by pe1chl · 2011-07-15 07:14 · Score: 1

What I find disturbing with features like this, is how the service (be it hotmail, linkedin, facebook, whatever) always assumes that when you receive crap from one of their users and want to report it so something is done about it, you also have an account yourself.
I want to be able to report that I receive spam from one of their users WITHOUT having to create an account on their system.
So the "my friend has been hacked" report should not be only in their mail user interface, but also in some publicly accessible webpage or even better in the handling of mail sent to abuse@.

Furthermore, having monitored events of "hacked hotmail accounts" for some time, I believe quite a number of them is not hacked by bruteforcing the password, but by phishing or luring the user into "when you fill in this questionnaire we will send you a free led lamp" etc, where one of the questions in the questionnaire actually asks the user to provide their mail address and password.
Many naive users give all info you ask them for when promised a free gift.

Re:Wait, what?! by jank1887 · 2011-07-15 07:18 · Score: 1

no. and above all, see the comment above about a max password length for Live.com accounts. (hotmail is part of live.com now)

Good idea to ban common passwords by gurps_npc · 2011-07-15 07:20 · Score: 2

Far better than simply outlawing "you can't use your username as your password" Same goes for the silly "can't use the last password as your current one". I never understood the reasoning behind the time based password change. No one expects people to get a new key every six months for their home lock. No one expects someone to get a new ATM card every 6 months. Good passwords are worth keeping for years - as long as they actually are a good password. Are you supposed to be worried that you have given out your old password and forgotten about doing it? You can't stop an idiot from giving away his password. But you don't have to screw it up for the rest of us to help out the idiot.

--
excitingthingstodo.blogspot.com

Re:Good idea to ban common passwords by BlindMaster · 2011-07-15 08:14 · Score: 1

I agree with ATM card or physical key, since you are aware of these things being taken away.
However, password can be different. You never know MITM attack.
I really hate changing my password every 6 months (my company policy is every 30 days, 15 different passwords). And the only way to remember my password to start my workstation is to have a pattern (sigh, add a different number once in a while), which is not very secure, I believe.
Re:Good idea to ban common passwords by JetScootr · 2011-07-15 08:56 · Score: 1

try this: use several unrelated dictionary words, strip the vowels, and make it look like math: prpl=rckt*grnt (purple = rocket * granite) or some similar small set of rules. passowrds are secure, you only have to remember three words, and once you've memorized the simple rules, you can even write down the three words without compromising the real password. You also get longer paswords (14 chars is current recommendation).

--
Pavlov wouldn't be so famous if he'd used a can opener instead of a bell.
Re:Good idea to ban common passwords by simishag · 2011-07-15 11:09 · Score: 1

I never understood the reasoning behind the time based password change. No one expects people to get a new key every six months for their home lock. No one expects someone to get a new ATM card every 6 months.
Physical tokens like keys don't require such frequent replacement because (in general) they are difficult to compromise without alerting the holder. Someone has to actually steal your key and take it to the hardware store without you noticing. Passwords, on the other hand, can be shoulder surfed, socially engineered, stolen with malware, stored in plain text in the database, shared with someone else, etc., and the user may have no clue his password is compromised. Also, if someone steals your key and robs your house, and there was no sign of forced entry, you probably would change the locks. But someone with your password could log in as you without you noticing for... well, maybe forever, depending on the system. I agree it can be overdone, but it is a good security practice and there is some logic behind it.
Re:Good idea to ban common passwords by LongearedBat · 2011-07-15 17:28 · Score: 1

People seldom try to open your locks without you finding out. And when they do manage to open a lock, you likely will change it pretty promptly.
People may try to crack your password quite often without you finding out. And when they do manage to crack your password, you still don't always find out.
Re:Good idea to ban common passwords by gurps_npc · 2011-07-18 04:45 · Score: 1

You have a good argument ....
for listing how many times in the past 24 hours someone tried to log in.
You have a crappy argument for requiring people to change their password.
Design the system around human limitations, don't force humans to do work that a computer does better.

--
excitingthingstodo.blogspot.com
Re:Good idea to ban common passwords by gurps_npc · 2011-07-18 04:48 · Score: 1

As I said above (in response to another poster), this means that when you log in, it should show you when you last logged in and how many times over the past day/week.
Your argument is to alert the owner, not to force the owner to do more make-work.

--
excitingthingstodo.blogspot.com
Re:Good idea to ban common passwords by gurps_npc · 2011-07-18 04:50 · Score: 1

As I said above (in response to another poster), this means that when you log in, it should show you when you last logged in and how many attempts were made over the past day/week.
Your argument is to alert the owner, not to force the owner to do more make-work.

--
excitingthingstodo.blogspot.com
Re:Good idea to ban common passwords by simishag · 2011-07-18 14:32 · Score: 1

Only the most paranoid can remember if they last logged in at 8:15 or 8:25. It's not a credible method of deterring casual logins when the attacker already has the login info. Also, some form factors don't provide a simple means of returning additional information upon a successful login. Think of a Web service where the username and password are included in the request. You'll get a success or failure response and that's it. Even if the service returns more detail, there isn't always a sensible way to alert the actual user, other than denying access on a failure.

Re:Wait, what?! by KarrdeSW · 2011-07-15 07:23 · Score: 1

Ilove3cats

Re:What if by Em+Adespoton · 2011-07-15 07:24 · Score: 1

well, you just have to check and see if "ireallylovecats" is on the blacklist. If it is, try "ireallyreallylovecats." Rinse and repeat (not the cats).

Re:What if by Em+Adespoton · 2011-07-15 07:26 · Score: 1

Is it just me, or does that graph look an awful lot like a fish without a head?

Re:I am not using hotmail, but maybe my friend is. by PickyH3D · 2011-07-15 07:31 · Score: 1

I want to be able to report that I receive spam from one of their users WITHOUT having to create an account on their system.

The principle of the idea is sound, but the implications of them being--ironically--spammed to hide real problems is probably not appealing to them.

I believe quite a number of them is not hacked by bruteforcing the password

This is almost certainly true, but the features simply came out at the same time due to their relationship, and having your password brute forced is not a requirement to having your account flagged by your friend.

Re:What if by Rik+Sweeney · 2011-07-15 07:36 · Score: 1

What if you really love cats?

Oh please, no one loves cats more than this girl

http://youtu.be/mTTwcCVajAc

--
Summation 2

0000 by Toe,+The · 2011-07-15 08:01 · Score: 1

Except in this scene (in Spaceballs), I think the password is: 0000.

That's what I use for everything.

Re:0000 by Lanteran · 2011-07-15 15:06 · Score: 1

No, it was 12345.

--
"People don't want to learn linux" hasn't been a valid excuse since '03.
Re:0000 by Toe,+The · 2011-07-16 01:06 · Score: 1

Woah. I guess it's been too long since I've seen that movie.
http://www.youtube.com/watch?v=WzEz-SHJbB0
Re:0000 by Lanteran · 2011-07-16 04:33 · Score: 1

Has it been more than a week since you've last seen spaceballs? Then it's been too long since you've last seen spaceballs.

--
"People don't want to learn linux" hasn't been a valid excuse since '03.

Re:Password Recovery vs Google Two Way Auth by BlindMaster · 2011-07-15 08:08 · Score: 1

How would you expect to `reset your password` for your email, while the validation process requires you login to your email account?
How do you envision to reset your password on Hotmail, while the requirement might be for you to login to get the reset password link?

Actually, its good to mention Google's two way authentication here as well.
I know HSBC or some other banks had been using similar way 20 years ago, and with better technologies, Google expands this with an app on Android phone (it works on my Android, never had an iPhone).

Re:What if by Toe,+The · 2011-07-15 08:17 · Score: 2

You can create a 100% secure password:
il0v3c4ts

I use this technique all the time. Usually I just use the name of the service, like bankofamerica, and change Es to 3s, etc. Do you get it? An E and a 3 look kinda the same... but backwards!!! Brilliant!

This is totally bulletproof. No hackers have ever heard of this amazing technique. Everyone should use it.

So does anyone think this is a good idea? by jader3rd · 2011-07-15 08:30 · Score: 1

Personally I think it's a good idea. I'm glad Hotmail is implementing this feature. I think it makes the internet as a whole a safer place. What's different about this is that most security advances center around the system; this centers around the fact that Hotmail is a small part of their users lives. This doesn't make Hotmail less hackable in any way, but it does (or is at least trying to) protect the user from having their reputation (is spam being sent from this account) hijacked when another service gets cracked, and the users shared password is comprimised.

Re:Password Recovery vs Google Two Way Auth by glwtta · 2011-07-15 08:31 · Score: 1

Email providers often ask for a secondary email when you sign up, just for this purpose, some services allow you to change it "in-place" (ie, answer a few questions, type in the new password - not terribly secure, of course), some use SMS (I quite like that option).

With banks, you typically have to call them, which is fine - it's not something yo have to do all that often.

Speaking of HSBC, they have this gimmick where you have two passwords, and one of them you have to enter by clicking letters on a little javascript keyboard (instead of typing) - I hate that thing, pointless security theater, and I always forget the second password.

--
sic transit gloria mundi

epidemic by gibbson · 2011-07-15 08:50 · Score: 1

Won't this just cause new common passwords to arise?

bout damn time by JetScootr · 2011-07-15 08:51 · Score: 1

Approx 20 years ago I wrote code for a system at work to do this, list was 100's of possible, including acronyms from work, userids and real names, stupid stuff like variations of 'password', etc. We had to do it cuz the customer (nasa) considered it "old hat, everyone else is doing this, why aren't we?"

--
Pavlov wouldn't be so famous if he'd used a can opener instead of a bell.

Re:Password Recovery vs Google Two Way Auth by BlindMaster · 2011-07-15 08:52 · Score: 1

The Google Two Way Authentication is similar the the SMS solution that you mentioned.
As for HSBC 20 years ago (not Internet era yet, but using modem to call into their server), which generates a second password for your next session.

Re:Wait, what?! by RMingin · 2011-07-15 08:53 · Score: 1

I less than three cats!

--
The preceding comment is my own, and in no way construes an opinon of the Emperor of Mankind.

Abuse by Gripp · 2011-07-15 09:01 · Score: 1

i can't imagine that the "my friend has been hacked" button will last. I would imagine that the hackers would want to flood that button to obscure the real attacks. and it wouldn't be that hard to script....

This is intolerable. by Estanislao+Mart�nez · 2011-07-15 09:01 · Score: 2

I'm sick of having to remember so many complicated passwords. Now that Hotmail is going to force me to change my password to something I can't remember, I'm just going to have to migrate to another email company. Hopefully I can get the same user name part as I have now (ron_damon).

--

Are you adequate?

Re:What if by LordLimecat · 2011-07-15 09:05 · Score: 1

Its a heck of an improvement over lowercase alpha-only passwords.

Re:What if by Deathlizard · 2011-07-15 09:16 · Score: 1

they'll just add another word to it. such as ilovelasercats

--
In Soviet Russia, Trojan exploits YOU!

Re:What if by burning-toast · 2011-07-15 09:18 · Score: 1

Given the hash in a common format, applications like LophtCrack could take this out in about 20 minutes or less... We won't even start with how fast rainbow tables or brute force could whip through it at a length of only 9 characters and only using alpha-numerics.

There is even a specific option to slightly increase the cracking time by checking for letter - number - symbol substitution which it will do before attempting brute force checking.

Not really any more secure at all. Sorry. I used to use Lopht on a network I administered to check for passwords this weak. And without fail they would take at most a couple of hours to find.

Re:What if by burning-toast · 2011-07-15 09:32 · Score: 1

Ok, I give myself the "whoosh" of the day award. Carry on...

Re:What if by Quirkz · 2011-07-15 09:45 · Score: 1

Or change it to: icanhazpassword

--
The Quirkz Handbook of Self-Improvement for People Who Are Already Pretty Okay

Re:Is there a list of the banned passwords? by dougisfunny · 2011-07-15 09:55 · Score: 1

I don't think you're clear on what brute force means.

--
This is not the funny you're looking for.

My Password Won't be Blocked Under That Rule! by Pauldow · 2011-07-15 10:25 · Score: 3, Funny

I've been using 8 asterisks for passwords so I can see what I'm typing.

Re:What if by berzerke · 2011-07-15 10:28 · Score: 1

Sure, with the hashes you can break the passwords quickly, but that requires you first have the hashes. Now think about attacking over the web and brute forcing it. Let's assume their brain dead and allow you to try all day long. How fast can you try passwords? Remember, you have to consider not only your connection speed, but their speed and the rate their server can answer.

I recently tested hydra on a full duplex 100Mbit network with just two computers on it, one being an ssh server and the other the attacker. The best speed I could sustain was around 220 tries/min. Assuming a 6 character password, lowercase only (English), if an attacker tried for 30 days non-stop and knew the character set, and knew it was 6 characters long, their chance of guessing the password would be (6^26/220/60/24)*30/(6^26) = 0.01%

Keep in mind, out of some 30 odd real life attacks against an ssh server I've got data on, the fastest attack I've seen is about 150 tries/min and that attack lasted less than 4 minutes. Obviously, if you use a dictionary attack and a dictionary password, the chance of brute forcing it jumps dramatically. But the actual data I have shows most usernames are tried only 1-3 times (depending on the attack) before the attacker moves on to the next account.

But the fact remains, it's not web brute force attacks that need to be feared. It's a server compromise where the hashes are compromised that is to be feared. And with Amazon's GPU clusters available for rent, the best hash can be brute forced quickly and cheaply.

Hotmail's changes are like the TSA. Lots of noise, inconvenience, and expense, but little to no real security improvement.

No need to keep track of a "list" by TimTucker · 2011-07-15 10:34 · Score: 1

I'd considered this sort of thing a while back -- there's really no need to use a set list of passwords.

Assuming that the passwords are being hashed, you can have a lookup table where you store:
(Password hash) + (Current # of accounts using that hash)

By setting a threshold for the ratio of (Current # of accounts using a hash) to (Total # of accounts), you can reasonably control the average entropy of passwords in the system.

For example, if you have 100,000 users in a system and set a threshold of 2%, the system would stop allowing anyone else to use that password.

Would be an interesting experiment to see what ratio comes up with the best balance between being secure vs. being too annoying to users.

The big downside of that type of dynamic system is that for low numbers of users, it may become easier to brute force which passwords are in use by iterating through the "change password" process. (Setting a limit on how many times an account can change their password in a given day would help slightly, but might not do much to stop a distributed attack)

In the case of Hotmail (or any other large provider), they're already starting with a large data set, so they'd be able to avoid that issue.

Better password manager needed by Chemisor · 2011-07-15 11:08 · Score: 1

People need to use the browser's password manager to avoid remembering or entering any passwords. There is no reason to keep it in your head when your computer is perfectly capable of doing it.

The problem with the current implementation is that you still have to enter the master password every time you start the browser, which leads most people to just not set one, which leads to the passwords being stored on the disk unencrypted and easily stolen.

The solution we need is to integrate authentication for the password manager with the login process. Store the passwords in an encrypted file, with the account password as the key. A password daemon, like ssh-agent, running as root can securely load and decrypt your password file at login time. It will remain unaccessible except through a specific interface. The interface can authenticate the calling application by using socket credentials passing and allow the user to explicitly let the firefox password manager (which will have to be a separate process and executable for this purpose) access the passwords.

This way the passwords are not accessible to any remote threat and are encrypted on disk to thwart any local threats. The user never has to enter any passwords except at login. Convenience and security.

Re:Better password manager needed by Red_Chaos1 · 2011-07-15 13:33 · Score: 1

As I noted above, the flaw in this is that not all sites use login fields that Firefox can capture. Imageshack is but one example of such a site.
Re:Better password manager needed by ghyspran · 2011-07-15 13:40 · Score: 1

You get that automatically if you have home directory encryption enabled, which both Ubuntu and OSX support out of the box in the install process. Then it doesn't matter what is stored on your disk in plaintext because it all gets automatically encrypted and decrypted when you log out.
Re:Better password manager needed by egranlund · 2011-07-15 18:16 · Score: 1

People need to use the browser's password manager to avoid remembering or entering any passwords. There is no reason to keep it in your head when your computer is perfectly capable of doing it.
The problem with the current implementation is that you still have to enter the master password every time you start the browser, which leads most people to just not set one, which leads to the passwords being stored on the disk unencrypted and easily stolen.
The solution we need is to integrate authentication for the password manager with the login process. Store the passwords in an encrypted file, with the account password as the key. A password daemon, like ssh-agent, running as root can securely load and decrypt your password file at login time. It will remain unaccessible except through a specific interface. The interface can authenticate the calling application by using socket credentials passing and allow the user to explicitly let the firefox password manager (which will have to be a separate process and executable for this purpose) access the passwords.
This way the passwords are not accessible to any remote threat and are encrypted on disk to thwart any local threats. The user never has to enter any passwords except at login. Convenience and security.
They already have this - it's called Keychain on Mac OS X
Re:Better password manager needed by Chemisor · 2011-07-16 00:51 · Score: 1

You get that automatically if you have home directory encryption enabled
No, you don't. While you are logged in, your password file will be decrypted and visible to anybody who wants to read it, like a malware app. Home directory encryption is there to protect against offline attacks only, when your hard drives are stolen. To protect against malware running as you the password file must not be accessible to you.

Perhaps... by Red_Chaos1 · 2011-07-15 11:14 · Score: 1

...we should add basic security to the curriculum at schools? I'm sure I'll be parroting what others have said already, but all password systems need to allow letters (case mattering), numbers, and special characters. Further I think they should require them. Length limits are good, and 8 is a decent starting point. Obvious pass words should be blacklisted as being done here. Perhaps implement a check against other user info like birth-date and such to refuse passwords involving 2 and 4 year birth year dates, etc.

Making password management easier for folks without it being a program they have to buy or spend a lot on will go a long way too. Being able to make one really long random strong password and have it applied to all websites would make things easier for the average user. Obviously they could then protect that with only one other password which they would need to memorize. Of course a keylogger could cause a problem there, but that's an issue no matter what.

At least with a central program, if a system was found to be rooted, once cleared the program could be used to push out a new password for all accounts, with a new master password for the program. No idea how feasible this would be though. First have to get all websites on board with decent password systems. Still far too many out there that restrict to text/digits only passwords, which is part of the problem. Especially when some of these sites are banks. Would also need sites to stop using login fields that a browser or other software cannot detect. That doesn't stop a keylogger, and only makes logins more of a PITA for the user.

Probably overlaps with Twitter's list by Leemeng · 2011-07-15 11:46 · Score: 1

Probably overlaps with:
Twitter's List Of 370 Banned Passwords
http://www.businessinsider.com/twitters-list-of-370-banned-passwords-2009-12

Anyone have the actual Hotmail list?

Too many rules by jklovanc · 2011-07-15 11:59 · Score: 1

For every rule one adds to the creation of passwords one decreases the number of possibilities. For example, if an 8 character password that must be letters and numbers you are removing 52^8 all character words and 10^8 all digit words. As the number of rules get larger the number of possibilities get smaller. I agree there should be a short list of banned passwords but if the list is too big it just helps cracking.

New common passwords by KMSelf · 2011-07-15 17:27 · Score: 1

That's possible.

Any dictionary of "common passwords" is going to have to be adaptive.

But the thing is, if you look at lists of common passwords, and of how many accounts can be compromised by them, the really common ones are really common.

Hotmail have taken a long-overdue step here. I'd love to see all major online service providers follow suit, though if we could just get major email providers (Google, Hotmail, Apple, Yahoo, AOL), and Facebook (used for single sign-on), we'd be ahead of the game.

There are still myriad problems with password recovery features (especially in a world of "free" online services which aren't tied to payments, a payment/credit card account, or billing address).

And there's the fundamental problem that most user-based networks are far more interested in increasing the number of users, not in boosting security. Security provisions slow sign-ups, and are fundamentally at odds with increasing userbase.

--

What part of "gestalt" don't you understand?

Re:What if by Antony-Kyre · 2011-07-17 21:42 · Score: 1

I am glad you mentioned that xkcd. It's funny, and quite possibly true. I don't know why someone marked you down as a troll. If anything, it may be off-topic.

Stop babysitting the users by wye43 · 2011-07-18 02:02 · Score: 1

You assume incorrectly that the user cares about the security of his account always.

I myself create occasionally accounts that I really don't care about them, I just need them for temporary means. In such use cases, a thousand rules and fields to fill are just pointless. And BTW, I always thought the "mystery question/answer" was the most stupid security measure ever invented, even for my main accounts.

Warn the user: YES. Ban the simple or common passwords: NO.

Also, a lot of people here on Slashdot needs to drop this high-and-mighty attitude regarding the complexity of the passwords. They are not really solving the real security issues, its mostly a brag issue: "Oh look, that guy just typed something like 25 characters for his password, he must be so awesome!".

Missing the bigger question... by Vrtigo1 · 2011-07-20 09:14 · Score: 1

I.E. how Microsoft is actually doing this password analysis, because we would presume that they're smart enough not to store them in clear text so anonymous/lulzsec/etc can come steal them. I wouldn't be surprised if they just popped themselves up on the radar of hacker groups, "Hey guys, M$ must be storing about 50 million passwords in clear text!!1" Certainly, you can compare hashes to get a count of identical passwords, but then how do you know what those passwords actually are in order to ban them?

Slashdot Mirror

Hotmail To Ban Common Passwords

96 of 140 comments (clear)