Slashdot Mirror
Microsoft May Ban Your Favorite Password (securityweek.com)
wiredmikey writes from a report via SecurityWeek.Com: Microsoft is taking a step to better protect users by banning the use of weak and commonly-used passwords across its services. Microsoft has announced that it is dynamically banning common passwords from Microsoft Account and Azure Active Directory (AD) system. In addition to banning commonly used passwords to improve user account safety, Microsoft has implemented a feature called smart password lockout, meant to add an extra level of protection when an account is attacked. [Alex Weinert, Group Program Manager of Azure AD Identity Protection team explains in a blog post that] Microsoft is seeing more than 10 million accounts being attacked each day, and that this data is used to dynamically update the list of banned passwords. This list is then used to prevent people from choosing a common or similar password. Microsoft's new feature comes after last week's leak of 117 million LinkedIn credentials.
If you ban common passwords. Then you end up with a new set of common passwords. Going to ban those too?
While not allowing "common" passwords is not the worse idea, in general the more password rules you make, the worse passwords you'll get. In the end people end up writing them on post-it notes...
Doesn't Microsoft own Skype? Cause I was trying to make a Skype account a couple of years ago and tried first concatenating three weird Greek words transliterated to latin. I don't remember which words exactly, in any case, the password was rejected as too weak. Yeah, try cracking something like "poliefkoloskodikos" (aka "veryeasypassword"). It rejected a couple of others as well (it did not give you a specific reason - perhaps it would if I was on a desktop) and in the fourth try accepted something as simple as "river1". How is this kind of policy helped by banning e.g. "password1", that is not the problem.
Oh, my "favorite" password rules are the ones that reduce the search space for potential hackers.
For example, I have one bank account that requires the password to start with a number. I have network security camera that doesn't accept over 8 characters and the list goes on...
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
This is a first. Someone on Slashdot making an argument for weak passwords.
Only the State obtains its revenue by coercion. - Murray Rothbard
"Microsoft has implemented a feature called smart password lockout, meant to add an extra level of protection when an account is attacked"
I've already fallen victim to this one. I had an @live.com email address that I used for things that were guaranteed to spam me. Things that needed a one time authentication and such. Unfortunately I made a typo once while trying to access the account. One typo, on one attempt. I've now been permanently locked out of the account.
They said they just need to verify that it's me, but there's no possible way to do so. They say I can give them a phone number to verify it, but they don't have my phone number on file in the first place. The next option was their account recovery tool, but it requires you tell them who you have sent mail to from the account, as I've only ever received mail in this account, and never sent anything out, I can't do that. I submitted the form anyway, but they tell me that they can't verify that I'm me so they won't unlock the account.
Mostly I can just create another throw away account, but unfortunately another service took this opportunity to try to "re-verify" me by sending an email to this now locked out account, and because I can't get that email, I'm also locked out of the other service.
Of course I should have known better, what idiot uses Microsoft for ANYTHING????
That is essentially what they are doing. But, added to the simple rule based strength measure is a set of current rainbow tables. If they are throwing out the other silly rules, like mixed case, numerals etc and just looking at objectively weak passwords (a password in a rainbow table is objectively weak) then this sounds great.
Protoplasm. Quiet Protoplasm. I like quiet protoplasm.
This will be instantly patched around with either a registry edit or a binary rogue patch available for download.
This is a Microsoft Account / Azure Active Directory, not a local Windows machine user account. Since they're cloud-based services, a local patch won't work.
Your new password is not accepted. Please install Windows 10 and try a new password.
Microsoft bans your favorite passwords, microsoft forces you to update to v 10 even though you said "fuck off", MS does this, MS does that. For chrissake, use something else, another OS!
Slashdot, fix the reply notifications... You won't get away with it...
This doesn't solve much. You just force the armature hackers to use proxies, which makes it more difficult to do forensic analysis. At the same time you prevent that 1/1000 person who is traveling to Russia and needs to access their account. Sounds like a lose-lose situation to me.
Microsoft leads the world in insecure software, so on the 20th anniversary of Windows 95 it's good they're working to help.
On the other hand any time you decrease keyspace by creating arbitrary rules ("Must contain this", "must contain that")
you constrain an otherwise limitless keyspace and make it easier to guess.
I want to wish them well... because it appears they are well-intentioned. Sadly, they are still incompetent.
Want to make stronger passwords? Don't REQUIRE people to use specific parts of the keyspace.
Want to make stronger systems? Don't make your Win95/Win98/WinME/Win2K/WinXP/Vista/7/10 compatible with DOS so people can pwn your users.
"Your password is weak, because 3 Million Users are already using it"
Cool, i found a common one! Lets try to use it on billgates@hotmail.com! Gotcha!
A whole new way to update your wordlists.