leroy00
Level: Master Delver

Rank Points: 155
Registered: 09-30-2003
IP: Logged

Yesterday I tried to send an email through the profile page of a forum member. I got an error screen with the following message:
Your password needs to have between 6 and 15 characters. It needs at least one uppercase letter, one lowercase letter, and one digit.(Error - No uppercase)
which is true, but obviously the password works for posting, editing profile, etc.

-leroy

____________________________
You can hear happiness staggering on down the street -- footless, dressed in red.
-Jimi Hendrix, "The Wind Cries Mary"

Schik
Level: Legendary Smitemaster

Rank Points: 5413
Registered: 02-04-2003
IP: Logged

A little while ago, we changed the password policy to require uppercase and lowercase letters and digits. We thought about whether or not we should force all existing users to change their passwords or not, and at least for the time being, decided not to.

A couple people have told me the about the same thing you're seeing. It was unintentional, but I'm going to leave it as-is. Think of it as a gentle prod to update your password to something that conforms to our new password policy.

In fact, you've brought up an oversight on my part - I intended that editing your profile would not work with an old-style password, again to urge people to update their passwords. I'll have to fix that.

____________________________
The greatness of a nation and its moral progress can be judged by the way it treats its animals.
--Mahatma Gandhi

eytanz
Level: Smitemaster

Rank Points: 2708
Registered: 02-05-2003
IP: Logged

Beh. Password policies suck. They do nothing but reduce the possible search-space for possible passwords making life easier for hackers, not harder.

____________________________
I got my avatar back! Yay!

Schik
Level: Legendary Smitemaster

Rank Points: 5413
Registered: 02-04-2003
IP: Logged

eytanz wrote:
They do nothing but reduce the possible search-space for possible passwords making life easier for hackers, not harder.

Not true. At all. Actually, making the policy more strict would be even better. Passwords are generally going to be cracked by brute force dictionary attacks. If your password is "password", it's going to be cracked on... oh, about the very first attempt. I'll admit that changing it to "Password1" to fit our policy isn't going to help much, but we're trying to take a small step, as opposed to irritating everyone with random 32 character passwords that change every week.

It's easy to get irritated by password policies when you're just a user, but from the administrator's point of view, they can save a whole lot of time and effort. When someone guesses that Erik's password is "password" and deletes everything on the forum, you might appreciate that more. Or at least *I* will, because I'll be the one cleaning up the mess.

____________________________
The greatness of a nation and its moral progress can be judged by the way it treats its animals.
--Mahatma Gandhi

AlefBet
Level: Smitemaster
Rank Points: 979
Registered: 07-16-2003
IP: Logged

The following are essentially random thoughts about passwords. I tried to organize them into a logical sequence, but it's probably best if each paragraph is read in isolation:

I'm personally not all that worried about my account being compromised because the worst they could do is post as me and delete my messages. Added security for forum members with admin privileges seems appropriate, but I'm not sure that it's necessary for everyone. If many people are like me, this is just one of literally 100+ passwords they use online, and they choose a strong password where it matters (finance passwords and admin passwords), but 100+ strong passwords for accounts no one but the user cares about (and where a compromise would be no big deal anyway) is just not going to happen. Faced with this information management fiasco (of which this forum is just one small part), I would recommend filtering for passwords like "Ab12345".

Increasing the entropy in passwords can generally improve security. I'm of the opinion that the best passwords are generally constructed as mnemonics for long phrases. Dictionary attacks won't work against them, and if the mnemonic is based on the distinctive letters in each word, alphabetic frequency information is less useful. Random passwords that are generated by computer and assigned have a tendency to either be quickly changed to a poor password or forgotten and reset by the admin over and over, so phrase mnemonics are about as close to random passwords as I think a human mind can wrap around.

On the other hand, I'm strongly convinced that policies requiring passwords to be changed every so often have a marked tendency to decrease security overall. If I have to pick only one password, I'm more inclined to come up with something random-looking, but significant to me, and memorizing it so I can use it indefinitely. But if I know I can only use it for a month or so, I am psychologically forced to choose something as easy as I can get away with just so I don't forget it. (Even if I write them down, I'll still try to pick something easy since writing down gibberish just feels like I'm going to make a copying error with no clues as to how to fix it once I discover the problem.)

So I guess I'm saying that even if it's frustrating for me (an ordinary forum user) to have to change one of the many passwords I use online to something more secure, I'll be okay with that since it's just once. Also, I'm glad you're not going to a periodical password change policy since, in my view, it would only add aggravation and reduce security.

____________________________
I was charged with conspiracy to commit jay-walking, and accessory to changing lanes without signaling after the fact .

++Adam H. Peterson

ErikH2000
Level: Legendary Smitemaster

Rank Points: 2794
Registered: 02-04-2003
IP: Logged

A few things...

We have to be careful about saying how our security is handled here (a public area). It can end up giving ideas to hackers.

The thing that prompted the password enforcement rules was new pirating activity for JtRH. We anticipated that people with illegal copies would come along and start scamming their way onto CaravelNet. I've seen a few incidents like that so far, so I think we were probably right.

A while back I manually reviewed all the users that had weak passwords and asked them to change them. In the future, we might have something where certain selected users are forced to change their password when they log in. I don't like forcing people to change their passwords, but we might have to do it for a small subset of our users. I'm tempted to give out some examples of the bad passwords people are using to show why the new rules Schik implemented make sense, but... see my first point.

Adam is right that security for the administrator accounts is even more important. We might do something extra there, but if so, it should be discussed privately.

-Erik

____________________________
The Godkiller - Chapter 1 available now on Steam. It's a DROD-like puzzle adventure game.
dev journals | twitch stream | youtube archive (NSFW)

AlefBet
Level: Smitemaster
Rank Points: 979
Registered: 07-16-2003
IP: Logged

Requiring people with weak passwords to change them once is fine by me, especially if they're CaravelNet enabled. I just want to make sure that we don't go for the "change every so often" security fad that many organizations are going for. On average, it only doubles the length of time for a brute force attack to succeed, and that's assuming the short-term passwords are as good as a single long-term password, which I have reason to believe is not true. One strong password for 10 years is (I believe) much more secure than 120 so-so passwords, one per month. So as long as we allow people to keep their strong passwords, it's all good by me. (Not that you really need my approval, of course.)

____________________________
I was charged with conspiracy to commit jay-walking, and accessory to changing lanes without signaling after the fact .

++Adam H. Peterson

larrymurk
Level: Smitemaster

Rank Points: 1916
Registered: 12-09-2004
IP: Logged

After say 3 incorrect password "guesses" can't you suspend the account assuming it is being hacked and have the user reconfirm/change their password. This would easily prevent brute force password hacking.

gamer_extreme_101
Level: Smitemaster

Rank Points: 1939
Registered: 03-07-2004
IP: Logged

Not necessarily "Suspend", but have an email sent out with a link that would "reactivate and clarify" their forum identity would be a good prevention against those kind of attacks. And if they did eventually log in with the correct password, there would be a little screen that says "Your forum account needs reactivation. Please check you email and follow the instructions provided"

____________________________
--That guy with a million different aliases since he doesn't like this name anymore.

eytanz
Level: Smitemaster

Rank Points: 2708
Registered: 02-05-2003
IP: Logged

Suspending people's accounts for incorrect password logins is a really bad idea. You're basically introducing a built-in way to introduce denial-of-service attacks for people. Especially in a forum, where user-names are visible, that means that if I don't like your post, I can get you suspended by just trying to log in a few times. Even if you can reactivate yourself by following an e-mail link or something, this causes inconvenience, and possibly spams the inbox of, people whose only fault was that their password was too difficult to guess in 3 tries.

Essentially, you are punishing the victim, not the offender.

It's much better to try to prevent people from attempting to log in more than 3 times in 1 minute or something. That won't affect normal users, but effectively shut down any automated system.

____________________________
I got my avatar back! Yay!

---

[Last edited by eytanz at 06-30-2005 08:53 PM]

rowrow
Level: Smiter
Rank Points: 432
Registered: 08-17-2004
IP: Logged

Why doesn't every user change his password to Hk4/9r*Z ?
This is for Schik incase he forgot

____________________________
B'hakhgra Du S'tra Moth'ness Ti!