Fedora's invisible passwords and visible squabbles [LWN.net]

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 7:37 UTC (Thu) by MortenSickel (subscriber, #3238)
Parent article: Fedora's invisible passwords and visible squabbles

"Hiding the password as you type doesn't actually do anything for security, as anyone watching your monitor could just watch your keyboard instead. "
Please tell me this is a fake quote! "as a person who has trained reading what someone types by watching the keyboard and being situated with a clear view of the keyboard culd just read your keyboard instead." would make sense.

to post comments

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 10:04 UTC (Thu) by hummassa (guest, #307) [Link] (16 responses)

for a value of "training" = "a couple of hours", maybe. Really, unless you are a star typist or your password is really long or complex, anyone watching your keyboard can read what you typed.

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 12:45 UTC (Thu) by drag (guest, #31333) [Link] (12 responses)

Or they could just use their smartphone to record you.

Really though the * password thing survives mostly as just a convention rather than any sort of rational thought process. It's not done because it actually improves security, but because it's always been done and it probably has something to do with security. Lots of time it make sense, but other times it doesn't.

The most important thing is to use secure passwords and hiding passwords from view just means that it makes that much more harder to use good passwords.

At work I would hate to have my passwords visible because it's busy and people are always wondering around. It's important to maintain some baseline security policy in that sort of situation.

At home I would LOVE to have my passwords visible because I use long passwords and it's irritating to have a typo and re-type in the password 4 or 5 times and get locked out of a account.

Locking accounts on bad passwords, however, is just idiotic and needs to go away. Whoever thinks that is a great idea needs a severe clubbing with a clue bat.

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 13:27 UTC (Thu) by Funcan (guest, #44209) [Link] (4 responses)

Locking an account on /enough/ bad passwords makes perfect sense, otherwise dumb brute forcing starts to become too easy - assuming you can extract a list of login names from somewhere, trying a couple of hundred most common passwords on all of them has a good chance of getting a few hits (birthday paradox bites you in the ass).

If you allow complex passwords and have reasonably well educated users, then locking after 10 or 20 wrong attempts, rather than 3, might start to make sense. Locking for a sort time rather than indefinitely might start to make sense too. Fail2ban short term IP blocks might also make sense too

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 15:18 UTC (Thu) by apoelstra (subscriber, #75205) [Link] (3 responses)

> If you allow complex passwords and have reasonably well educated users, then locking after 10 or 20 wrong attempts, rather than 3, might start to make sense. Locking for a sort time rather than indefinitely might start to make sense too. Fail2ban short term IP blocks might also make sense too

If you had said 100 or 200 attempts, I'd agree with you. No human is going to accidentally mess up a password that many times, any bad guy who can guess the password in fewer tries knows too much anyway (you already have compromised security), and brute forcing is completely blocked.

Alternately, blocking unilaterally for 15 or 30 seconds after every bad attempt would also prevent brute-forcing, as well as be extremely irritating to human bad guys.

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 16:36 UTC (Thu) by drag (guest, #31333) [Link]

All the difference between have 3 tries and 200 tries is that it takes a attacker a few seconds longer to lock out all the users and administrators. ;)

Fedora's invisible passwords and visible squabbles

Posted May 15, 2013 14:14 UTC (Wed) by hummassa (guest, #307) [Link] (1 responses)

Apple does the right thing with respect to this: throttle exponentially against the number of tries. 10s, 30s, 1.5min, 4.5min, 13.5min, 40.5min and so on.

Fedora's invisible passwords and visible squabbles

Posted May 16, 2013 13:21 UTC (Thu) by callegar (guest, #16148) [Link]

No, not at all. It is quite irritating when you leave your ipad around to see that someone had fun in locking it for almost 15'.

Really, this does not make any sense. To avoid brute force attacks a few seconds are more than enough: 100000 trials * 36 sec = 3600000 sec = 3600h = half a year > average time between recommended password changes.

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 15:41 UTC (Thu) by mitr (subscriber, #31599) [Link] (6 responses)

I think it's exactly the other way around: systems should lock users out, at least for some time, on incorrect attempts; if they do, the passwords can be much shorter and easier to enter.

This is especially applicable to web applications, where every log in attempt is "online" and the lockout policy can be consistently enforced.

For passphrases that protect encrypted data at rest (e.g. hard disk encryption passphrases) or other systems that allow offline password cracking, the password does need to be long - however hard disk encryption is pretty much the primary such case, and even in this case a clever combination of hardware + software (e.g. a TPM-like device storing the actual key, that can lock the user out) might allow us to use short passwords.

(Note that long passwords are not necessary in web applications to protect against rogue administrators of the web application running an offline dictionary attack - the rogue administrators can just modify the web application to log the passwords in plaintext, so password length does not matter for protection against rogue administrators. It only protects against password guessing by third parties (and against people seeing and remembering a short password).

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 16:09 UTC (Thu) by andresfreund (subscriber, #69562) [Link] (2 responses)

> I think it's exactly the other way around: systems should lock users out, at least for some time, on incorrect attempts; if they do, the passwords can be much shorter and easier to enter.

> This is especially applicable to web applications, where every log in attempt is "online" and the lockout policy can be consistently enforced.

Making it extremely easy to lock somebody out of their account. Pissed about somebody? Enter 10 times the wrong password on their email account's web interface. In contrast to protecting my account with a good password I can't do anything to protect my account to being temporarily blocked in this case.

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 17:32 UTC (Thu) by mitr (subscriber, #31599) [Link] (1 responses)

Teaching the lockout logic about existence of IP addresses (which more or less can't be forged with TCP), to be smart about treating attacks from a single IP address / small IP block / botnets different, and to alert human administrators about unusal cases should not be that hard.

It would be nice if every application didn't have to invent this from scratch, sure - are there any libraries that can already do this?

Fedora's invisible passwords and visible squabbles

Posted May 10, 2013 10:18 UTC (Fri) by k8to (guest, #15413) [Link]

Well when the implementation involves logfile scraping (common) then you sure can forge IP addresses.

just log in as the username "jrodman]: 1.2.3.4" or similar.

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 16:34 UTC (Thu) by drag (guest, #31333) [Link]

> I think it's exactly the other way around: systems should lock users out, at least for some time, on incorrect attempts; if they do, the passwords can be much shorter and easier to enter.

At any place I worked at that had such password policies I could lock out EVERYBODY in the entire corporation with a simple shell script.

How would you like it if everybody got locked out of their accounts? CEO, IT, business, etc etc. Every administrator, every user.. all at the same time? Say... right when everybody gets in in the morning. Something like that can easily cost a business tens of thousands of dollars.

It is effectively building a denial of service vulnerability into your password policies.

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 17:58 UTC (Thu) by intgr (subscriber, #39733) [Link] (1 responses)

> I think it's exactly the other way around: systems should lock users out, at least for some time, on incorrect attempts; if they do, the passwords can be much shorter and easier to enter.

I think the most sensible thing to do is requiring a CAPTCHA after a few wrong attempts. It will keep out most bots and slow down human guessers, while just being a small hassle for legitimate users.

Fedora's invisible passwords and visible squabbles

Posted May 13, 2013 8:17 UTC (Mon) by micka (subscriber, #38720) [Link]

> while just being a small hassle for legitimate users.

A small hassle ? This things that consistently proves me that I am a bot ?

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 12:45 UTC (Thu) by pboddie (guest, #50784) [Link]

Well, what this change apparently does is to require administrators to tell other people to leave the room, rather than not stand immediately behind them, when they're setting up a system. Maybe administrators who had any unprivileged users in the room when previously setting up systems will now be told that they were "doing it all wrong".

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 14:33 UTC (Thu) by AndreE (guest, #60148) [Link] (1 responses)

It's much easier to notice someone with a camera pointed at your keyboard than someone glancing at your screen

Fedora's invisible passwords and visible squabbles

Posted May 10, 2013 3:29 UTC (Fri) by faramir (subscriber, #2327) [Link]

That was true in the BGG era. Now that we are in the AGG (after google glasses) era, not so much.