Fedora's invisible passwords and visible squabbles [LWN.net]

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 15:07 UTC (Thu) by Baylink (guest, #755)
Parent article: Fedora's invisible passwords and visible squabbles

There are two separate questions here, as far as I can see:

Is a change in password-entry-handling warranted? And is Anaconda suficiently "core" to Fedora that that question should drive or be driven by a distribution-wide policy, as opposed to being a "preserve the desires of the package maintainers" issue?

My inclination on the latter is "yes", though admittedly, I haven't used Anaconda since RH8; you have no choice about the installer, the distribution release manager picks that for you; I can't think of anything else -- even the kernel, about which you sometimes get a choice -- that is so core to a distribution as its installer package. That being the case, I don't think it at all unreasonable to construe that as a core package, and expect that policies it sets are distribution wide policies, rather than the whims of a specific package maintainer.

The more fundamental question, though, is the first: is a change in default password-entry visibility policy justified? It is my understanding that one of the driving forces behind this change was an opinion put forth by security consultant Bruce Schneier.

Bruce has recanted that opinion in later writings, so to the extent that it was such a driving force, it's clearly time to reconsider. That said, it's substantially easier -- an order of magnitude, if not two -- to shoulder-surf off a display (think "binoculars", if not "HD security webcams" "Freeze! And Enhance!" :-).

I personally tend to like to check that box that says "show my password". But *I want the box*; *I* know if someone is near me, or if my monitor is visible from useful angles; the computer... so doesn't.

IMO: The box should be there, and by default, it should be unchecked. Those who note that asterisks are bad are also correct; knowing the length of the password substantially reduces the effort to crack it.

It's possible such a single-use password is not the low-hanging fruit, but we do know what makes it *less* secure, and there's no sense volunteering to do those things.

to post comments

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 19:04 UTC (Thu) by mathstuf (subscriber, #69389) [Link] (1 responses)

> Those who note that asterisks are bad are also correct; knowing the length of the password substantially reduces the effort to crack it.

Knowing that there is a password entered in the box is nice to know however. Why not make the password field 2–3 characters wide and show the asterisks/dots/whatever (like the gnome-keyring dialog)? I believe KDE also had the option to show 3 asterisks for each character (to help overflow a larger box and that you quickly break the count-at-a-glance limit).

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 19:19 UTC (Thu) by Baylink (guest, #755) [Link]

The 3-asterisks thing is probably the most useful compromise, though it's hard to see them move; I would use three *different* characters, like:

*#%

That would make it much easier to see the motion as each key is pressed.

Though, as I say, I tend to just prefer double clicking in the "show password" checkbox; the quick flash is enough, generally, for me to confirm I typed it right.

Password length

Posted May 16, 2013 12:56 UTC (Thu) by robbe (guest, #16131) [Link] (2 responses)

> Those who note that asterisks are bad are also correct; knowing the length
> of the password substantially reduces the effort to crack it.

Depends on your definition of "substantial". For the cases I computed, and that I consider relevant, the effort reduction is not even half. Not what I would call a good safety margin.

The more important advantage an attacker gains by seeing the (approximate) password length is being able to weed out "too hard" passwords, and just attack accounts with easier ones.

Password length

Posted May 16, 2013 14:20 UTC (Thu) by robbe (guest, #16131) [Link]

Oops, I miscalculated. The added effort for the attacker if she does not know the password length asymptotically approaches (b+1)/b, where b is the size of the character space. Worst case for the attacker is a numeric password, which adds only a measly 11 % of effort. Lower-alpha gives 4 % more, etc.

Password length

Posted May 16, 2013 14:46 UTC (Thu) by anselm (subscriber, #2796) [Link]

Way back when, VAX/VMS used to output either one asterisk or three for every password key pressed, on a random basis. This had the advantage of letting the user know that their keypress had registered, without giving bystanders a good clue how long the password in question actually was.