Xato (Mark Burnett)

That might be this: https://xato.net/windows-spying-and-a-twitter-rant-19203babb2e7 It's so confusing to disable that a (admittedly self-proclaimed, but still) "security expert" got it wrong several times, and even after that it still continued sending data to Microsoft. It reminds me of the same scummy tricks used by spyware/adware in the past e.g. "do not disable for the best user experience", double-negative wording, etc. I believe it's still (deliberately) really easy to pirate/crack Windows, so I could get the Enterprise edition if I wanted --- but I wouldn't want it even if it was legally free, just like all sorts of other malware and unwanted software.

> Then why let users choose a password at all? Why not just assign them one that they have to write down? Because then anyone who reads what is written down gains full access to the user's data. A password (kept in human memory) plus passphrase (written down) is more secure. I would agree this comes at the cost of convenience, but I think the trade-off is worth it. > Why not generate a 20 character random string? Because it would be a real pain to type each time the user logs in. In this case I don't think the security/convenience trade-off is worth it. > As Colin points out in the top comment, hashing with scrypt will make even mediocre passwords uncrackable. True, but what percentage of users choose poor passwords - not mediocre ones? Scrypt will not be much good if the user chooses a password from the dictionary, or a word that appears in a list of the top 10,000 most common passwords. (Edit: According to Mark Burnett [2] such passwords are chosen by 99.8% of users) > And high-speed cracking is only a problem if the bad guys get your password table. The password + passphrase model also protects users who choose the same password for different online systems. A weakness in some other website (or something more evil [1]) will not compromise the security of my online system. Edit: Low-speed cracking might also be a problem. Mark Burnett says 14% of users have a password from the top 10 password list [2]. [1] http://xkcd.com/792/ [2]…

I have to say that I loved his other post on the TSA's ridiculous password policy... http://xato.net/passwords/worst-password-policy-ever Their policy is: 1. Minimum password length is eight characters. 2. Passwords must contain at least one of each of the following: one alphabetic uppercase, one alphabetic lowercase, one numeric, and one special character. 3. Passwords shall not contain any two identical consecutive characters (example: 22apples, 14588904). 4. Passwords may contain no more than two identical consecutive characters in any position from the previous password. 5. Passwords shall not contain any dictionary word. 6. Passwords shall not contain any proper noun or the name of any person, pet, child, or fictional character. 7. Passwords shall not contain any employee serial number, Social Security number, birth date, phone number, or any information that could be readily guessed about the creator of the password. 8. Passwords shall not contain any simple pattern of letters or numbers, such as "qwerty" or "xyz123". 9. Passwords shall not be any word, noun, or name spelled backwards or appended with a single digit or with a two-digit "year" string, such as 98xyz123. 10. Pass phrases, if used in addition to or instead of passwords, should follow these same guidelines. 11. Passwords shall not be the same as the User 12. Password length will be selected to provide a level of protection commensurate to the value or sensitivity of the resources or data it…

> AFAIK the option to control telemetry was always there for Enterprise Edition. ( ) A lot ( ) All of it https://xato.net/windows-spying-and-a-twitter-rant-19203babb2e7 https://news.ycombinator.com/item?id=12959097

I think the ship of "easily analzed password dumps" has already sailed e.g. https://xato.net/today-i-am-releasing-ten-million-passwords-b6278bbe74… <-- 10 million passwords

Agree, but a collision even for md5 is a relatively rare event. When brute-forcing the bcrypt hash, this would reduce the attempts you would need to try against a given hash, but only by a very small factor. With a reasonable work factor, I would assume it would still make a brute force attack impractical at scale. I didn't do the test, but I'd expect that there wouldn't be more than a handful of collisions for the md5 of the 100m most common passwords. [edit] I actually I just did the test on this 10m password list and no collision https://xato.net/today-i-am-releasing-ten-million-passwords-b6278bbe74…

How did you "avoid" sample bias? How many of the passwords come from databases that were dumped in cleartext or cracked with 100% success? Meaning every account on that system was included in cleartext or 100% of the passwords from a dump were cracked. The reason I ask is that the dataset you analyzed does not make this claim: "Now not all of these passwords are plaintext. Many dumps include passwords in a hashed format that requires you to crack them yourself." https://xato.net/a-glimpse-into-the-world-of-internet-password-dumps-5…

It's from this post: https://xato.net/passwords/more-top-worst-passwords/ Although that's probably a bit out of date now. I might see if there's a newer version.

The way Microsoft Windows parses "Program Files" in the path seems incredible at first: https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilitie… http://xato.net/hardening/the-programexe-problem/ "The problem is that it doesn't know. It just starts at the beginning and tries finding an executable until it finds a match. So in this case, it will try these files every time you run the command: C:\Program.exe C:\Program Files\Internet.exe C:\Program Files\Internet Explorer\iexplore.exe "You might see where I'm going with this: if you place an executable named program.exe in the root directory, it will probably end up running quite a bit. In fact, it will run anytime Windows launches a Program Files executable that does not have quotes around the path." [1] [1] http://www.securityfocus.com/columnists/301

Relevant: "Dear NSA, I Don’t Think You Meant Yottabytes" http://xato.net/privacy/dear-nsa-meant-yottabytes/

4.7% of users have the password password; 8.5% have the passwords password or 123456; 9.8% have the passwords password, 123456 or 12345678; 14% have a password from the top 10 passwords 40% have a password from the top 100 passwords 79% have a password from the top 500 passwords 91% have a password from the top 1000 passwords http://xato.net/passwords/more-top-worst-passwords/

It's using lame as a response to this article: http://xato.net/malware/flame-is-kind-of-lame/

I think it's a reply to this article: http://xato.net/malware/flame-is-kind-of-lame/ (discussed on HN here: http://news.ycombinator.com/item?id=4087914)

Some examples: http://idealab.talkingpointsmemo.com/2012/05/flame-malware-mostly-smok… "The hype surrounding Flame may be partially the result of the ITU" http://www.thetechherald.com/articles/Is-the-hype-surrounding-Flame-bl… "None of the methods of this malware are particularly new." http://xato.net/malware/flame-is-kind-of-lame/ "It’s just not that impressive as far as features go. In fact, 10 years ago it really wouldn’t have been that impressive." Mikko

I'm not a math person either, but here's some fodder for someone who is. Mark Burnett's extensive password collection (which he acknowledges is skewed, because it's largely based on cracked passwords, he only harvests passwords between 3 and 30 chars, etc.). Here's how some of his stats shake out: * Although my list contains about 6 million username/password combos, the list only contains about 1,300,000 unique passwords. * Of those, approximately 300,000 of those passwords are used by more than one person; about 1,000,000 only appear once (and a good portion of those are obviously generated by a computer). * The list of the top 20 passwords rarely changes and 1 out of every 50 people uses one of these passwords. So it's conceivable that 6M unique passwords could cover a very significant portion of a 120M user namespace. Ref: http://xato.net/passwords/how-i-collect-passwords

Character minimums hurt your entropy too. Stripping the entire search space up to nine characters isn't really a good idea. In my opinion it'd be better to just find a list of the top 10K passwords and disallow them. One out of 50 people use one of the top 20 passwords. [0] I'd bet that over half of passwords used are in the top ten thousand. [0]: http://xato.net/passwords/how-i-collect-passwords

Did anyone look at the linked site http://xato.net/passwords/more-top-worst-passwords? I pulled his top 10k list, but it doesn't add up with his analysis. I get that the top 100 passwords only cover 14% of the accounts, not 40%. And the top 1000 passwords only cover 44%, not 91%. These numbers don't change his argument all that much, but I'm curious what I'm missing about the way he calculated his.

According to [1], the 100 most frequently used passwords are used by 40% of people, and the 500 most frequently used passwords are used by 71% of people. So you can increase security for over half of your users simply by disallowing the 200 most commonly used passwords. This set of passwords is small enough to fit in an in-memory list, so you don't even need to use a database for that. I don't think there's much need to check for common passwords at each login, provided that none of your users are allowed to use such passwords in the first place. You might get more security by banning IPs that try more than a few of those common passwords in a short time (it's a useful way to detect brute-force attempts), but in fact you should be banning any IP that generates more than a few failed logins in a short time. [1] http://xato.net/passwords/more-top-worst-passwords/ Another measure I use on my webapps is calculating how many bits of entropy a password contains, and ban anything less than ~40 bits (the threshold depends on the target demographic). An 8-digit number has 10^8 = 26.5 bits of entropy. An 8-char lowercase string has 26^8 = 37.6 bits of entropy (unless it's a common word). A mixed-case 8-char string that also contains numbers has (26+26+10)^8 = 47.6 bits of entropy. This method has the advantage that I don't need to specify annoying rules like "one lowercase, one uppercase, one symbol, etc." Simpler passwords can be allowed if they are long enough, and complex…