Here is the text of the NIST sp800-63b Digital Identity Guidelines.

  • catloaf@lemm.ee
    link
    fedilink
    English
    arrow-up
    59
    ·
    3 months ago

    I hate that anyone has to be told not to truncate passwords. Like even if you haven’t had any training at all, you’d have to be advanced stupid to even come up with that idea in the first place.

    • einlander@lemmy.world
      link
      fedilink
      English
      arrow-up
      24
      ·
      3 months ago

      Microsoft used to do that. I made a password in the late 90’s for a we service and I found out that it truncated my password when they made it after it warned my my password was too long when I tried to log in. It truncated at 16 characters.

      • catloaf@lemm.ee
        link
        fedilink
        English
        arrow-up
        7
        ·
        2 months ago

        The weirdest one I found was a site that would only check to see if what you entered started with the correct password. So if your password was hunter2 and you tried hunter246, it would let you in.

        Which means not only were they storing the password, but they had to go out of their way to use the wrong kind of string comparison.

        • Midnight Wolf@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          2 months ago

          USAA does this. I renentl learned that, when I updated my password a few years back to my personal standard number of characters, everything was good until someone mentioned this fuck-up in a thread. USAA only checks the first… 16? characters. I assume it just discards anything beyond that. Other users say that it warns and doesn’t let you enter more than that during password creation, but it/my pw mgr sure didn’t care, as I have a password several fold that limit. I took out a couple characters from my ‘set’ password, and it still logged in just fine. 16, just fine. 15, error.

          Fucking wild.

      • chiisana@lemmy.chiisana.net
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 months ago

        The LM password hash (predecessor to NTLM) was calculated in two blocks of 7 characters from that truncated 14 characters. Which meant the rainbow table for that is much smaller than necessary and if your password is not 14 characters, then technically part of the hash is much easier to brute force, because the other missing characters are just padded with null.

    • Amanduh@lemm.ee
      link
      fedilink
      English
      arrow-up
      8
      ·
      3 months ago

      Can you elaborate further? Why would someone want to truncate passwords to begin with?

      • essteeyou@lemmy.world
        link
        fedilink
        English
        arrow-up
        23
        ·
        3 months ago

        To save a few megabytes of text in a database somewhere. Likely the same database that gets hacked.

        • orclev@lemmy.world
          link
          fedilink
          English
          arrow-up
          28
          ·
          3 months ago

          Which shouldn’t even matter because passwords are salted and hashed before storing them, so you’re not actually saving anything. At least they better be. If you’re not hashing passwords you’ve got a much bigger problem than low complexity passwords.

          • essteeyou@lemmy.world
            link
            fedilink
            English
            arrow-up
            33
            ·
            3 months ago

            The place that truncates passwords is probably not the place to look for best practices when it comes to security. :-)

            • orclev@lemmy.world
              link
              fedilink
              English
              arrow-up
              6
              arrow-down
              1
              ·
              3 months ago

              Hashing passwords isn’t even best practice at this point, it’s the minimally acceptable standard.

                • pivot_root@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  8
                  ·
                  edit-2
                  3 months ago

                  Use a library. It’s far too easy for developers or project managers to fuck up the minimum requirements for safely storing passwords.

                  But, if you are wanting to do it by hand…

                  • Don’t use a regular hashing algorithm, use a password hashing algorithm
                  • Use a high iteration count to make it too resource-intensive to brute force
                  • Salt the hash to prevent rainbow tables
                  • Salt the hash with something unique to that specific user so identical passwords have different hashes
                  • Laser@feddit.org
                    link
                    fedilink
                    English
                    arrow-up
                    2
                    ·
                    2 months ago

                    Salt the hash with something unique to that specific user so identical passwords have different hashes

                    Isn’t that… the very definition of a Salt? A user-specific known string? Though my understanding is that the salt gets appended to the user-provided password, hashed and then checked against the record, so I wouldn’t say that the hash is salted, but rather the password.

                    Also using a pepper is good practice in addition to a salt, though the latter is more important.

                  • Buddahriffic@lemmy.world
                    link
                    fedilink
                    English
                    arrow-up
                    1
                    ·
                    2 months ago

                    I remember hearing to not layer encryptions or hashes on top of themselves. It didn’t make any sense to me at the time. It was presented as if that weakened the encryption somehow, though wasn’t elaborated on (it was a security focused class, not encryption focused, so didn’t go heavy into the math).

                    Like my thought was, if doing more encryption weakened the encryption that was already there, couldn’t an attacker just do more encryption themselves to reduce entropy?

                    The class was overall good, but this was still a university level CS course and I really wish I had pressed on that bit of “advice” more. Best guess at this point is that I misunderstood what was really being said because it just never made any sense at all to me.

              • frezik@midwest.social
                link
                fedilink
                English
                arrow-up
                2
                arrow-down
                1
                ·
                edit-2
                2 months ago

                Sorta. Not really.

                Key derivation algorithms are still hashes in most practical ways. Though they’re derived directly from block ciphers in most cases, so you could also say they’re encrypted. Even though people say to hash passwords, not encrypt them.

                I find the whole terminology here to be unenlightening. It obscures more than it understands.

                • orclev@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  2 months ago

                  A KDF is not reversible so it’s not encryption (a bad one can be brute forced or have a collision, but that’s different from decrypting it even if the outcome is effectively the same). As long as you’re salting (and ideally peppering) your passwords and the iteration count is sufficiently high, any sufficiently long password will be effectively unrecoverable via any known means (barring a flaw being found in the KDF).

                  The defining characteristic that separates hashing from encryption is that for hashing there is no inverse function that can take the output and one or more extra parameters (secrets, salts, etc.) and produce the original input, unlike with encryption.

                  • frezik@midwest.social
                    link
                    fedilink
                    English
                    arrow-up
                    1
                    ·
                    edit-2
                    2 months ago

                    OK. How do you reconcile that with “Hashing passwords isn’t even the best practice at this point”? Key derivation functions are certainly the recommended approach these days. If they are hashes, then your earlier post is wrong, and if they aren’t hashes, then your next post was wrong.

        • frezik@midwest.social
          link
          fedilink
          English
          arrow-up
          1
          ·
          edit-2
          2 months ago

          Lots of older databases had fixed length fields, and you had to pad it if it was smaller. VARCHAR is a relatively new thing. So it’s not just saving space, but that old databases tended to force the issue.

          Nobody has an excuse today. Even Cobol has variable length strings.