Talk:Password

I've removed some information about biometrics from the article as it wasn't really about passwords, I'll be moving it to a new article about user identification. --Imran 00:50, 10 Jan 2004 (UTC)

---

Imran,

You are, strictly, correct. However, password is taken in practice by many of the (non security specialist) user community to be anything which is used as access control. Hence my comments. I was attempting to make the issue of adequacy of access controls explicit, and so to inform the reader on something that is almost always implicitly assumed to be sufficient. Security is an odd thing in that humans characteristically have considerable difficulty in even seeing it (a figure / ground problem I suspect) and when thinking about it, thinking clearly.

My comments were, thus, intended to inform where information was not even suspected to be needed. In a modest sense, of course!

Perhaps a revision of the articles in this area into something like 'access control' which is pointed at by password, biometrics, user identification, ... This would allow some discussion of meta issues not strictly belonging in any of the referencing articles. ??

ww

---

The article said it was "sensible" for the system to give the user a randomly generated password. Please don't write such things. Don't treat the users as pawns that exist to serve the computer system. It is the other way round. Sorry for venting. Been bitten by this attitude more than once in real life.

Anyway the above is just one example of the fact that this article has a non-obvious type of POV: a security-POV. It assumes that the computer security is the most important thing in the world and everything else is secondary. A perfect example is the last paragraph: If even the smallest possibility exists that the password has become known to anyone other than those to whom it 'belongs', it should be considered compromised, and immediately changed. This is obviously never the case in reality, for no-one can expend infinite amounts of resourced in securing computers, and there's always a tradeoff between the level of security you get and users' productivity.

I'm starting to get the feeling that many other security articles also have this POV. It is no more acceptable than other types of POV, and needs to be fixed. -- Arvindn 03:54, 18 Apr 2004 (UTC)

Arvindn, If security is not the point of using passwords, why bother. If you bother to use them at all, then any chance of compromise ... Not clear this is POV at all for anyone using passwords.

As for the 'sensible' comment, you are not the only one to have been bitten by this. VMS (and other operating systems) had/has(?) an auto password generation option. Every single user I had hated it when we required them to use it after 'too many' passwords got loose. That should be read, by the way, as 'we learned of too many'. How many actually got loose was and remains unknown. It was experience speaking there. And the intent was to convey that '...from an ideal security perspective...' etc. Reword as desired to make this clear if the original intent is acceptable. I agree with the bold faced sentiment, and in the VMS experience noted here, was implementing policy from above.

I considering writing a paragraph or two on adequate alternatives to such passwords, but figured that I'd catch flak for being too long winded. Would you think such a para or two would be appropriate?

ww 17:43, 18 Apr 2004 (UTC)

---

IIRC, user rights are determined per UID, and UID is given from a unique username/password combo. On the first UNIX systems (and on some current ones), you may very well have (hopefully) different passwords for the same username, resulting in multiple UIDs.

"Writing down passwords" suggestion

I removed the following text:

A possible way by which one could get away with having one's password written down would be to have it written in a place in a list of false passwords. If one uses a weak password, the list should be full of false week passwords. If one uses a strong passwords, false strong passwords should be used. Thus, instead of having to recall a seemingly random alphanumeric string, one needs only remember what login goes with which password. Numbering the list can help with that. However, this measure should be taken if there is no other way for the user to remember his or her password.

I don't think this is good advice. If you have a list of passwords and non-passwords, you are dramatically reducing the number of passwords that need to be checked. "Never write down a password" is better and more straightforward advice. --Huppybanny 21:54, Aug 16, 2004 (UTC)

I agree with this removal (in fact, I'd planned to do it myself when I came in today...); has any security expert endorsed this idea? — Matt 23:41, 16 Aug 2004 (UTC)

I agree having a list of false passwords does not provide good cover and is not significantly more secure than having the password written down. However, "Never write down a password" is not strictly correct. It depends on your threat model. Peter 03:38, 18 Aug 2004 (UTC)

Indeed; writing down your password can provide better security in many situations. Schneier: "You can't memorize good enough passwords any more, so don't bother. Create long random passwords, and write them down. Store them in your wallet, or in a program like Password Safe. Guard them as you would your cash." (emph mine) [1] (http://www.schneier.com/crypto-gram-0105.html) — Matt 02:29, 19 Aug 2004 (UTC)

Matt, Much as I admire Schneier, I think he's wrong on this. Password Safe (his freeware password database program) is probably very good and all, and 'long random passwords' are certainly good in many respects, but anything which lets the user shuffle off his responsibilities to safeguard these little chunks of key data to something or someone else is wrong psychologically. Even if PSafe were to be perfect, it would still be bad advice. We h sap don't do this sort of stuff very well, and apparently need have our noses rubbed in it more or less continuously to do even as well as we can. Peter's observation above about dependence on your threat model is quite relevant. Missing in Schneier's comment, and exceptionally hard to sensibly apply, but quite relevant. ww 16:34, 20 Aug 2004 (UTC)

Well, it does depend on the threat model. We're happy to carry around keys to things like cars and houses on our person; this is considered an acceptable risk, even though there's a chance the keys could be stolen. In many cases passwords protect less valuable information (think Hotmail). For these cases, why is it a horrendous security failing to write down a password and keep it in your wallet? There's a compelling argument to use an unguessable password stored in your wallet rather than memorise a guessable password. Regardless, getting back to the article, we clearly need to modify statements such as "most observers regard written down passwords as necessarily insecure". — Matt 07:13, 21 Aug 2004 (UTC)

Diceware

Perhaps we should mention diceware (http://www.diceware.com)?

This is the best system for producing a strong password:

• Diceware can provide very strong passwords.
• The password/passphrase is fairly easy to remember.
• The password/passphrase is truly random.
• It is possible to quantize the strength associated with a diceware password.

The only drawback of diceware is that the passwords are quite long. They take longer to type. So it works best for high-security situations (such as protecting a private PGP key).

This is my first time contributing to Wikipedia. I want to make sure I don't step on anyone's toes. Would it be alright if I add a Wiki page about diceware and then add a section to the Password page about diceware?

Go for it, your contribution would be very welcome! I'd encourage you to try and write in a neutral fashion about Diceware (even though it's great) — try and avoid advocacy, if you can. If you need any help on formatting / other queries, I'd be glad to help. — Matt 02:19, 19 Aug 2004 (UTC)

Dcarrera, Always glad to see bravery in those new to WP! I second Matt's comment (Go for it!), and agree with his observation about P(oint)O(f)V(iew). An example of such is "This is the best system for producing a strong password:". A point which would be hard to defend against a claim of POV. Some attention might also be paid to the "...password is truly random." observation. This is a veritable tarpit of confusion, trapping many insufficiently suspicious folk, probably because of the many oh so tempting! (but wrong) ways of thinking about random and randomness.

But on the question of password choice, usability is relevant in real world situations (see Arvindn's comment above), and must be considered lest users rise up and lynch the system admins for making their lives secure, but hell on earth otherwise. When people are involved, sensible security design becomes something of a black art and requires the patience of Job, the knowledge/perspective of a Turing, the ruthlessness of a Bismark, and the luck of the Irish. Since these are seldom available simultaneously, security design in the real world becomes the art of the possible. An infuriating situation for those who like clarity, logic, and finality. Much like herding cats, really.

Don't worry over much about stepping on toes. By getting involved here, you agree not to object, and so did everyone else. It's good for egos which need a little reshaping. Nonetheless, it's an interesting place, and I applaud your concern for others. It's a trait WP needs more of, albeit while being BOLD in editing. If you're interested in security and crypto (not quite the same things, mostly) you might wish to check in at Wikipedia:WikiProject Cryptography to see how things are (somewhat) organized in the WP crypto corner. ww 16:29, 20 Aug 2004 (UTC)

Writing down password - security flaw or not?

It appears that Microsoft's Jesper Johanssen thinks that users should write down passwords. See [2] (http://news.com.com/Microsoft+security+guru+Jot+down+your+passwords/2100-7355_3-5716590.html?tag=nefd.ac). Perhaps we should note this? - Ta bu shi da yu 07:24, 9 Jun 2005 (UTC)

We already do. See "Likelihood that a password can be remembered." Wikipedia had this advice before Mr. Johanssen's remarks. --agr 10:43, 9 Jun 2005 (UTC)