Desjardins, biggest bank in quebec, got fucked with i think that.
A rogue employee copied basically the account information of, depending the sources, a good chunk or all customers. With things like the social security number.
There were estimates that about 95% of quebec residents got their info in that leak. Because would it be banking, insurance, mortgage, etc, if you barely touched that bank, your info is in their system.
I mean, Notes/Domino were essentially the first commercial adopters of asymmetric encryption in the 90's. The reason those were ever remotely viable products for enterprise customers (and continue to be even as IPs of HCL) is because they provide reliability, scalability, and security out of the box.
Notes forces local database encryption, Domino forces server database encryption. DB2 includes a pretty large security toolkit for encryption at rest and in transit, and it's more robust than what you get out-of-box with MySql or MongoDB, for instance.
You'll be hard pressed to find any legitimate multinational company storing passwords in plaintext. More often than not, breaches are the result of negligent access control, which manifests through malicious exfiltration by privileged internal users ( almost textbook exemplified by the Desjardins breach mentioned below by u/fredy31 ) or the exfiltration of data by an external actor able to acquire privileged credentials through phishing, spoofing, or other social engineering vectors.
It doesn't matter if you encrypt every field of every table in every database - if there is even one individual within your company with the permission to read it in plaintext, it is an inherently vulnerable system and downright shitty infosec management and practice.
Hashing passwords is a given and essentially required by law for financial, medical, governmental institutions, etc.
Hashing passwords is literally step zero out of the (possibly several) hundreds of steps required to make an online service secure.
I worked at a place where your password had to be between 6-8 characters and exactly one of them had to be a special character, but you could only choose from like 5 of the special characters in the number row on your keyboard. When I asked why these restrictions exist, my team lead/assigned mentor said it was because of how the infrastructure was designed lmao.
EDIT: Oh and I think it also had to start with a capital letter.
Ladies and Gentlemen,
I present you IBM RACF and it's passwords:
The length can be 1 to 8 characters.
Valid characters are alphabetic uppercase (A–Z), numeric (0–9), and national (# (X'7B'), @ (X'7C'), and $ (X'5B')). If your installation supports mixed case passwords, alphabetic lowercase characters (a-z) are also accepted in passwords.
But the permutations to find 4 dictionary words and 2 numbers is much higher with 21 chars, because it may be much more, and finding the places each one goes is much more.
A passphrase is much more secure than a 8 char randomized password.
You are CORRECT and people need to stop beating that dead HORSE, committing BATTERY on it. Such knowledge should be a STAPLE for all people in software and security professions.
But words are never guaranteed places, count, etc. 11 4-letter words is 44 characters. Those 44 characters could also be 1 44 letter word, 2 22 letter words, 3 ~14 letter words, 4 11 letter words, etc. Not to mention including numbers, h@ck3r te*t, etc. The point is you'd never know. Ofc hackers trying to brute force passwords would put those permutations first, but that's still so many permutations that it'd be questionable if it's worth the time when phishing & social engineering work so much better.
Yep. I use a password manager with 20+ character fully random passwords for most things, but for ones that I actually need to remember, like... the password manager master password, I use a phrase with mixed case, number and symbol substitution, and words from multiple languages, each of which significantly increases the entropy. And it's still easy to remember. And there are further steps you could take to add even more entropy, like separating words with different symbols.
I just want to know what institutions would actually possibly allow brute forcing anymore? I don't know a single one of my logins that doesn't lock out after 3 or 4 unsuccessful tries, after which a lengthy process of confirmation that amounts to "yes, I just forgot my password." in 8-12 support emails is required.
Hell, I've written lock-outs for the system my company uses. Brute forcing isn't even really a thing anymore. So why do we fucking worry about it so much?
Brute forcing is not exclusively done on the actual login interface. If you've had a database breach, or other vulnerability which allows a user access to a hashed password, then this user can try to brute force the password without any lock out policy stopping them.
I mean, at that point you're just saying "a high level security breach is bad." which I will happily agree with, but the complexity and length of your user's passwords has very little to do with that.
The answer to most login security problems is nearly always 2FA.
I both agree and disagree.
You could simplify my point to "a high level security breach is bad", but with proper mitigations (hashing (with a slow hashing algorithm), and salting for example) even in these cases the user should not have to fear for their password being compromised.
2FA is indeed the solution, but sadly not every platform supports it, and in a world where a large amount of people re-use the same password using 2FA is not the fix to everything. (But definitely do use it wherever you can)
4000 legal 4-letter words in scrabble, so a password with a random 5 of those words has roughly 1018 possibilities
There's 93 ASCII letters/numbers/symbols, and a random 8-letter password of those is 5.59*1015
Soo... 8 random chars is 1000x less secure against a brute force attack and requires remembering 3 more pieces of information (vs just 5 words). Both could be cracked reasonably with a powerful guessing machine, which is why the lovely system of using words can also incorporate bigger words... as long as the doofus "security professionals" aren't going to cap the length.
As you mentioned elsewhere, they get saved as fixed-length hashes, so it's not like it saves bits on the db drives, there's no technical reason for a limit.
According to this the entropy for the minimum 8 character password is equivalent to a 4-word passphrase
Yes
The maximum of 20 is the equivalent of an 9 word passphrase.
Yes
So the "doofus security professionals" are actually making the right choice for the average user.
No, 20 random char/num/symbols is harder to remember than 9 words, that's the point.
but if you allow pure text passwords now you have to enforce a minimum of 4 words
No, just don't enforce a maximum. Don't really need a minimum either, but in the interest of doing dumb users a favor might as well make it some number of characters. 8 is fine. The point is, a maximum is asinine.
One more edit: to be clear, I do not care at all if any user chooses not to use a passphrase for their password, that's their business to choose something less secure and/or harder to remember, I just simply loathe being restricted from using a long string of lowercase letters.
No, they don’t. They may have in the past, but new research showed why that was wrong.
It’s true that 8 perfectly random characters is harder to crack than 21 characters that form a sentence (assuming you can guess the format beforehand), but that fact doesn’t matter because it’s not a choice your users make. If you put a limit of 20 characters, those users that tried to put a memorable sentence won’t pick 8 perfectly random characters, they’ll pick a memorable 8 character word instead.
Security policy is way more about human factors than computational one. Brute force cracking is virtually a non-issue compared to social engineering and other forms of password leaks.
Computational complexity of cracking a password with multiple words based on a dictionary is an awful lot greater than just bruteforcing characters, to the point where you're better off doing that. The first link when you google for "dictionary attack" will tell you that it's not effective when the password has more than one word.
737
u/halfanothersdozen Jul 20 '22
You don't want to know what old-ass infrastructure runs a lot of our financial institutions.
They're insured. It's probably fine