Quote from: bitsalame on June 21, 2011, 12:09:05 AM

Quote from: enmaku on June 20, 2011, 11:52:02 PM

I understand all too well that if people are allowed to choose ANY password at all, they will usually choose a weak one. The onus of security is not typically placed on the user, it is up to the institution to FORCE the user to choose a minimum acceptable level of security. This is why every major OS has systems built in to enforce password length, complexity and expiration requirements. Users cannot always be counted on to choose methods and systems which are in their best interests.

It's yet another extension of that classic rule of programming: "Always assume your user is an idiot (even if your only user is yourself)"

That principle is wrong from the very basics.
You can't increase security through forcing a human being. Idiots are particularly clever to circumvent a foolproof design.
If you force arbitrary formatting of a password, they WILL write it down and paste it on the monitor, making it available to anyone who walks by by the office.

We must break the paradigm of "strong=difficult passwords". You shouldn't force anyone, you must invite them to adopt it.
We must make "strong=easy passwords" for the users, that is easy for the user to remember and computationally difficult to crack.
The first two examples I give in my previous post are damn easy once you "get it" and it is a nightmare for the cracker.

A password like this: "De345tgfr." it's a nightmare for a cracker.
Try typing it in the keyboard (go ahead, type it with one finger).
As you can see, forms a determined and easy to remember pattern on the keyboard.
It is damn easy to remember because I exploit the "procedural memory" (your "finger memory").
That is the first method I discuss in my previous post.

The RSA SecureID type of security is the ideal one for the end user... there are more experimental and sophisticated methods of authetications based on the fingerprinting of your typing rhythm: you type a text in a particular way, and that becomes a very precise biometric data.
I tested a few solutions (web based) and they are really amazing in their accuracy.

But until those solutions become standarized and open to the public, the people should be security conscious.
Forcing them is not the solution, educating them is.
Regards,

It may end up on a sticky note on the monitor but that leads to a single user having their account stolen for their own stupidity. Failing to enforce a strong password policy leads to MANY users having their accounts compromised for the SITE'S stupidity.

Not every individual user is perhaps best served by strong password policies, but the user-base as a whole certainly is and for a site with some 60,000 users, a utilitarian approach that protected 59,900 of them would have been preferred and in fact would likely have stopped this attack, provided the compromised account was not one of the few old enough to have an un-salted hash. Even if Mr (or Mrs?) 500,000 BTC had written their forcibly-made-stronger password on a post-it next to their mousepad that would be meaningless to an attacker with a database dump who would not have physical access to said post-it.