Stop forcing arbitrary password rules • Hacker News Board

Re: Stop forcing arbitrary password rules

#21

Post by HNSucksAss » Sat, Oct 24, 2015, 10:03 AM UTC

The best password bullshit I've encountered was United Healthcare's. They put a list of password requirements on their page, but even if you adhere to all of them, the page will claim that your password is invalid.

Why? Because they AUDIT YOUR PASSWORD FOR "SWEAR" WORDS. I shit you not: http://goldmanosi.blogspot.com/2013/09/united-healthcare-aud...

Re: Stop forcing arbitrary password rules

#22

Post by lhecker » Sat, Oct 24, 2015, 10:06 AM UTC

I completely agree with the author, but... what he completely misses is the biggest annoyance: maximum length rules.

I'd probably sacrifice my firstborn if Microsoft would finally wake up and accept passwords longer than 16 goddamn characters...

Re: Stop forcing arbitrary password rules

#23

Post by carbonic » Sat, Oct 24, 2015, 10:09 AM UTC

scintill76 wrote: post #17

emsy wrote: post #15

Second worst password rule: preventing to paste in the password field. As seen at The OS X FileVault dialog, PayPal, Blizzard and many more....

Chrome hackaround: 1. Right-click the field, Inspect element. 2. Go to Console tab, type: $0.value = 'mypassword'; $0 is the last selected element: https://developer.chrome.com/devtools/docs/commandline-api

You can do this in FF and probably others by using this method:

1. click on the input field. 2. Type document.activeElement.value = 'MyPassword'; into the console.

Re: Stop forcing arbitrary password rules

#24

Post by vortico » Sat, Oct 24, 2015, 10:09 AM UTC

z3t4 wrote: post #20

emsy wrote: post #15

Second worst password rule: preventing to paste in the password field. As seen at The OS X FileVault dialog, PayPal, Blizzard and many more....

99% is probably stolen passwords and 0.0001% brute forced passwords.

A password thief surely wouldn't be stopped by a text box that doesn't allow Ctrl-V.

Re: Stop forcing arbitrary password rules

#25

Post by jakobdabo » Sat, Oct 24, 2015, 10:13 AM UTC

z3t4 wrote: post #20

emsy wrote: post #15

Second worst password rule: preventing to paste in the password field. As seen at The OS X FileVault dialog, PayPal, Blizzard and many more....

99% is probably stolen passwords and 0.0001% brute forced passwords.

No, 99% are the ones copied from a password manager application.

Re: Stop forcing arbitrary password rules

#26

Post by bradjohnson » Sat, Oct 24, 2015, 10:15 AM UTC

It always seems like banks are way behind the curve on this for whatever reason. My old credit union that I left a couple years back required specifically a 6 character ^[0-9]$ password for complete access to my account. I have no idea why this seemed like a good idea to them. Plus the idiotic security question crap that they usually store in plain text. Just let me store my email and send me an email if I lose access; security questions make you /less/ secure.

Re: Stop forcing arbitrary password rules

#27

Post by jpdus » Sat, Oct 24, 2015, 10:16 AM UTC

Totally agree. At least 1 Uppercase means 99% of people just use an uppercase first character for their standard password. 1 number means they append 1,2 or a year and 1 special character means they append an exclamation mark. Entropy added = 0 (if password rules are known to the attacker). I don't get how anyone who cared the slightest about security would think otherwise and enforces these stupid rules.

Re: Stop forcing arbitrary password rules

#28

Post by DanBC » Sat, Oct 24, 2015, 10:21 AM UTC

nsmalch wrote: post #8

forgotpwtomain wrote: post #3

I agree with the point the author is making and generally am just as annoyed by arbitrary password rules; nevertheless: > chili dog monkey nutso Is definitely not 18 quintillion years at best it's approximately 250000^4 which is 2^72. A good (though still requiring some memorizing effort approach) would be something along the lines of https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi... which uses a standa…

XKCD's diceware argument fails under certain conditions. Computationally very hard to crack, but when plucked from actual phrases that have been uttered; weak. So to give an example, any natural language phrase like: "I took a walk in a park" is easier to crack. I am certain there is somebody coding an infinite-monkey-type bruter to crack diceware as we speak: https://en.wikipedia.org/wiki/Infinite_monkey_theorem

I'm not sure I understand how an infinite monkey attack would work against diceware.

Let's assume a word list of 7776 words. All words are lower case alpha. The attacker has pur wordlist. And the attacker knows there are seven words in the passphrase.

That's still 7776^7.

Even if we prune the wordlist ("I'm not using 'zerg' in my phrase", "I rolled 11111, that's not random so I'll roll again") it's still not an attackable space.

Re: Stop forcing arbitrary password rules

#29

Post by 1ris » Sat, Oct 24, 2015, 10:23 AM UTC

Out of all, my bank forces to have my password to have exactly 5 chars. This is madness. Fortunately to actually do anything I need a second authentication factor.

Re: Stop forcing arbitrary password rules

#30

Post by pjmlp » Sat, Oct 24, 2015, 10:26 AM UTC

The worse ones are the constraints to which characters one isn't suppose to use, which on my book only reveals sloppy coding as the developer wasn't able to cope with arbitrary characters.