Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop forcing arbitrary password rules

ryanwinchester.ca

Post reply on HN
Print view View original

61–70 of 196 posts

Re: Stop forcing arbitrary password rules

#61

Post by tombrossman »

dannib wrote: post #53
Karlozkiller wrote: post #46

Earlier quoted context omitted.

No, the most annoying thing is when they don't tell you the rules in advance, and you start typing a password that fits most standard rules. Now either you get through but don't know if you could've used a better password. Or your password will be denied and you have to make adaptions or change completely.

No, the most annoying is when you paste your password manager's auto generated long password and it silently get cut after 16 characters but successfully let you create your account. But now the login form doesn't have the same max-length property and your password will fail. Hopefully the reset password form is synced with the login form.

There's something about pasting vs typing that fails to give the user the necessary feedback and this has been a problem for a while. I faced this same issue years ago and I finally figured out my passwords were being truncated by hitting the 'forgot password' link and noting that the service emailed me the plaintext password (another problem but let's do one at a time) which was fewer characters. My original was 32 and the one they sent was far fewer.

I emailed support to ask and they said 'oh yes, we limit the number of characters in your password'. There was no documentation or feedback on the page to tell you this if you pasted the password, but if after pasting you deleted the last character and then tried to re-type it, you would see the error. Pasting never triggered the tooltip telling you the issue.

Now I try this each time I sign up for something which is a minor hassle but still much easier than the seemingly random failures I had been seeing. It also taught me to immediately sign out and test the services' password recovery functionality to weed out the ones storing plaintext passwords, so that's good.

Re: Stop forcing arbitrary password rules

#62

Post by IanCal »

qb45 wrote: post #58
dannib wrote: post #53

Earlier quoted context omitted.

No, the most annoying is when you paste your password manager's auto generated long password and it silently get cut after 16 characters but successfully let you create your account. But now the login form doesn't have the same max-length property and your password will fail. Hopefully the reset password form is synced with the login form.

Sounds so insane I guess it must have really happened. I had similar issue with paypal once. Their bank account number field expected to get N digits without spaces, so it was hard limited to N characters. Of course they didn't bother telling about that. When I pasted my number with some K space separators tossed between digits, the last K digits have been silently truncated. Boom, account locked.

> Sounds so insane I guess it must have really happened.

That happened to me on either "verified by visa" or the mastercard equivalent. I had to reset my password a few times before I figured that one out. For those that haven't used this it's an extra password protected step that comes up sometimes when purchasing things with your card.

Re: Stop forcing arbitrary password rules

#63

Post by codedokode »

whyoh wrote: post #59
codedokode wrote: post #34

What we really need is to stop using passwords. Passwords are awful UX design solution. The users have to think of and remember some meaningless phrase to get the service they really needed. If you use easy password, your account can be hacked. If you use difficult password, you won't remember it in a week. For some people remembering a password or login might be especially difficult. You can use software to generate…

No doubt a lot of people suck at password management, but with proper management it's easier for a thief to steal a hardware key. Or a phone. Which is why I hate that some new services require a phone number for authentication.

I don't think so. Stealing passwords from password manager with a trojan software is much easier (and safer) than breaking into somebody's house. In some countries you can even get shot for that.

You can say the same about credit cards: they can easily be lost, stolen etc. But generally they are better protected than internet bank account with just a password.

And the most appealing point is ease of use. Inserting a key and pressing a button is much easier for a common person than dealing with complicated matters like login, email or password.

Re: Stop forcing arbitrary password rules

#64

Post by maxerickson »

codedokode wrote: post #34

What we really need is to stop using passwords. Passwords are awful UX design solution. The users have to think of and remember some meaningless phrase to get the service they really needed. If you use easy password, your account can be hacked. If you use difficult password, you won't remember it in a week. For some people remembering a password or login might be especially difficult. You can use software to generate…

I'd like to be able to use my phone for this.

It wouldn't be as secure as a special purpose device, but it would be a whole lot more convenient. Given that people are using banking and pay apps on their phones, I think it doesn't really introduce any new issues for the typical user.

Re: Stop forcing arbitrary password rules

#65

Post by mattmanser »

whyoh wrote: post #59
codedokode wrote: post #34

What we really need is to stop using passwords. Passwords are awful UX design solution. The users have to think of and remember some meaningless phrase to get the service they really needed. If you use easy password, your account can be hacked. If you use difficult password, you won't remember it in a week. For some people remembering a password or login might be especially difficult. You can use software to generate…

No doubt a lot of people suck at password management, but with proper management it's easier for a thief to steal a hardware key. Or a phone. Which is why I hate that some new services require a phone number for authentication.

It's easier for a thief targeting specifically you, but that's not what most password hacks are about.

Re: Stop forcing arbitrary password rules

#66

Post by hueving »

paulmd wrote: post #31
petercooper wrote: post #5

Earlier quoted context omitted.

it's approximately 250000^4 If the attacker knows you've used four dictionary words in a row. Now you need to multiply the number by the odds of that ..

And the entropy of the password 0b0 is only a single bit - if the attacker knows you've used a single-bit password. Hashed into the SHA-256 space that's only a 1:2^256 chance of someone colliding with it. Still, is that a password you'd set? What does that have to do with the output of the password in terms of brute-force guessing? Aren't you kind of assuming that an opponent won't try a broad dictionary attack? Equa…

What are you going on about? Your giant post did nothing to refute the point that an attacker doesn't know you are using 1 word vs 4 words vs 12.

Also, you seem to imply that there is a distinguishable difference in sha1 outputs of good random inputs and English word inputs, which violates a security property of cryptographic hashes. So there is a lot of fame to be had if you can prove that.

Re: Stop forcing arbitrary password rules

#67

Post by coreyp_1 »

I despise expiring passwords. My university makes me change my password every 6 months, and they keep a list of the last 2 year's worth of passwords so that you can't reuse them. That, and they disallow some characters such as "#" and " " (space). It's annoying.

Re: Stop forcing arbitrary password rules

#68

Post by codedokode »

maxerickson wrote: post #64
codedokode wrote: post #34

What we really need is to stop using passwords. Passwords are awful UX design solution. The users have to think of and remember some meaningless phrase to get the service they really needed. If you use easy password, your account can be hacked. If you use difficult password, you won't remember it in a week. For some people remembering a password or login might be especially difficult. You can use software to generate…

I'd like to be able to use my phone for this. It wouldn't be as secure as a special purpose device, but it would be a whole lot more convenient. Given that people are using banking and pay apps on their phones, I think it doesn't really introduce any new issues for the typical user.

If there is an open source protocol you can use any device you like.

But using bank application on a phone is totally unsecure. A modern phone is a computer with complicated software that can be exploited.

Re: Stop forcing arbitrary password rules

#69

Post by Asbostos »

codedokode wrote: post #34

What we really need is to stop using passwords. Passwords are awful UX design solution. The users have to think of and remember some meaningless phrase to get the service they really needed. If you use easy password, your account can be hacked. If you use difficult password, you won't remember it in a week. For some people remembering a password or login might be especially difficult. You can use software to generate…

Ironically, it's easier for me to log into my internet banking than twitter because internet banking only has a hardware key and a simple 6 digit pin, but for Twitter, I have to go find my paper password list and type it in. It would be great if there was some kind of common hardware key that could be used on multiple sites.

Re: Stop forcing arbitrary password rules

#70

Post by maxerickson »

codedokode wrote: post #68
maxerickson wrote: post #64

Earlier quoted context omitted.

I'd like to be able to use my phone for this. It wouldn't be as secure as a special purpose device, but it would be a whole lot more convenient. Given that people are using banking and pay apps on their phones, I think it doesn't really introduce any new issues for the typical user.

If there is an open source protocol you can use any device you like. But using bank application on a phone is totally unsecure. A modern phone is a computer with complicated software that can be exploited.

Well, I'm not using a dedicated device for all that stuff, my phone is probably my most secure computer.
Post reply on HN