Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop forcing arbitrary password rules

ryanwinchester.ca

Post reply on HN
Print view View original

91–100 of 196 posts

Re: Stop forcing arbitrary password rules

#91

Post by Someone »

qb45 wrote: post #58
dannib wrote: post #53

Earlier quoted context omitted.

No, the most annoying is when you paste your password manager's auto generated long password and it silently get cut after 16 characters but successfully let you create your account. But now the login form doesn't have the same max-length property and your password will fail. Hopefully the reset password form is synced with the login form.

Sounds so insane I guess it must have really happened. I had similar issue with paypal once. Their bank account number field expected to get N digits without spaces, so it was hard limited to N characters. Of course they didn't bother telling about that. When I pasted my number with some K space separators tossed between digits, the last K digits have been silently truncated. Boom, account locked.

Happened to me this week. "Luckily", they also implemented the "feature" where they can send you your password by email directly after you set it, so when I couldn't get in with the password I set, I reset the password, got a mail with a new password, logged in, changed the password to a new random long string, and this timeasked them to send the password to me. The password they sent was chopped off. That told me their limit, so I could set my password a third time to get something maximally secure.

Re: Stop forcing arbitrary password rules

#92

Post by proactivesvcs »

tombrossman wrote: post #61
dannib wrote: post #53

Earlier quoted context omitted.

No, the most annoying is when you paste your password manager's auto generated long password and it silently get cut after 16 characters but successfully let you create your account. But now the login form doesn't have the same max-length property and your password will fail. Hopefully the reset password form is synced with the login form.

There's something about pasting vs typing that fails to give the user the necessary feedback and this has been a problem for a while. I faced this same issue years ago and I finally figured out my passwords were being truncated by hitting the 'forgot password' link and noting that the service emailed me the plaintext password (another problem but let's do one at a time) which was fewer characters. My original was 32…

You might be interesting in Plain Text Offenders' browser add-on. It warns when you're browsing a site that is known to store or send passwords in plain text: http://plaintextoffenders.com/

Re: Stop forcing arbitrary password rules

#93

Post by TomGullen »

petercooper wrote: post #5
forgotpwtomain wrote: post #3

I agree with the point the author is making and generally am just as annoyed by arbitrary password rules; nevertheless: > chili dog monkey nutso Is definitely not 18 quintillion years at best it's approximately 250000^4 which is 2^72. A good (though still requiring some memorizing effort approach) would be something along the lines of https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi... which uses a standa…

it's approximately 250000^4 If the attacker knows you've used four dictionary words in a row. Now you need to multiply the number by the odds of that ..

Just cross reference with people who've posted that XKCD comic

Re: Stop forcing arbitrary password rules

#94

Post by codedokode »

netheril96 wrote: post #82
microtonal wrote: post #45

Earlier quoted context omitted.

With keys such as a U2F key, you can use it for multiple sites (each site will have a site-specific keypair). Most sites allow you to associate multiple U2F keys as well. Since U2F keys typically cost 7 to 15 Euro, it's really not much of a problem to buy one for use and to put one as a backup in a fire-proof safe. That said, I think it's bad to rely on one factor. If the key gets stolen, security is compromised. The…

People in developing countries probably won't ever buy a U2F key. 7 to 15 Euros are too expensive for them (and me).

U2F looks very promising. The prices will probably go down as the standard will get adopted and there will be more competition.

Re: Stop forcing arbitrary password rules

#95

Post by reddytowns »

ErrantX wrote: post #74
desdiv wrote: post #10

Earlier quoted context omitted.

Can you explain why the XKCD scheme is weak to dictionary attacks? Using the 2048 common words example from the comic, there would be 2048^4 = 1.8e13 four word combinations. I don't see any possible attack that's faster than brute-force here.

Of course, it's not the worst schema. But it gets a lot more credit than it is worth. Using dictionary words reduces the entropy of your password significantly. And for a cracker it can be trivial to attack passwords of that form. Given the sort of compute power you can obtain cheaply nowadays, attacking 4-word schemas (especially given people tend to use common words) is not hard. It's to some degree security throug…

How long does it take to crack a 4 word password, vs a 3?

Re: Stop forcing arbitrary password rules

#96

Post by tomjen3 »

chris_wot wrote: post #77

I've been wondering about password complexity for a while now. If a password is cryptographically hashed, so long as it isn't a dictionary word or date, why on earth do people add in complexity rules that prevent arbitrary character sequences? What I'm getting at here is that if you had a 8 character password (for the sake of the example), and you can type in lowercase letters, uppercase letters, numbers and punctuat…

It forces people to use Password1# rather than just password. There are many, many more people with an easily guessable password than there are with entirely random 8 char passwords.

Re: Stop forcing arbitrary password rules

#97

Post by T01 »

dannib wrote: post #53
Karlozkiller wrote: post #46

Earlier quoted context omitted.

No, the most annoying thing is when they don't tell you the rules in advance, and you start typing a password that fits most standard rules. Now either you get through but don't know if you could've used a better password. Or your password will be denied and you have to make adaptions or change completely.

No, the most annoying is when you paste your password manager's auto generated long password and it silently get cut after 16 characters but successfully let you create your account. But now the login form doesn't have the same max-length property and your password will fail. Hopefully the reset password form is synced with the login form.

Paypal does this

Re: Stop forcing arbitrary password rules

#98

Post by DanBC »

nsmalch wrote: post #51
DanBC wrote: post #28

Earlier quoted context omitted.

I'm not sure I understand how an infinite monkey attack would work against diceware. Let's assume a word list of 7776 words. All words are lower case alpha. The attacker has pur wordlist. And the attacker knows there are seven words in the passphrase. That's still 7776^7. Even if we prune the wordlist ("I'm not using 'zerg' in my phrase", "I rolled 11111, that's not random so I'll roll again") it's still not an attac…

As a rule of thumb, I would go after natural language phrases first, because it is impossible to tell if the phrase was machine-generated. It's nearly impossible to arrange dots randomly on a page with a pencil because there is always some structure or engrained rigidity in human guesswork. There is also the possibility that the dots were done by 'inception', and certain biases were programmed in via subliminal messa…

Humans use dice to generate randomness. They throw 5 dice, to get a five digit number. They look up that number on a list to get a word. They repeat this process until they have a 7 word phrase.

So, there are weaknesses if humans roll the 5 dice and get 1, 1, 1, 1, 1 and then say "That's not random, I'll roll again"[1] or they roll a number, look it up and say "I'll never remember 'zerg', I'll roll again".

Re: Stop forcing arbitrary password rules

#99

Post by eru »

lhecker wrote: post #49
dagss wrote: post #44

Earlier quoted context omitted.

Point is you can use passphrases that are easier for humans to remember, but you then need to measure entropy as numbers of words and size of dictionary and 16 characters is too little. https://xkcd.com/936/

Yep exactly that. It would be great if I could just use some whole words as the password for accounts which I need to use often or are really important and thus IMHO make password stores impractical (e.g. desktop login, Gmail, …)

Add second factor authorization for these, in any case. Google Authenticator app on the phone works reasonably well, or perhaps even get a physical token.

Re: Stop forcing arbitrary password rules

#100

Post by Asbostos »

Natanael_L wrote: post #72
Asbostos wrote: post #69

Earlier quoted context omitted.

Ironically, it's easier for me to log into my internet banking than twitter because internet banking only has a hardware key and a simple 6 digit pin, but for Twitter, I have to go find my paper password list and type it in. It would be great if there was some kind of common hardware key that could be used on multiple sites.

U2F! The new Yubikeys supports it, and there's other hardware you can get too that supports the protocol.

Hey that looks fantastic. It only seems to be supported by about half a dozen sites though. I wonder if there are some big costs to a site adopting it.
Post reply on HN