Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop forcing arbitrary password rules

ryanwinchester.ca

Post reply on HN
Print view View original

101–110 of 196 posts

Re: Stop forcing arbitrary password rules

#101

Post by JoeAltmaier »

xixixao wrote: post #41
CHY872 wrote: post #37

Earlier quoted context omitted.

No. They are not superior to passwords - they merely provide different tradeoffs. For example, the site that requires your hypothetical key-type key would require that either all of their customers have spent money on such a key (bad) or that they are willing to pay for keys for all of their customers. This is something that has been thought about in detail - see https://vtllf.org/blog/ssh-web-sign-in/quest-to-replac…

More importantly, you just replaced the problems of virtual keys with the problems of physical keys: you can lose them. Recovery is much more difficult than recovery of a virtual key.

Really? You don't lose (forget) virtual keys? It's a far worse problem. A physical key can always be found if you look hard enough. A virtual key can truly be lost forever.

Re: Stop forcing arbitrary password rules

#102

Post by JoeAltmaier »

jpdus wrote: post #27

Totally agree. At least 1 Uppercase means 99% of people just use an uppercase first character for their standard password. 1 number means they append 1,2 or a year and 1 special character means they append an exclamation mark. Entropy added = 0 (if password rules are known to the attacker). I don't get how anyone who cared the slightest about security would think otherwise and enforces these stupid rules.

Ha! I add '0' to the end of my password. Uncrackable!

Re: Stop forcing arbitrary password rules

#103

Post by welly »

Asbostos wrote: post #69
codedokode wrote: post #34

What we really need is to stop using passwords. Passwords are awful UX design solution. The users have to think of and remember some meaningless phrase to get the service they really needed. If you use easy password, your account can be hacked. If you use difficult password, you won't remember it in a week. For some people remembering a password or login might be especially difficult. You can use software to generate…

Ironically, it's easier for me to log into my internet banking than twitter because internet banking only has a hardware key and a simple 6 digit pin, but for Twitter, I have to go find my paper password list and type it in. It would be great if there was some kind of common hardware key that could be used on multiple sites.

Isn't your paper password list just a post-it note attached to your screen like mine is?

Re: Stop forcing arbitrary password rules

#104

Post by citruspi »

qb45 wrote: post #58
dannib wrote: post #53

Earlier quoted context omitted.

No, the most annoying is when you paste your password manager's auto generated long password and it silently get cut after 16 characters but successfully let you create your account. But now the login form doesn't have the same max-length property and your password will fail. Hopefully the reset password form is synced with the login form.

Sounds so insane I guess it must have really happened. I had similar issue with paypal once. Their bank account number field expected to get N digits without spaces, so it was hard limited to N characters. Of course they didn't bother telling about that. When I pasted my number with some K space separators tossed between digits, the last K digits have been silently truncated. Boom, account locked.

> Sounds so insane I guess it must have really happened.

I had it happen to me when changing a password on an Apple ID account 1-2 years ago. My password was accepted without an error and truncated to 32 characters.

Re: Stop forcing arbitrary password rules

#105

Post by JoeAltmaier »

coreyp_1 wrote: post #67

I despise expiring passwords. My university makes me change my password every 6 months, and they keep a list of the last 2 year's worth of passwords so that you can't reuse them. That, and they disallow some characters such as "#" and " " (space). It's annoying.

Typically, folks just change the '1' at the end to '2'. And so on. I agree this is another totally pointless password rule that helps nobody.

Re: Stop forcing arbitrary password rules

#106

Post by adamc »

pjmlp wrote: post #30

The worse ones are the constraints to which characters one isn't suppose to use, which on my book only reveals sloppy coding as the developer wasn't able to cope with arbitrary characters.

Sometimes it reveals things about the underlying system (e.g., that they are storing passwords on a mainframe, or in a database with a different character set).

Re: Stop forcing arbitrary password rules

#107

Post by citruspi »

JoeAltmaier wrote: post #101
xixixao wrote: post #41

Earlier quoted context omitted.

More importantly, you just replaced the problems of virtual keys with the problems of physical keys: you can lose them. Recovery is much more difficult than recovery of a virtual key.

Really? You don't lose (forget) virtual keys? It's a far worse problem. A physical key can always be found if you look hard enough. A virtual key can truly be lost forever.

> A virtual key can truly be lost forever.

Sure, but it's super easy to make backups of virtual keys. It's a digital file - just copy it.

Worried one backup isn't enough? Make a million. Space is cheap.

Re: Stop forcing arbitrary password rules

#108

Post by JoeAltmaier »

citruspi wrote: post #107
JoeAltmaier wrote: post #101

Earlier quoted context omitted.

Really? You don't lose (forget) virtual keys? It's a far worse problem. A physical key can always be found if you look hard enough. A virtual key can truly be lost forever.

> A virtual key can truly be lost forever. Sure, but it's super easy to make backups of virtual keys. It's a digital file - just copy it. Worried one backup isn't enough? Make a million. Space is cheap.

Ok, but that makes is harder, not easier, to manage virtual keys. And the more copies, the weaker the key (the easier to find). A million is a terrible, terrible idea.

No, I despise passwords. The whole scheme is backwards. I don't want to authenticate myself to the server; I want to authenticate the server to me. Why doesn't it provide the password, and my computer verify it? Why is a fallible human being in this game at all?

Re: Stop forcing arbitrary password rules

#109

Post by CydeWeys »

netheril96 wrote: post #82
microtonal wrote: post #45

Earlier quoted context omitted.

With keys such as a U2F key, you can use it for multiple sites (each site will have a site-specific keypair). Most sites allow you to associate multiple U2F keys as well. Since U2F keys typically cost 7 to 15 Euro, it's really not much of a problem to buy one for use and to put one as a backup in a fire-proof safe. That said, I think it's bad to rely on one factor. If the key gets stolen, security is compromised. The…

People in developing countries probably won't ever buy a U2F key. 7 to 15 Euros are too expensive for them (and me).

A lot of banks already give them away to their customers because the hardware costs are less than the fraud costs associated with compromised accounts. And in an ideal world, said keys would be general use, not just for logging into the bank's site.

Re: Stop forcing arbitrary password rules

#110

Post by JoeAltmaier »

DanBC wrote: post #98
nsmalch wrote: post #51

Earlier quoted context omitted.

As a rule of thumb, I would go after natural language phrases first, because it is impossible to tell if the phrase was machine-generated. It's nearly impossible to arrange dots randomly on a page with a pencil because there is always some structure or engrained rigidity in human guesswork. There is also the possibility that the dots were done by 'inception', and certain biases were programmed in via subliminal messa…

Humans use dice to generate randomness. They throw 5 dice, to get a five digit number. They look up that number on a list to get a word. They repeat this process until they have a 7 word phrase. So, there are weaknesses if humans roll the 5 dice and get 1, 1, 1, 1, 1 and then say "That's not random, I'll roll again"[1] or they roll a number, look it up and say "I'll never remember 'zerg', I'll roll again".

Rolling again, is no weakness at all. The next roll is also random and exactly as unguessable as the first. If the game was done 'without replacement' then the field would be reduced, but it isn't, and the field is unimaginably huge anyway. There is no effect whatsoever by 'rolling again' until you are happy with the result.

My buddy Tom always generates UUIDs by hitting the button several times. It gives him pleasure to 'waste' all those random numbers.

Post reply on HN