The problem is that those that enforce those rules does not read these articles :( its sad
Stop forcing arbitrary password rules
131–140 of 196 posts
Re: Stop forcing arbitrary password rules
#132Earlier quoted context omitted.
Point is you can use passphrases that are easier for humans to remember, but you then need to measure entropy as numbers of words and size of dictionary and 16 characters is too little. https://xkcd.com/936/
Yep exactly that. It would be great if I could just use some whole words as the password for accounts which I need to use often or are really important and thus IMHO make password stores impractical (e.g. desktop login, Gmail, …)
I use a passphrase on my Gmail account in the manner of "This is the password I am using for Gmail". Works just fine.
Re: Stop forcing arbitrary password rules
#133Or browser manufacturers could implement HOBA and we could stop worrying about passwords for the web. Just sayin...
Re: Stop forcing arbitrary password rules
#134Earlier quoted context omitted.
Of course, it's not the worst schema. But it gets a lot more credit than it is worth. Using dictionary words reduces the entropy of your password significantly. And for a cracker it can be trivial to attack passwords of that form. Given the sort of compute power you can obtain cheaply nowadays, attacking 4-word schemas (especially given people tend to use common words) is not hard. It's to some degree security throug…
> It's to some degree security through obscurity: no, a > cracker will not know your schema in advance but he will > attempt to attack multiple schema types. If you put it like that, then passwords are security through obscurity too, since they are only secure because the attacker does not know the password? It's really all about having your own, personal schema. Even a slight variation of a popular one will put you…
Absolutely, use something different and more complex to 4 common words. That's pretty much what I am saying. My argument is that whilst you are switched on to the problem enough to do that, a lot of people simply are not. So stuff like the XKCD comic can be harmful.
To the second part of your post: sure it's a concern. But that wasn't really the subject of the post. You will never protect yourself completely, but I've always argued that if you're concerned about the sort of things you're concerned about it's already too late. We should train people to use the internet safely and be alert for compromise at the individual level.
Re: Stop forcing arbitrary password rules
#135What we really need is to stop using passwords. Passwords are awful UX design solution. The users have to think of and remember some meaningless phrase to get the service they really needed. If you use easy password, your account can be hacked. If you use difficult password, you won't remember it in a week. For some people remembering a password or login might be especially difficult. You can use software to generate…
Hardware might be a nicer UX (though god forbid you forget your dongle one day and are completely screwed). But I fail to see how it's more secure without a second form of authentication.
Re: Stop forcing arbitrary password rules
#136Earlier quoted context omitted.
Of course, it's not the worst schema. But it gets a lot more credit than it is worth. Using dictionary words reduces the entropy of your password significantly. And for a cracker it can be trivial to attack passwords of that form. Given the sort of compute power you can obtain cheaply nowadays, attacking 4-word schemas (especially given people tend to use common words) is not hard. It's to some degree security throug…
> especially given people tend to use common words You don't pick the words yourself, you choose them at random. That's the whole point. > Given the sort of compute power you can obtain cheaply nowadays, attacking 4-word schemas (especially given people tend to use common words) is not hard. If the password is hashed with bcrypt with a work factor of 10 (the default in Rails), it would take ~5500 years to crack a sin…
Except, how can you be sure your password was stored securely? You should never assume that.
> You don't pick the words yourself, you choose them at random. That's the whole point.
Suggest: you're supposed to choose them at random. In practice (source: 5 years as a security analyst) this does not happen. People are predictable!
Re: Stop forcing arbitrary password rules
#137I completely agree with the author, but... what he completely misses is the biggest annoyance: maximum length rules. I'd probably sacrifice my firstborn if Microsoft would finally wake up and accept passwords longer than 16 goddamn characters...
No, the most annoying thing is when they don't tell you the rules in advance, and you start typing a password that fits most standard rules. Now either you get through but don't know if you could've used a better password. Or your password will be denied and you have to make adaptions or change completely.
The most annoying thing is when they let you log in with google/facebook and then ask you to create a password on top of that.
Re: Stop forcing arbitrary password rules
#138Earlier quoted context omitted.
We have those keys, technically supported in every browser, and you can decide on the level of security that you want - and store keys on highly secure tamper-resistant hardware tokens or manage everything purely in software of your choice. It's called TLS client certificates and no one supports those. Browser vendors make UIs that are absolutely awful (it's like they do this on some damned purpose!), there is no syn…
U2F works too, and it even hides the details about which sites you have registered in from everybody but each individual site owner - you can't identify the individual token of know if your users have registered elsewhere or not even if you compare account details. They use unique keypairs for every site.
As far as I get it (I haven't read much about U2F), U2F is generally perceived - and advertised - as a second factor, not the primary credential like a password.
On the other side, client certificates (be it TLS with X.509 or whatever) are generally considered as password replacements.
I mean, I suppose many don't want a password - just click an identity with autonomous credentials that don't depend on any third party, optionally do the confirmation ritual (hardware button, PIN entry) - and get recognized.
Re: Stop forcing arbitrary password rules
#139Earlier quoted context omitted.
Now this reminded me of one Unix server operated by an educational institution that shall remain unnamed, where passwords were (maybe still are?) truncated to 8 characters. Fortunately, this wasn't a problem because as long as the first 8 characters matched you could type literally anything and the password would get accepted. Funnily, the admins apparently really cared about security very much, so they required user…
There is a bank which shall remain nameless ( Schwab ) which not only silently truncates passwords to 8 characters, but also performs a case insensitive match. They say they're working on fixing it but it's taking an awfully long time.
As long as you throttle login attempts short passwords are fine. EX: 6 digit pin on a debit card might seem useless, but if you only get 3 tries per day that's just not an issue.
~10-20 failed attempts per day per IP + some rules to check for multiple IP's per account and 8 lowercase letters - most common passwords is actually reasonable.
Re: Stop forcing arbitrary password rules
#140Earlier quoted context omitted.
More importantly, you just replaced the problems of virtual keys with the problems of physical keys: you can lose them. Recovery is much more difficult than recovery of a virtual key.
Really? You don't lose (forget) virtual keys? It's a far worse problem. A physical key can always be found if you look hard enough. A virtual key can truly be lost forever.
A physical key cannot always be found unless you're a hikikomori who never, ever leaves the house.