[deleted]
Stop forcing arbitrary password rules
141–150 of 196 posts
Re: Stop forcing arbitrary password rules
#142100 times yes. The mere presence of a single character from a different class does not increase entropy. It means that most common passwords move from 8 lowercase letters to 6 lowercase letters plus 1 number plus 1 symbol, which is even easier to search. If you have a sophisticated entropy estimation tool, or library, great. Another simple thing is using a min length, plus restrict from a dictionary of the million mo…
Must contain 2 of the following, (upper case letter), (lower case letter), (number), or (Symbol) is higher entropy than 8 lower case letters.
Re: Stop forcing arbitrary password rules
#143Earlier quoted context omitted.
Now this reminded me of one Unix server operated by an educational institution that shall remain unnamed, where passwords were (maybe still are?) truncated to 8 characters. Fortunately, this wasn't a problem because as long as the first 8 characters matched you could type literally anything and the password would get accepted. Funnily, the admins apparently really cared about security very much, so they required user…
There is a bank which shall remain nameless ( Schwab ) which not only silently truncates passwords to 8 characters, but also performs a case insensitive match. They say they're working on fixing it but it's taking an awfully long time.
Last I checked, Fidelity truncates to 10 characters, but silently converts them all to digits. They map them all to their equivalents on a typical phone keypad... so it's not even using all the digits. Talk about awful security...
Edit to add: It appears they may have fixed this misfeature. I did personally verify that you could log into their website with the phone-equivalent digits at one point, maybe a year or two ago. There's also a few forum threads about it around the net, eg https://www.bogleheads.org/forum/viewtopic.php?t=93792#p1350...
Re: Stop forcing arbitrary password rules
#144Surprised of 99% agreement here at HN, because usually IT/security people in majority of the cases don't understand me when saying ^^ the same.
Re: Stop forcing arbitrary password rules
#145100 times yes. The mere presence of a single character from a different class does not increase entropy. It means that most common passwords move from 8 lowercase letters to 6 lowercase letters plus 1 number plus 1 symbol, which is even easier to search. If you have a sophisticated entropy estimation tool, or library, great. Another simple thing is using a min length, plus restrict from a dictionary of the million mo…
Must contain 2 of the following, (upper case letter), (lower case letter), (number), or (Symbol) is higher entropy than 8 lower case letters.
Mathematically, but not socially.
It means that humans reduce the entropy across the board to (more than, IMO) compensate for the mathematical advantage.
Re: Stop forcing arbitrary password rules
#146Earlier quoted context omitted.
No. For a dictionary attack, someone would need to know that you are using words. They would need to know if they are separated by spaces, or dots or slashes. The probability of someone knowing your personal scheme is fantastically low, unless they already know one of your other passwords and can guess it. A password like: "Żółć zżółkła w gąszczu fantazyji!" Is absolutely impossible to crack in any reasonable amount…
It has literally been done already. Obscure African poems have been guessed.
By people who knew to look for obscure african poems? I mean sure, you could guess a Polish sentence if you used a Polish dictionary, but how likely is that?
Re: Stop forcing arbitrary password rules
#147I despise expiring passwords. My university makes me change my password every 6 months, and they keep a list of the last 2 year's worth of passwords so that you can't reuse them. That, and they disallow some characters such as "#" and " " (space). It's annoying.
I don't care for them either, but there is definitely a purpose: it limits the vulnerability period of a users password compromise.
For example, if you share passwords between sites, compromising one site gives you a limited time frame in which to attack the other. 6 months isn't even a bad compromise; some places with high security requirements make it 30 days.
Re: Stop forcing arbitrary password rules
#148I completely agree with the author, but... what he completely misses is the biggest annoyance: maximum length rules. I'd probably sacrifice my firstborn if Microsoft would finally wake up and accept passwords longer than 16 goddamn characters...
Whenever I see this maximum password length nonsense, I realize that whoever is in charge of security at this company apparently doesn't know or care about password managers. And that speaks volumes to me.
It is also a 'code smell' that suggests that the relevant company is storing passwords in plaintext.
Reason: If they were hashing the password, the hash output would be fixed length, independent of the input length, so there would be no need for an external, user visible, maximum length restrictions.
Re: Stop forcing arbitrary password rules
#149I completely agree with the author, but... what he completely misses is the biggest annoyance: maximum length rules. I'd probably sacrifice my firstborn if Microsoft would finally wake up and accept passwords longer than 16 goddamn characters...
[deleted]
Re: Stop forcing arbitrary password rules
#150Earlier quoted context omitted.
Must contain 2 of the following, (upper case letter), (lower case letter), (number), or (Symbol) is higher entropy than 8 lower case letters.
Mathematically, but not socially. It means that humans reduce the entropy across the board to (more than, IMO) compensate for the mathematical advantage.
[deleted]