Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop forcing arbitrary password rules

ryanwinchester.ca

Post reply on HN
Print view View original

161–170 of 196 posts

Re: Stop forcing arbitrary password rules

#161

Post by mikelward »

plorg wrote: post #16

I was in Chicago with my family recently and purchased a one-day pass for the CTA. When I returned home I found you could create an online account connected to the card, ostensibly to be able to fill it up automatically, but also to track your ridership. I thought it would be interesting to see what kind of data a rider could get from the card. I spent quite a bit of time trying to create an account only to receive a…

Last I knew, the T-Mobile registration form prevented typing the letter 'v' in the password field. It was a rookie programmer trying to prevent pasting.

Re: Stop forcing arbitrary password rules

#163

Post by bradleyjg »

Retric wrote: post #142
ddlatham wrote: post #126

100 times yes. The mere presence of a single character from a different class does not increase entropy. It means that most common passwords move from 8 lowercase letters to 6 lowercase letters plus 1 number plus 1 symbol, which is even easier to search. If you have a sophisticated entropy estimation tool, or library, great. Another simple thing is using a min length, plus restrict from a dictionary of the million mo…

Must contain 2 of the following, (upper case letter), (lower case letter), (number), or (Symbol) is higher entropy than 8 lower case letters.

A randomly selected member of the set of all of 8 character strings which contain at least 2 of [(upper case letter), (lower case letter), (number), or (Symbol)] has more entropy than the a randomly selected member of the set of 8 character strings which contain only lower case letters.

However, all bets are off if the respective strings are no randomly selected. 'Passw0rd' is worse than 'xmliicou'.

Re: Stop forcing arbitrary password rules

#164

Post by mkobit »

pwg wrote: post #148
jordanpg wrote: post #128

Earlier quoted context omitted.

Whenever I see this maximum password length nonsense, I realize that whoever is in charge of security at this company apparently doesn't know or care about password managers. And that speaks volumes to me.

It is also a 'code smell' that suggests that the relevant company is storing passwords in plaintext. Reason: If they were hashing the password, the hash output would be fixed length, independent of the input length, so there would be no need for an external, user visible, maximum length restrictions.

That's an interesting and plausible take on it. Why do you think new companies still go the route of not allowing special characters (like ;"()' and the other SQL injection types)? I would think that new companies would know better by now, but I guess not?

Re: Stop forcing arbitrary password rules

#165

Post by sfilipov »

ddlatham wrote: post #126

100 times yes. The mere presence of a single character from a different class does not increase entropy. It means that most common passwords move from 8 lowercase letters to 6 lowercase letters plus 1 number plus 1 symbol, which is even easier to search. If you have a sophisticated entropy estimation tool, or library, great. Another simple thing is using a min length, plus restrict from a dictionary of the million mo…

Additionally, I thought that's what key stretching and PBKDF2 - to slow down brute force attacks.

Re: Stop forcing arbitrary password rules

#166

Post by smoothgrips »

Someone wrote: post #91
qb45 wrote: post #58

Earlier quoted context omitted.

Sounds so insane I guess it must have really happened. I had similar issue with paypal once. Their bank account number field expected to get N digits without spaces, so it was hard limited to N characters. Of course they didn't bother telling about that. When I pasted my number with some K space separators tossed between digits, the last K digits have been silently truncated. Boom, account locked.

Happened to me this week. "Luckily", they also implemented the "feature" where they can send you your password by email directly after you set it, so when I couldn't get in with the password I set, I reset the password, got a mail with a new password, logged in, changed the password to a new random long string, and this timeasked them to send the password to me. The password they sent was chopped off. That told me th…

So, they emailed your password to you? Plaintext? They store passwords in plaintext? Paypal?

Re: Stop forcing arbitrary password rules

#167

Post by ryan-c »

forgotpwtomain wrote: post #3

I agree with the point the author is making and generally am just as annoyed by arbitrary password rules; nevertheless: > chili dog monkey nutso Is definitely not 18 quintillion years at best it's approximately 250000^4 which is 2^72. A good (though still requiring some memorizing effort approach) would be something along the lines of https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi... which uses a standa…

250,000^4 is obscenely generous. A typical person's vocabulary is maybe a tenth that, and people will be biased towards common words.

Re: Stop forcing arbitrary password rules

#168

Post by 0x49 »

proactivesvcs wrote: post #92
tombrossman wrote: post #61

Earlier quoted context omitted.

There's something about pasting vs typing that fails to give the user the necessary feedback and this has been a problem for a while. I faced this same issue years ago and I finally figured out my passwords were being truncated by hitting the 'forgot password' link and noting that the service emailed me the plaintext password (another problem but let's do one at a time) which was fewer characters. My original was 32…

You might be interesting in Plain Text Offenders' browser add-on. It warns when you're browsing a site that is known to store or send passwords in plain text: http://plaintextoffenders.com/

This site, while clever, is spreading potentially bad information. For instance, ive worked for plenty of companies that send out site-generated passwords. The password is stored encrypted and sent out once to the user. While not the most secure, an attacker still wont be able to get to all of the plaintext passwords if they cracked into the database.

Re: Stop forcing arbitrary password rules

#169

Post by Natanael_L »

gambiting wrote: post #146
Natanael_L wrote: post #122

Earlier quoted context omitted.

It has literally been done already. Obscure African poems have been guessed.

By people who knew to look for obscure african poems? I mean sure, you could guess a Polish sentence if you used a Polish dictionary, but how likely is that?

Very, because password crackers are literally including everything they can come over.

Re: Stop forcing arbitrary password rules

#170

Post by just_curioussss »

JoeAltmaier wrote: post #118
DanBC wrote: post #112

Earlier quoted context omitted.

With diceware there's a list of 7776 words. When someone rolls 1,1,1,1,1 and rejects that word they've cut down the word list to 7775 words. That's tiny, but it is a change.

Right, for word choice it is significant. I was thinking, rejecting the whole password pattern.

By rejecting a certain pattern you weakening the whole password scheme. It is no longer random, it is human chosen.

An attacker can under certain circumstances exploit this behavior. For example, if they notice you are picking shorter words or words that consist of certain characters, they will have an easier time to crack the password. Whole categories or patterns can be rejected because of that, reducing the search space.

An extreme version of your method, is picking only the patterns that relate exclusively to you, like picking your favorite music or hobbies. Then the whole scheme becomes useless.

Post reply on HN