They want me to enter upper case letter. I enter Ö and it doesn't accept it
Stop forcing arbitrary password rules
181–190 of 196 posts
Re: Stop forcing arbitrary password rules
#182Apologies if this is a common held practice which i'm unaware, but why not establish a policy amounting to: "if the system-admin can't somewhat trivially crack your password then i won't bug you about it". That is, allow any password, then if your chosen crack software can't crack that password, leave them alone. If you can crack it then: "Please select another password, as our trivial cracking software discovered it". This would strike me as a less user burdensome method which would be more generally secure than every 13 weeks: "9-12 characters including one of each of the following set"
Re: Stop forcing arbitrary password rules
#183Earlier quoted context omitted.
There is a bank which shall remain nameless ( Schwab ) which not only silently truncates passwords to 8 characters, but also performs a case insensitive match. They say they're working on fixing it but it's taking an awfully long time.
As long as you throttle login attempts short passwords are fine. EX: 6 digit pin on a debit card might seem useless, but if you only get 3 tries per day that's just not an issue. ~10-20 failed attempts per day per IP + some rules to check for multiple IP's per account and 8 lowercase letters - most common passwords is actually reasonable.
> As long as you throttle login attempts short passwords are fine.
Not if the password-hash database leaks.
Re: Stop forcing arbitrary password rules
#184I was looking for a cloud MongoDB provider, so I found MongoLab then I tried to register. It didn't let me because my password didn't have a number in it, do you want to know the password I used? Here's the password:
U\"&%x#vdE
I asked the support and he said this:
Not all of our users are as savvy with security concerns.
I wish them to get rich with their non-savvy users, best of luck to them.
Re: Stop forcing arbitrary password rules
#185"Through 20 years of effort, we've successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess." Wow.
Re: Stop forcing arbitrary password rules
#186Earlier quoted context omitted.
99% is probably stolen passwords and 0.0001% brute forced passwords.
No, 99% are the ones copied from a password manager application.
If there is a Trojan, it can read the clipboard data. But most ppl save their password unencrypted. And can then be found by exploits in browser, java, flash, etc. Or unknowingly sharing the password file on a file-sharing network :P
It's more secure to write it down on a piece of paper, then saving it on your hdd and copy/paste into the password box.
Re: Stop forcing arbitrary password rules
#187Earlier quoted context omitted.
No, 99% are the ones copied from a password manager application.
If there is a Trojan, it can read the clipboard data. But most ppl save their password unencrypted. And can then be found by exploits in browser, java, flash, etc. Or unknowingly sharing the password file on a file-sharing network :P It's more secure to write it down on a piece of paper, then saving it on your hdd and copy/paste into the password box.
Why should a trojan bother to read files or clipboard data when it can read the password directly from the input field? You don't even need a trojan for this purpose, simple XSS at the right spot is sufficient. This means it's irellevant wether you write it on paper or in a file, since the password will be stolen when it's entered. The only thing you can do is to make sure your password is long enough so it can't be guessed, and that's where a password manager will help you.
Re: Stop forcing arbitrary password rules
#188Second worst password rule: preventing to paste in the password field. As seen at The OS X FileVault dialog, PayPal, Blizzard and many more....
Chrome hackaround: 1. Right-click the field, Inspect element. 2. Go to Console tab, type: $0.value = 'mypassword'; $0 is the last selected element: https://developer.chrome.com/devtools/docs/commandline-api
That's good for browser passwords, but finding out that your 64 character password can't be pasted in the system dialog after erverything is set up is extremely frustrating (there is a hard to find command line workaround though). I think Blizzard enforces the no-paste rule in its Battle.net launcher (that you can't trick) but I'm not 100% sure.
Re: Stop forcing arbitrary password rules
#189Allowing 100,000 login attempts per second is in itself insecure! Using longer passwords in that case is just treating the symptoms of a bad security strategy.
Good security strategy: Have many layers of security! For example: Limit the login attempts to max ten tries. And another layer, whether you like it or not is to make users not use their "standard" password.
More security layers: hash+random salt, SSL, password timing, logging, 2-way authentication, hiding, white-listing, ... a strong password =)
Please note the difference between cryptography and password authentication though. In cryptography, a longer key is most likely always better.
Re: Stop forcing arbitrary password rules
#190I use pwsafe for iOS (yes trusting some guy built a binary ok) to keep my many passwords for each domain. It will generate (no I don't know the RNG) passwords based on policy settings (length, characters, etc) And like the author, flat out my number one bugbear is that no matter what random(ish) password I choose before signing up, some idiot will decide that my 12 letter password is too long or my password must have…
And then you lose your phone and...
Pretty much the same as everything else that happens when I lose my phone. Total disaster.