Dumb Password Rules
github.com
Dumb Password Rules
1–10 of 86 posts
Re: Dumb Password Rules
#2 > - Must be at least 8 characters long
> - Include at least 1 number
> - Include at least 1 uppercase letter
> - Include at least 1 lowercase letter
> - May use special character
Re: Dumb Password Rules
#3Joel Califa's "Patronizing Passwords" has some great examples: http://joelcalifa.com/blog/patronizing-passwords/
Re: Dumb Password Rules
#4You can add Voat to the list, it has one of the most frustrating sign-up processes known to man. Most of the rules are hidden until you solve the captcha and press submit.
Re: Dumb Password Rules
#5In the same spirit, can we please do away with the idea of expiring passwords -- and then enforcing that we can't even re-use our last X number of passwords. It just causes locked out accounts, written down passwords or adding on one more of whatever character was at the end.
Re: Dumb Password Rules
#6Some of the restrictions of special characters I can somewhat understand: Depending on the keyboard layout, many of these often disallowed characters require proper right-alt support to be set up in order to be typed.
People tend to get these wrong or to be unaware of the currently set keyboard layout which will cause support issues.
Same goes for non-ASCII characters where this also depends on the browser configuration and version as they still get the encodings wrong at times.
Yes. For us advanced users using password managers this is a non-issue as we're pasting anyways, but for people typing the passwords manually, this can be a problem.
Case in point is me setting up new linux boxes and always using a safe initial password (long but pure ASCII) knowing that I'can't be absolutely sure I've configured the keyboard layout correctly. I've started this practice after having been forced to force-reset my password via the `init=/bin/sh` boot argument as the first step after the install :-)
What I absolutely don't get though is maximum lengths on passwords. You should be hashing them anyways, so setting a maximum length is completely pointless.
Re: Dumb Password Rules
#7My favorites are the ones where you can't use more than a certain number of characters or where you can't use special characters.
Re: Dumb Password Rules
#8In the same spirit, can we please do away with the idea of expiring passwords -- and then enforcing that we can't even re-use our last X number of passwords. It just causes locked out accounts, written down passwords or adding on one more of whatever character was at the end.
Sites with such strict rules should be enforcing 2FA instead.
Re: Dumb Password Rules
#9> - Must be at least 8 characters long > - Include at least 1 number > - Include at least 1 uppercase letter > - Include at least 1 lowercase letter > - May use special character "Password1"
Could be shorter.