How about allowing special characters and not just a-zA-Z0-9.
Dumb Password Rules
11–20 of 86 posts
Re: Dumb Password Rules
#12Stack Overflow is the offender that's affected (and surprised) me most in terms of arbitrary requirements. though
It's a while since I've tried changing my password there so not sure if it's changed.
Re: Dumb Password Rules
#13How about allowing special characters and not just a-zA-Z0-9.
Usually, there is some legacy system behind the scenes that can't be updated because reasons. Not an excuse, but it isn't always that easy.
Re: Dumb Password Rules
#14In the same spirit, can we please do away with the idea of expiring passwords -- and then enforcing that we can't even re-use our last X number of passwords. It just causes locked out accounts, written down passwords or adding on one more of whatever character was at the end.
There is a specific reason for having "cant reuse last X number of passwords" combined with having an "expiring password" rule.
The idea is that if someone was silently in your account, and doing a "stealth" attack - then they could change your password, then change it back to your original password, thus "resetting" your expiring password timer, giving them more time in the system - and you would not know that the password was reset. Preventing old passwords prevents this.
Note: The only flaw I never understand with the above is cant the attacker just change the password like 10-15 times in 5mins, and thus "flush" out the old password?
Note 2: I dont personally agree with expiring passwords - but it helps understand the reason why it exists.
Re: Dumb Password Rules
#15In the same spirit, can we please do away with the idea of expiring passwords -- and then enforcing that we can't even re-use our last X number of passwords. It just causes locked out accounts, written down passwords or adding on one more of whatever character was at the end.
There is a specific reason for having "cant reuse last X number of passwords" combined with having an "expiring password" rule. The idea is that if someone was silently in your account, and doing a "stealth" attack - then they could change your password, then change it back to your original password, thus "resetting" your expiring password timer, giving them more time in the system - and you would not know that the p…
> The only flaw I never understand with the above is cant the attacker just change the password like 10-15 times in 5mins, and thus "flush" out the old password?
In systems where you have the "can't use previous N passwords" when changing it, you also pair that with a "can't change password more than X times a time increment".
Re: Dumb Password Rules
#16A university that I'm applying to has a particularly stupid requirement on their login portal, but since I'm a prospective student, I don't think it'd be wise for me to name and shame.
Re: Dumb Password Rules
#17A university that I'm applying to has a particularly stupid requirement on their login portal, but since I'm a prospective student, I don't think it'd be wise for me to name and shame.
Come back and contribute to this once they've made a decision. :)
Re: Dumb Password Rules
#18In the same spirit, can we please do away with the idea of expiring passwords -- and then enforcing that we can't even re-use our last X number of passwords. It just causes locked out accounts, written down passwords or adding on one more of whatever character was at the end.
There is a specific reason for having "cant reuse last X number of passwords" combined with having an "expiring password" rule. The idea is that if someone was silently in your account, and doing a "stealth" attack - then they could change your password, then change it back to your original password, thus "resetting" your expiring password timer, giving them more time in the system - and you would not know that the p…
That thought requires the users to actually use new and unique passwords on every reset. If the attacker knows that your password is "Password1!!!!", it's pretty easy to guess that the next time it asks you for a password it will be "Password1!!!!!". We're all computationally lazy after all.
I feel like the notifications that X device was recently used to login from Y IP/location solve that problem in a much easier way.
Re: Dumb Password Rules
#19In the same spirit, can we please do away with the idea of expiring passwords -- and then enforcing that we can't even re-use our last X number of passwords. It just causes locked out accounts, written down passwords or adding on one more of whatever character was at the end.
There is a specific reason for having "cant reuse last X number of passwords" combined with having an "expiring password" rule. The idea is that if someone was silently in your account, and doing a "stealth" attack - then they could change your password, then change it back to your original password, thus "resetting" your expiring password timer, giving them more time in the system - and you would not know that the p…
err in that attack how do they know your original password to change it back? and if they know your password to change it back why bother changing it in the first place, why not just log in as you?
AFAIK the reason for password history is where periodic password change is enforced, to prevent a user from just alternating between two passwords.
enforced periodic password change is (in the general case) not great for security, luckily we're starting to see official guidance which recognizes this https://www.ncsc.gov.uk/guidance/password-guidance-simplifyi...
Re: Dumb Password Rules
#20My favorites are the ones where you can't use more than a certain number of characters or where you can't use special characters.
Amex website had their max password length of 8 characters. Not sure if they changed it. Even if you do have a system constraint, you could just lop off the extra characters and the user wouldn't probably never notice.