I created an issue for this, but one really dumb thing is inconsistent password verification. Bestbuy will let you use anything for a password but on login really long passwords will trip it up. Been able to reproduce it a few times with 64 character passwords generated from 1pass.
Dumb Password Rules
41–50 of 86 posts
Re: Dumb Password Rules
#42In the same spirit, can we please do away with the idea of expiring passwords -- and then enforcing that we can't even re-use our last X number of passwords. It just causes locked out accounts, written down passwords or adding on one more of whatever character was at the end.
There is a specific reason for having "cant reuse last X number of passwords" combined with having an "expiring password" rule. The idea is that if someone was silently in your account, and doing a "stealth" attack - then they could change your password, then change it back to your original password, thus "resetting" your expiring password timer, giving them more time in the system - and you would not know that the p…
WRT your note, some security policies (I don't remember which of them do it off the top of my head, but things like DoD STIG, PCI-DSS, NIST, CJIS, etc.), require a minimum time (e.g. 1 day) between password changes to prevent exactly this.
It doesn't seem that common in the corporate world or typical web apps, though.
Re: Dumb Password Rules
#43Earlier quoted context omitted.
There is a specific reason for having "cant reuse last X number of passwords" combined with having an "expiring password" rule. The idea is that if someone was silently in your account, and doing a "stealth" attack - then they could change your password, then change it back to your original password, thus "resetting" your expiring password timer, giving them more time in the system - and you would not know that the p…
Although, a lot of accounts send immediately E-mail on changes (e.g. bank says “the password on your account was changed” so you would know if someone was changing it and changing it back). It actually seems pretty reasonable to send E-mails on every single account update, as some sites do.
Perhaps you would notice. The average user, however, would probably then try to log in to their bank (with their usual password), get in just fine, and then think something along the lines of "oh, the bank's system must be screwed up again" and forget about it.
Re: Dumb Password Rules
#44My favorites are the ones where you can't use more than a certain number of characters or where you can't use special characters.
Or when the system truncates a long password during password creation and doesn't tell you. Then when you log in, the full password fails.
Re: Dumb Password Rules
#45> - Must be at least 8 characters long > - Include at least 1 number > - Include at least 1 uppercase letter > - Include at least 1 lowercase letter > - May use special character "Password1"
From a past job:
> - Must be at least 8 characters long
> - Include at least 1 number
> - Include at least 1 uppercase letter
> - Include at least 1 lowercase letter
> - Include at least 1 non-alphanumeric character
> - Must not reuse a previous password
> - Expires every month
Re: Dumb Password Rules
#46I use KeePass to store all of my (randomly generated) passwords. One ongoing annoyance is that it's increasingly difficult to generate a random string will be meet a given site's Dumb Password Rules, because so many sites have them, and there's surprisingly little overlap in the rules. I would really like to see a database of sites and their corresponding Dumb Password Rules, so that I can tell KeePass (or any other…
KeePass should let users configure a pattern for passwords, like "8-25 letters or numbers or these symbols, must have 1 uppercase letter", and just replicate that socially (the pair of web site and pattern) across all KeePass users.
Sounds like a good idea at first, but could also be a huge attack point.
Re: Dumb Password Rules
#47While we're at it, can we also shame the banks which ask you "third", "fourth" and "ninth" character of your password + date of birth to login? Clearly they're storing the password in Plaintext (otherwise the "random" characters can't be matched).
I know Thomas Cook did this with their pre-paid forex mastercards which I happen to use while travelling abroad.
Re: Dumb Password Rules
#48Joel Califa's "Patronizing Passwords" has some great examples: http://joelcalifa.com/blog/patronizing-passwords/
Thanks for the article, I enjoyed the read
Re: Dumb Password Rules
#49My favorites are the ones where you can't use more than a certain number of characters or where you can't use special characters.
Amex website had their max password length of 8 characters. Not sure if they changed it. Even if you do have a system constraint, you could just lop off the extra characters and the user wouldn't probably never notice.
Mine is way more than eight characters (randomly generated w/ KeePassX), although I haven't tried truncating it to eight and seeing what happens.
Re: Dumb Password Rules
#50Honest question: does password strength actually matter that much in practice? Do people using "horse" get hacked more often than using "zjh5?&Dp"? Is there a point of diminishing returns where "horse23" is basically good enough? Has anybody studied this in a systematic way?