51–60 of 86 posts
I created an issue for this, but one really dumb thing is inconsistent password verification. Bestbuy will let you use anything for a password but on login really long passwords will trip it up. Been able to reproduce it a few times with 64 character passwords generated from 1pass.
I use KeePass to store all of my (randomly generated) passwords. One ongoing annoyance is that it's increasingly difficult to generate a random string will be meet a given site's Dumb Password Rules, because so many sites have them, and there's surprisingly little overlap in the rules. I would really like to see a database of sites and their corresponding Dumb Password Rules, so that I can tell KeePass (or any other…
KeePass should let users configure a pattern for passwords, like "8-25 letters or numbers or these symbols, must have 1 uppercase letter", and just replicate that socially (the pair of web site and pattern) across all KeePass users.
How about allowing special characters and not just a-zA-Z0-9.
Sites that don't cleanse the user input properly.
The last time I researched this, I found a number of different opinions, but they ultimately trended toward it being a "good idea", with the caveat that the words need to be chosen by a truly random process, and not by the user (as then bias would creep in).
I'm not a cryptographer, though - maybe someone(s) here is and can give some further insight?
Also - if such a password is a good thing, it would probably be best to use it for a password manager, and let the manager generate long random passwords for individual logins.
If XKCD-936 is considered ok, then in theory, as long as the password field allows for reasonably long passwords (25+ characters), and simple letters and numbers - it should be ok.
The problem would then be education (for the users and developers - plus convincing IT/security/management) - we've all been conditioned that passwords need to appear complex (not that they actually are for a computer). Then of course, there's the problem that this is baked into financial/banking security rules passed by Congress (so if XKCD-936 is correct, it basically means we've legislated an insecure practice in place, based on faulty knowledge at the time, for the one area where we need the most security possible)...
Thoughts?
Earlier quoted context omitted.
KeePass should let users configure a pattern for passwords, like "8-25 letters or numbers or these symbols, must have 1 uppercase letter", and just replicate that socially (the pair of web site and pattern) across all KeePass users.
Sounds like a good idea at first, but could also be a huge attack point.
Allowing some basic rule-setting, though, sounds quite nice. Arbitrary restrictions will probably leave people setting bad passwords, but there are some very common flags like "must have a special character" or "can't have a special character" that it'd be convenient to access for these sites.
I use KeePass to store all of my (randomly generated) passwords. One ongoing annoyance is that it's increasingly difficult to generate a random string will be meet a given site's Dumb Password Rules, because so many sites have them, and there's surprisingly little overlap in the rules. I would really like to see a database of sites and their corresponding Dumb Password Rules, so that I can tell KeePass (or any other…
KeePass should let users configure a pattern for passwords, like "8-25 letters or numbers or these symbols, must have 1 uppercase letter", and just replicate that socially (the pair of web site and pattern) across all KeePass users.
Popular German bank „Sparkasse“ has this great online banking system that allows you only 5 characters (Small and large, numbers, umlauts and eszet[1]). They call it a PIN (Personal identification /number/), but IMO its terribly insecure. [1] https://en.wikipedia.org/wiki/%C3%9F
5 characters with those options obviously isn't enough, but it's still better than "four digit numeric", which is also out there. That's such a small space that you can try it by hand, for god's sake.
I use KeePass to store all of my (randomly generated) passwords. One ongoing annoyance is that it's increasingly difficult to generate a random string will be meet a given site's Dumb Password Rules, because so many sites have them, and there's surprisingly little overlap in the rules. I would really like to see a database of sites and their corresponding Dumb Password Rules, so that I can tell KeePass (or any other…
KeePass should let users configure a pattern for passwords, like "8-25 letters or numbers or these symbols, must have 1 uppercase letter", and just replicate that socially (the pair of web site and pattern) across all KeePass users.