Password Rules Are Bullshit
blog.codinghorror.com
Password Rules Are Bullshit
1–10 of 283 posts
Re: Password Rules Are Bullshit
#2Rule 1 is that password rules are bullshit, but all of the other rules lead to needing Rule 1: how are you going to explain to a user that their password cannot be their username, or that their password needs more entropy or complexity?
Re: Password Rules Are Bullshit
#3Here's another problem that isn't discussed very much: error messaging and failure modes.
I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "create" page was silently truncated on the front end, but the same truncation does not occur in all places, so I would type a longer password on the login page then what was registered in the system and it would fail.
Other times a password that was too long or contained whitespace would fail with a cryptic error message, or would tell me I failed to meet some other password rule that I know I did not fail to meet.
I don't understand how something with so many widely-recognized best practices associated with it can be implemented badly.
Re: Password Rules Are Bullshit
#4Why don't we just stop allowing users to choose their passwords?
Re: Password Rules Are Bullshit
#5Rule 1 is that password rules are bullshit, but all of the other rules lead to needing Rule 1: how are you going to explain to a user that their password cannot be their username, or that their password needs more entropy or complexity?
Rule 5 rejects nulls; if your password is your username, you don't have a password.
Meanwhile my organization is getting ready to mandate the use of a password manager that uses bullshit rules to produce analytics to surface at the director/VP level. So it goes. I look forward to automating the GI that's used to produce this GO.
Re: Password Rules Are Bullshit
#6It should be mentioned that the NIST reference Jeff sites is only a draft, started last year. https://pages.nist.gov/800-63-3/sp800-63b.html
It's a great one. Not only does i recommend against composition rules, but
> Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)
Oh, if there is a sin against passwords it is forcing quickly memoizable (i.e. simpler) passwords.
Re: Password Rules Are Bullshit
#7Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…
The same way anything else well understood can be implemented badly: naïveté, incompetence, ignorant ukaze from on high, "well we had to have something but there wasn't enough time", or some combination thereof.
Re: Password Rules Are Bullshit
#8Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…
This is why the first thing I do when I create an account -- no exceptions as long as it's not a throwaway -- is always to log out and log back in.
If there was a problem with password truncation I'll know straight away and I can either figure out what the truncated password should be and switch it to something that isn't truncated or if that's impossible I can create a new account. If I'm unable to create a new account at least I'll know to stay away from them without having done anything important yet.
Re: Password Rules Are Bullshit
#9Reminds me of this joke:
Re: Password Rules Are Bullshit
#10Why don't we just stop allowing users to choose their passwords?
Because unless users are using a password manager, they need to be able to remember them (and anyone using a password manager is going to be generating secure passwords anyway)