i'd prefer no password validation other than having to type it twice. but have a password strength gauge, and give hints on how to bump up the strength (have you tried using a non-alphanumeric character)
Password Rules Are Bullshit
21–30 of 283 posts
Re: Password Rules Are Bullshit
#22I have to use Dashlane for work and it horrifies me that their password requirements are so outdated. A password manager ought to know that it's more important to have a longer password than a password with a number in it.
(See rules here: https://csdashlane.zendesk.com/hc/en-us/articles/202698981-I...)
Re: Password Rules Are Bullshit
#23So after explaining why [existing] password rules ere bullshit, author introduces his own ones.
Re: Password Rules Are Bullshit
#24Thou shall take care of the password manager, as it is a single point of failure. Because users (=not people who read and understand news from hnews, but the layman):
1 - won't make backup of the password manager (PM) database
2 - will forget sometimes the main password of the PM
3 - will loose the cellphone where the PM is installed
4 - will not update the PM
5 - will tell somebody else the PM password
And there will be many PM, some will have flaws, bugs or backdoors. Some will work on iOs but not on Android. Some will mess up in same point and make users lose trust.
And there will be sites with bad interface that won't accept copy-and-paste of the passwords. That will require things that your random-generated password doesn't contain. Will complain about something that it contains. Will do good on the password but will have those stupid questions (maiden name? grandfather name? pet name?) that you'll be able to find in any Facebook. Than the weak point becomes the password recovery.
I just found one type of requirement that was good enough to people take real care with the password: when the password is the one that allows anyone to withdraw cash from their account. When there is real money in the game, people take care.
Edit: misspelling, thanks for the warning!
Re: Password Rules Are Bullshit
#25I agree with almost everything but the he loses me towards the end:
> I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters.
Isn't that exactly what you're complaining about with your arbitrary password restrictions to begin with?
I mean, I can imagine that a clueless user might have the illusion of safety if they're using something like "1q2w3e4r5t" but if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. So why even bother?
I think there are two possible ways to look at this problem from a service provider perspective:
- if the user getting their password stolen is a bad thing for you (i.e., you're a bank or something like that, and getting an account compromised will put you in trouble), then IMO the only satisfactory solution is to impose a password to the user. In effect these ridiculous password requirements are exactly that, except less convenient and secure. Cut to the chase and say "your bank password is Axei5aoc0i, write it down somewhere safe".
- if the user getting their password stolen is not a problem for you because it's not your responsibility to handle these issues (like a hacker news account for instance) then just let the user pick whatever they want and deal with the consequences. If they care enough about it they'll care enough to pick a decent password. At most if you really want to be friendly give an indication that a password might be weak, but please don't disallow it.
Re: Password Rules Are Bullshit
#26I wish we could just avoid all of this by using methods like SRP[1] where the site wouldn't even need to know the plain-text password in the first place. Why am I giving a "secret" to someone else?
[1] https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...
Re: Password Rules Are Bullshit
#27Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…
Funny thing is this sort of password bug bit me on PayPal. PayPal of all places! Not sure if it was the length or a disallowed character, but no actual validation took place. Would let you "change" it to something and then never allow you login.
Re: Password Rules Are Bullshit
#28I'm surprised that this article didn't mention the most important point about password rules:
They force you to come up with a new password that you probably haven't used before and so you will probably forget it.
There are websites that I don't use often where I literally have to reset the password (and go through all the i-forgot-my-password steps) every time I want to log in because they forced me to come up with an overly creative password.
I think most people have two or three passwords for all their apps/services; one very secure one, one medium security one and one low security one (where you literally don't care if you get hacked). It's not the company's business to tell you which of those classes of passwords it deserves for its website.
Re: Password Rules Are Bullshit
#29As a side note, if you are a website with arbitrary rules, as a general UI recommendation, please state your rules if a user inputs an incorrect password. I'm looking at you yahoo.
Re: Password Rules Are Bullshit
#30I gave up on this long ago. I login to various accounts from different machines often enough that a password manager doesn't always work for me. I keep a printed paper copy of some 60 different passwords in my laptop bag in case I need to remember one for a new machine. That printed copy gets handwritten notes on it from time to time, which I then use to update the text file on a thumb drive when I'm not connected to the Internet. I print a new copy about every two months, I guess.
To add to the bullshit, it is so common that a site will have some idiotic rule (like "must include a number," "must have at least one lower (or upper) case letter," "must include a special character," "must not include any of these special characters," "must change password every 30 / 45 / 60 / 90 days"), that I don't even get mad about it anymore. I can't even spend the mental energy to send them an email.
Whew, thanks. I feel better now.