Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules Are Bullshit

blog.codinghorror.com

Post reply on HN
Print view View original

31–40 of 283 posts

Re: Password Rules Are Bullshit

#31

Post by koolba »

nerdponx wrote: post #3

Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…

> Why? Because my password in the "create" page was silently truncated on the front end, but the same truncation does not occur in all places, so I would type a longer password on the login page then what was registered in the system and it would fail.

Here's an even worse one than truncating the end of long passwords: truncating internal whitespace

The change/reset password dialog for Apple ID does this. If your password is "foo bar baz bam" then it will happily convert it to "foobarbazbam" but not tell you it did so. Then when you go to log into your Apple ID on your phone, you include the whitespace, you try repeatedly and then lock your account (temporarily). Then you do it again...

Some general advice is:

- Don't silently truncate anything (i.e. don't limit the length)

- Don't silently remove anything (i.e. don't remove whitespace)

- Don't silently transmute anything (i.e. don't convert to lowercase)

- Don't have a password max length with a limit less than $BIG_NUM chars[1]

- Do give the user feedback rather than silently doing anything.

[1]: You're hashing them anyway right? So the storage doesn't change. Though if you're using something like bcrypt be aware of the max hashed length: https://security.stackexchange.com/questions/39849/does-bcry.... Also you can work around that by hashing the entire uses password (with say SHA-512) prior to inputting into bcrypt.

Re: Password Rules Are Bullshit

#32

Post by andrewclunn »

mysecretpassword > Ae2!_jT7

from a security standpoint. I hate the required special characters BS, especially since other sites will explicitly restrict you from using those same characters. Seriously, without a password manager of some kind I don't know how people can function online.

Re: Password Rules Are Bullshit

#33

Post by Brendinooo »

simias wrote: post #25

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…

>but if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. So why even bother?

I agree. Sometimes I'm just signing up to a site where I don't put any personal info up, or at least nothing more sensitive than my name. Why do I need high-level security there?

Re: Password Rules Are Bullshit

#34

Post by lloeki »

Travel to some other side of the world and France's CNIL recommends[0] the following password rules as of 27 Jan 2017 (abridged):

- if the system uses a login + password scheme: 12 chars min and mandatory mix of all among non-caps/caps/digit/special

- if the system uses a login + password + time-based exponential backoff rate limiting with a baseline of 1 min after 5 tries maxxing at 25 per 24h or lockout after 10 tries or a bot detector such as captcha: 8 chars min and mandatory mix of 3 among non-caps/caps/digit/special

- if the system uses login + password + environmental information (such as IP or MAC addr, etc...) + time-based exponential backoff rate limiting with a baseline of 1 min after 5 tries maxxing at 25 per 24h or lockout after 5 tries or a bot detector such as captcha: 5 chars

- if the system uses login + password + hardware second factor (SIM, U2F, YubiKey...) + lock out after 3 tries: 4 chars

To fend off in-transit and offline attacks, the document suggests that auth should transit sufficiently encrypted (using a cipher or method currently recognised as strong and non-vulnerable) and passwords should be stored obfuscated using a secure (similarly defined as strong and non-vulnerable) one-way cryptographic function with salt (and possibly pepper since they mention a "key", which makes no sense for one-way crypto functions).

[0]: https://www.legifrance.gouv.fr/affichTexte.do;jsessionid=DCF...

Re: Password Rules Are Bullshit

#35

Post by sverige »

simias wrote: post #25

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…

Yes and yes! Many throwaway accounts I have use some variation of the same password, because I don't care if someone hacks my HN or reddit or youtube account. I don't use my real name on any of them. If I lose control of it, I'll just make a new one. (Karma doesn't pay the bills, and I don't make money from my very excellent youtube comments; someone else does.)

This is why all these accounts get an email account that doesn't include my real name, too. There are so many sites that have these signup dialogs that require an email address -- why? Oh yeah, that's right, user data is the oil that will fuel the future economy.

Re: Password Rules Are Bullshit

#36

Post by amatix »

baron816 wrote: post #18

Why not get rid of passwords completely and just send a link to log in to the user's email address?

Particularly for sites where you're unlikely to return for months/years (government, utilities, charities, small ecommerce sites) this is a fantastic approach.

Re: Password Rules Are Bullshit

#38

Post by corobo »

simias wrote: post #25

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…

> if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing

You do. A lot of users don't consider automation when it comes to people hacking their account. I've heard "Nobody will ever guess it though" a few times during my career.

Re: Password Rules Are Bullshit

#40

Post by krapp »

empath75 wrote: post #37

Why don't we dispense with the pretense that passwords should be human readable strings of characters at all, and just make them a sequence of randomly generated bits.

Passwords often need to be human readable because, in practice, humans often need to memorize them and then enter them from memory, or write them down on a piece of paper first, which can be error prone with a complex password.

Using a password manager isn't always an option either - there is a vast amount of infrastructure, much of it corporate and nearly immutable - that simply presents the user with a password prompt and expects them to get it right.

It's only recently that some password prompts even let you view the password you've typed. With a terminal, you get no visual feedback at all.

Post reply on HN