Who cares about remembering passwords? Like my burner mobile phones, I use burner passwords. I use a one time password and the next time I need to log in to the website, I request my password to be reset and use the link that is emailed to me...
Password Rules Are Bullshit
71–80 of 283 posts
Re: Password Rules Are Bullshit
#72I find it interesting he mentions Emojis as I actually just recently wrote a deterministic password generator that uses the Emoji annotations (for word selection) for generating deterministic passwords from a master password: https://github.com/agentgt/ezpwdgen
Of course you could use the EFF word database but after trial and error I actually like the Emoji annotations [1] better (I obviously remove short words and non ascii stuff).
I plan on having the script show the words along with the corresponding emoji (iterm supports emojis) to help remember. The idea being not to copy and paste (I need practice on remembering stuff anyway... the joy of getting older).
Re: Password Rules Are Bullshit
#73I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…
> I mean, I can imagine that a clueless user might have the illusion of safety if they're using something like "1q2w3e4r5t" but if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. So why even bother? It's not an illusion, 1q2w3e4r5t is indeed better than aaaaaaaaa, even if it's just the numbers interleaved with qwerty (and probably easy to brute force generate up to it). > if I use "aaaaa…
> It's not an illusion, 1q2w3e4r5t is indeed better than aaaaaaaaa, even if it's just the numbers interleaved with qwerty (and probably easy to brute force generate up to it).
In this case, we're talking 'better' but still bullshit [1]. Calling it 'better' makes no meaningful distinction whatsoever in practice.
[1] https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.ht...
Re: Password Rules Are Bullshit
#74I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…
Totally agree. If you annoy the user too much, they will not try to circumvent your rules, they will leave and find something else to do with their time.
Also, the big question that's missing from the article is: who's the enemy? If the enemy are Russian genius hackers, then certainly very long passwords and maybe other measures are in order.
But the enemy is not always remote. I just bought a new iPad and had to reset my password and so-called "security questions".
In my experience, there are only two kinds of security questions: ones I don't know the answer to myself, and ones everyone around me knows the answer to (what was your first job, what was your surname when you were a child, etc.)
The problem is, in the case of the iPad, your enemy is not some James Bond villain in a cave in Ukraine, it's your 13 year old child who wants to use your account to buy apps, or your spouse during a nasty separation. And they both know, or can guess, answers to "security questions".
What I do personally is type random things as the answers, and write them down somewhere. But that doesn't improve security, it weakens it.
Re: Password Rules Are Bullshit
#75Not mentioned: Password reuse across sites. Have some check as to whether the same password can be used for the same username / email across other sites. I discovered this one early; back in 2000 I was an admin for a student portal at uni created by Virgin. As an admin I could manage people's accounts; including reset their passwords. The field for me to change their password had their current password; it was hidden…
Regular forced changed of passwords is generally a net-negative for security.
There's nothing wrong with changing if you think it's been breached or just 'cause you feel like it, but a system forcing change every 90 days is likely to be a bad idea.
This is due to the fact that when most user groups are forced into periodic change they will stick an enumerator at the end (e.g. password1, password2 etc) which ruins any benefit you might have got from it.
That's why we've (finally) started to see good official guidelines saying forced password rotation is a bad idea (e.g. https://www.ncsc.gov.uk/guidance/password-guidance-simplifyi... and https://nakedsecurity.sophos.com/2016/08/18/nists-new-passwo... )
Re: Password Rules Are Bullshit
#76Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…
> Why? Because my password in the "create" page was silently truncated on the front end, but the same truncation does not occur in all places, so I would type a longer password on the login page then what was registered in the system and it would fail. Here's an even worse one than truncating the end of long passwords: truncating internal whitespace The change/reset password dialog for Apple ID does this. If your pas…
Oh yeah! Freedompop actually transformed a space into a "+" (or vice versa). And this is just free internet I set up for my dad. Took us like an hour to figure that one out.
Re: Password Rules Are Bullshit
#77Rule 1 is that password rules are bullshit, but all of the other rules lead to needing Rule 1: how are you going to explain to a user that their password cannot be their username, or that their password needs more entropy or complexity?
Just spitballing, but it's possible that you could take the given password and derive the hashcat invocation that would generate the password. In the strictest case this is equivalent to computing the Kolmogorov complexity of the password, but there's an easier way: have a list of the X most common rules, and test the password against those. Once you have the rule, you can calculate how many possibilities exist in that search space and do a calculation ala GRC Haystack[1]. If it's the case that the list of rules doesn't have one that matches the password, that's probably good enough anyway.
Re: Password Rules Are Bullshit
#78I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…
Totally agree. If you annoy the user too much, they will not try to circumvent your rules, they will leave and find something else to do with their time. Also, the big question that's missing from the article is: who's the enemy? If the enemy are Russian genius hackers, then certainly very long passwords and maybe other measures are in order. But the enemy is not always remote. I just bought a new iPad and had to res…
I simply type passwords in the answers.
"What is your mother's maiden name?" - "gHk899iL@"
Re: Password Rules Are Bullshit
#79On the password front, I like the new NIST guidelines (summary here https://nakedsecurity.sophos.com/2016/08/18/nists-new-passwo... with links to the detail) and the UK NCSC guidelines https://www.ncsc.gov.uk/guidance/password-guidance-simplifyi... which favour far more realistic guidelines rather than the arbitrary nonsense of hard complexity rules and forced regular password resets.
Re: Password Rules Are Bullshit
#80I resisted for a while but now always use Google or Facebook account for sites that let me. Makes the password problems much simpler.
Special brickbat for American Express who doesn't let you use special characters in passwords - screwing up my system.