Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules Are Bullshit

blog.codinghorror.com

Post reply on HN
Print view View original

91–100 of 283 posts

Re: Password Rules Are Bullshit

#91

Post by borplk »

koolba wrote: post #31
nerdponx wrote: post #3

Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…

> Why? Because my password in the "create" page was silently truncated on the front end, but the same truncation does not occur in all places, so I would type a longer password on the login page then what was registered in the system and it would fail. Here's an even worse one than truncating the end of long passwords: truncating internal whitespace The change/reset password dialog for Apple ID does this. If your pas…

Extremely large password sizes can lead to a DDOS attack on the server (due to computation complexity curve). A large size such as 4096 characters is perfect. Don't accept a password that is 10GBs in size. But don't limit to MAX 16 characters either.

Re: Password Rules Are Bullshit

#92

Post by JulianMorrison »

simias wrote: post #25

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…

Imposed passwords aren't the only solution. Something like Google Authenticator is an alternative. Or key fobs. Or send a confirmation code to their phone. Or something like Barclays' PINsentry [1] for cards where you need the gadget, the card and the PIN. Or face recognition, which I recently saw demonstrated (it includes liveness checks like asking you to blink).

[1] http://www.barclays.co.uk/Helpsupport/UpgradetoPINsentry/P12...

Re: Password Rules Are Bullshit

#93

Post by jasonkostempski »

The biggest issue with passwords is using the same one with the same username everywhere. I knew this, still did it with accounts I didn't really care about (Netflix, Hulu, Skype, etc) and, of course, after 10 years of using the same one, just about every place I used it was getting accessed by someone else over the last few month. Writing down passwords and keeping them in plain site in your house is probably safer than using a username/password combo that you use a lot, on a system any script kiddie can get at.

Re: Password Rules Are Bullshit

#94

Post by accountface »

sverige wrote: post #35
simias wrote: post #25

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…

Yes and yes! Many throwaway accounts I have use some variation of the same password, because I don't care if someone hacks my HN or reddit or youtube account. I don't use my real name on any of them. If I lose control of it, I'll just make a new one. (Karma doesn't pay the bills, and I don't make money from my very excellent youtube comments; someone else does.) This is why all these accounts get an email account tha…

You don't care about the account, but the admin should. Look at all the compromised account issue on twitter. There's spam everywhere.

Re: Password Rules Are Bullshit

#95

Post by Artemis2 »

sontek wrote: post #81

I agree 100% with these complaints about some of us don't have a choice. For example, PCI requires: - Contain both numeric and alphabetic characters. - Users to change passwords at least every 90 days. - Password parameters are set to require that new passwords cannot be the same as the four previously used passwords. Which go against the NIST guidelines. So how do you do things that are considered "best practices" w…

I assume you are referring to the NIST SP 800-63-3, which is quite new (still a draft).

PCI DSS follows NIST guidelines quite closely. Requirement 8.2.3 reads "refer to industry standards (e.g., the current version of NIST SP 800-63.)". These requirements will probably be updated at the next version of the standard (and I hope they will!).

Re: Password Rules Are Bullshit

#96

Post by Tostino »

I totally agree that arbitrary password rules are not a good thing, they frustrate users to no end, and can make things less secure.

I really liked the zxcvbn library from Dropbox, as it allows you to catch those really egregiously bad passwords before it's too late, but is much smarter than any list of arbitrary rules could be. I actually wrote a similar library (nbvcxz - https://github.com/GoSimpleLLC/nbvcxz) for my company which implements all of the functionality of zxcvbn (and extends it as well) so I could use it on the server side.

Re: Password Rules Are Bullshit

#97

Post by tboyd47 »

aleksei wrote: post #61
simias wrote: post #25

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…

> if the user getting their password stolen is not a problem for you because it's not your responsibility to handle these issues (like a hacker news account for instance) then just let the user pick whatever they want and deal with the consequences. If they care enough about it they'll care enough to pick a decent password. Surely that's a cop-out? If the user getting their data stolen is not a big deal for you, why…

I guess Atwood's point is that it's impossible for developers to stop users from creating dumb passwords just using regexes. That much is true. Even if you require an uppercase letter, lowercase letter, special character, and number, you're still going to have a lot of passwords like "Password_1" coming in. And then, if you require people to change their password every so often, it will become "Password_2," "Password_3," etc. There's no easy way around this.

It is weird that he goes on to suggest a complex system of rules literally right after saying rules are bad, and that's the point where he lost me too.

If users don't understand what a good password is, they are going to eventually get an account compromised somewhere, if not on your site, then on another. In cases where there's no liability back to you, then there's no sense in babying them. If you do have liability, then two-factor authentication is probably a better way to go.

I personally would hate it if a company forced me to use their generated passwords because I like to manage my own passwords.

Re: Password Rules Are Bullshit

#98

Post by paulddraper »

simias wrote: post #25

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…

For what it's worth, the current NIST draft has the exact same recommendations:

> Verifiers SHOULD NOT impose other composition rules (e.g., mixtures of different character types) on memorized secrets.

> When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example, the list MAY include (but is not limited to):

> * Passwords obtained from previous breach corpuses.

> * Dictionary words.

> * Repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’).

> * Context specific words, such as the name of the service, the username, and derivatives thereof.

I suppose you could open a pull request :) https://github.com/usnistgov/800-63-3

Re: Password Rules Are Bullshit

#99

Post by paulddraper »

Artemis2 wrote: post #95
sontek wrote: post #81

I agree 100% with these complaints about some of us don't have a choice. For example, PCI requires: - Contain both numeric and alphabetic characters. - Users to change passwords at least every 90 days. - Password parameters are set to require that new passwords cannot be the same as the four previously used passwords. Which go against the NIST guidelines. So how do you do things that are considered "best practices" w…

I assume you are referring to the NIST SP 800-63-3, which is quite new (still a draft). PCI DSS follows NIST guidelines quite closely. Requirement 8.2.3 reads "refer to industry standards (e.g., the current version of NIST SP 800-63.)". These requirements will probably be updated at the next version of the standard (and I hope they will!).

Correct. Once the NIST draft is finalized, PCI standards will likely change quickly.

Re: Password Rules Are Bullshit

#100

Post by ajmurmann »

accountface wrote: post #94
sverige wrote: post #35

Earlier quoted context omitted.

Yes and yes! Many throwaway accounts I have use some variation of the same password, because I don't care if someone hacks my HN or reddit or youtube account. I don't use my real name on any of them. If I lose control of it, I'll just make a new one. (Karma doesn't pay the bills, and I don't make money from my very excellent youtube comments; someone else does.) This is why all these accounts get an email account tha…

You don't care about the account, but the admin should. Look at all the compromised account issue on twitter. There's spam everywhere.

So they can ban the spammer?
Post reply on HN