Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules Are Bullshit

blog.codinghorror.com

Post reply on HN
Print view View original

111–120 of 283 posts

Re: Password Rules Are Bullshit

#111

Post by aleksei »

tboyd47 wrote: post #97
aleksei wrote: post #61

Earlier quoted context omitted.

> if the user getting their password stolen is not a problem for you because it's not your responsibility to handle these issues (like a hacker news account for instance) then just let the user pick whatever they want and deal with the consequences. If they care enough about it they'll care enough to pick a decent password. Surely that's a cop-out? If the user getting their data stolen is not a big deal for you, why…

I guess Atwood's point is that it's impossible for developers to stop users from creating dumb passwords just using regexes. That much is true. Even if you require an uppercase letter, lowercase letter, special character, and number, you're still going to have a lot of passwords like "Password_1" coming in. And then, if you require people to change their password every so often, it will become "Password_2," "Password…

Okay, I see the issue regarding regexes.

However I take offense at the notion of "babying" users. We are all babied in some aspect of our lives: if it weren't for the active work and intervention of those in other fields, we wouldn't know whether the food we eat is safe, or if the roof isn't going to collapse during the night. I'd like developers to assume some responsibility for their users in turn.

But I concede that may be beside the point in the case of password rules.

Re: Password Rules Are Bullshit

#112

Post by SapphireSun »

nerdponx wrote: post #59
coldpie wrote: post #49

Earlier quoted context omitted.

I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords. What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on th…

I was wondering this as I read it as well. Yes, we know it would be fairly easy to compromise an individual account by guessing common passwords. But that assumes you have one particular account in mind. If you're just looking for bank accounts to access, you first need a list of usernames to try (ideally usernames of non-tech-savvy people) and then you need to run your entire password guessing routine for each one.…

The last time a company had their password hashes exfiltrated. All the common passwords are quickly broken.

Re: Password Rules Are Bullshit

#113

Post by pbhjpbhj »

bambax wrote: post #74
simias wrote: post #25

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…

Totally agree. If you annoy the user too much, they will not try to circumvent your rules, they will leave and find something else to do with their time. Also, the big question that's missing from the article is: who's the enemy? If the enemy are Russian genius hackers, then certainly very long passwords and maybe other measures are in order. But the enemy is not always remote. I just bought a new iPad and had to res…

>What I do personally is type random things as the answers, and write them down somewhere. But that doesn't improve security, it weakens it. //

It weakens it to the extent of your physical security. But in practice how many crackers are breaking in to your flat [aka condo] to find your written down security responses, unless you're famous - or a target some other way (politician?) - in which case you should have sufficient physical security to protect the written answers.

Having security questions allows users to use hard passwords without the problem of losing an account. It increases the risk of personal attacks, for sure, but I'd warrant the chance of personal attack [ie by someone who knows you (or has gone through your bins)] is minimal for most people vs. the chance of an automated online attack.

I think it's right to minimise the online attack surface at the risk of the offline one for most users.

Re: Password Rules Are Bullshit

#114

Post by ajmurmann »

I've been intrigued by trying to circumvent passwords completely. On the vast majority of websites your password already is only as secure as your associated email account. You control the email you can reset the password. So maybe we can build on that? Instead of entering a password I entered a code that gets emailed to me either manually out via link. For important things we can airways supplement with another token from a TFA app or better TFA device. I'd argue that this would be more secure for the average user and more convenient for at least some users and use cases. I personally would find this mildly annoying on my laptop where I'm already logged in to a password manager, but convenient on my phone where logging in to a password manager is a major pain. Cheapshark.com does something similar and as a user I find it a great experience. It's more of an obvious fit for something like this where your account isn't very valuable and you use infrequently, but it's really no less secure.

Re: Password Rules Are Bullshit

#115

Post by mathw »

crottypeter wrote: post #52
lsaferite wrote: post #13

Earlier quoted context omitted.

I read a recent anecdote bout a similar issue. The person had their long password silently truncated to 21 chars on the reset page and 20 chars on the login page. That sounds like a super fun thing to track down as an end user.

(UK mobile network) giffgaff.com does this. You can enter any length (as far as I can tell) on the "set password" form but the login form will only submit 25 chars. This means you can successfully set your password to something you can never enter! It has been raised in their forum but the discussion there is drowned out by people missing the point entirely. https://community.giffgaff.com/t5/Help-Support/Password-Lim…

I've run into this kind of issue before. I had an 11-character password silently truncated to 10 on signup, then when I typed the full one into the login form it failed to log in.

Woo. Can't remember what clue the system gave me that let me figure out what had happened now.

Re: Password Rules Are Bullshit

#116

Post by dahart »

Password rules are especially bullshit on mobile devices where the pain of caps (requiring shift key) and the pain of special characters (often requiring a change of keyboard) are extra severe punishments.

A long all-lowercase pass phrase that's pronounceable is both safe and easy to remember and easy to type on mobile devices. When I hit sign ups that require other characters while on a tablet, I frequently decide I don't need it and bail out.

Re: Password Rules Are Bullshit

#117

Post by tomjen3 »

noja wrote: post #2

Rule 1 is that password rules are bullshit, but all of the other rules lead to needing Rule 1: how are you going to explain to a user that their password cannot be their username, or that their password needs more entropy or complexity?

Don't allow them to select one, assign them one and reset it as needed.

Re: Password Rules Are Bullshit

#118

Post by jondubois »

x1798DE wrote: post #109
jondubois wrote: post #28

I'm surprised that this article didn't mention the most important point about password rules: They force you to come up with a new password that you probably haven't used before and so you will probably forget it. There are websites that I don't use often where I literally have to reset the password (and go through all the i-forgot-my-password steps) every time I want to log in because they forced me to come up with…

You really shouldn't be re-using passwords across sites anyway, since all your accounts are compromised if any of them are compromised. Since re-using passwords is a problem solved by using a password manager, I'm assuming you're not using one, in which case you likely won't even remember the list of sites where you have accounts that have a shared password if you need to change it when any of the other sites are com…

Most of my accounts use my low-security password, I don't care much if they all get compromised. I only use my high-security password on 1 site.

Password managers are horrible - Whenever I change machines, I could never remember all my passwords and I certainly don't want to store my passwords in the cloud.

Re: Password Rules Are Bullshit

#119

Post by pbhjpbhj »

JulianMorrison wrote: post #92
simias wrote: post #25

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…

Imposed passwords aren't the only solution. Something like Google Authenticator is an alternative. Or key fobs. Or send a confirmation code to their phone. Or something like Barclays' PINsentry [1] for cards where you need the gadget, the card and the PIN. Or face recognition, which I recently saw demonstrated (it includes liveness checks like asking you to blink). [1] http://www.barclays.co.uk/Helpsupport/UpgradetoP…

Authenticator is great, but then you get the arsehole effect - every arsehole company decision maker wants you to only use their authenticator. So, I made an account on MS recently and can't use GA because "fuck you user, we won't stop until we own every facet of your digital existence" or something. That shows you where such companies rank security.

[FWIW I expect the reverse situation is probably the same, this is just my anecdotal experience].

Re: Password Rules Are Bullshit

#120

Post by accountface »

ajmurmann wrote: post #100
accountface wrote: post #94

Earlier quoted context omitted.

You don't care about the account, but the admin should. Look at all the compromised account issue on twitter. There's spam everywhere.

So they can ban the spammer?

Then you're effectively banning someone's existing account, which they could have been using for years at that point. There's a lot of potential content there. Not a great feeling for anyone.

Seems like the simplest solution is to have some basic password requirements.

Post reply on HN