Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules Are Bullshit

blog.codinghorror.com

Post reply on HN
Print view View original

151–160 of 283 posts

Re: Password Rules Are Bullshit

#151

Post by ryandrake »

Raphmedia wrote: post #78
bambax wrote: post #74

Earlier quoted context omitted.

Totally agree. If you annoy the user too much, they will not try to circumvent your rules, they will leave and find something else to do with their time. Also, the big question that's missing from the article is: who's the enemy? If the enemy are Russian genius hackers, then certainly very long passwords and maybe other measures are in order. But the enemy is not always remote. I just bought a new iPad and had to res…

I simply type passwords in the answers. "What is your mother's maiden name?" - "gHk899iL@"

This is a good idea. Unfortunately if you have ever in the past (foolishly) answered these security questions honestly, you can't just now start answering them with your password, unless you keep track of which sites have your honest answers and which sites you just gave your password again.

Re: Password Rules Are Bullshit

#152

Post by hueving »

TuringTest wrote: post #143
lostlogin wrote: post #138

Earlier quoted context omitted.

It wouldn't really matter how good your password was in the leak/breach scenario would it?

It would, if [some fields of] the database is encrypted. Then the attacker could only get the content from accounts with weak passwords, not yours.

I know of almost nowhere that encrypts content with the user password. It means if the user resets the password because they forgot it, they lose content.

Re: Password Rules Are Bullshit

#153

Post by ryandrake »

nerdponx wrote: post #3

Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…

> I don't understand how something with so many widely-recognized best practices associated with it can be implemented badly.

The same reason why we have other kinds of crappy software: People try to do it themselves rather than using a robust, tested, third party solution.

Re: Password Rules Are Bullshit

#154

Post by jonknee »

jondubois wrote: post #118
x1798DE wrote: post #109

Earlier quoted context omitted.

You really shouldn't be re-using passwords across sites anyway, since all your accounts are compromised if any of them are compromised. Since re-using passwords is a problem solved by using a password manager, I'm assuming you're not using one, in which case you likely won't even remember the list of sites where you have accounts that have a shared password if you need to change it when any of the other sites are com…

Most of my accounts use my low-security password, I don't care much if they all get compromised. I only use my high-security password on 1 site. Password managers are horrible - Whenever I change machines, I could never remember all my passwords and I certainly don't want to store my passwords in the cloud.

> Password managers are horrible - Whenever I change machines, I could never remember all my passwords and I certainly don't want to store my passwords in the cloud.

1Password can sync locally which is a nice plus:

https://support.1password.com/wlan-server/

Re: Password Rules Are Bullshit

#155

Post by camiller »

neikos wrote: post #82
sverige wrote: post #35

Earlier quoted context omitted.

Yes and yes! Many throwaway accounts I have use some variation of the same password, because I don't care if someone hacks my HN or reddit or youtube account. I don't use my real name on any of them. If I lose control of it, I'll just make a new one. (Karma doesn't pay the bills, and I don't make money from my very excellent youtube comments; someone else does.) This is why all these accounts get an email account tha…

Two ways why I think E-Mails are useful at signup: - Password Recovery (this can be optional though, for my sites it usually is) - 'Legit Users', sending an email and having them confirmed through a code in them gives a bit more confidence in the user

'legit users'

There isn't a day that goes by that I don't get an email intended for someone else, often including personal information, due to a mistyped email address. Whoever decided that email verification was a poor user experience needs to be hit in the head with a shovel after he digs the appropriate sized hole.

If you know Catherin (PA) let her know her round trip to vegas is confirmed

Carolyn's (NYC) open table reservation was canceled by the restaurant.

Different Carolyn (CA) needs to correct email address with the walnut creak school district.

Possible the same Catherine (PA), your financial advisor needs a distribution form filled out.

Clint (OH), your repair at Kay jewelers in Akron is done.

Ann (FL), Thank you for scheduling an online appointment with Conley Subaru

sigh, you get the idea

Edit: Oh, and I'm going to start canceling Open Table reservations that show up in my inbox.

Re: Password Rules Are Bullshit

#156

Post by bambax »

pbhjpbhj wrote: post #113
bambax wrote: post #74

Earlier quoted context omitted.

Totally agree. If you annoy the user too much, they will not try to circumvent your rules, they will leave and find something else to do with their time. Also, the big question that's missing from the article is: who's the enemy? If the enemy are Russian genius hackers, then certainly very long passwords and maybe other measures are in order. But the enemy is not always remote. I just bought a new iPad and had to res…

>What I do personally is type random things as the answers, and write them down somewhere. But that doesn't improve security, it weakens it. // It weakens it to the extent of your physical security. But in practice how many crackers are breaking in to your flat [aka condo] to find your written down security responses, unless you're famous - or a target some other way (politician?) - in which case you should have suff…

If you're famous, answers to security questions can usually be found in the Wikipedia page about you, so you pretty much have to make them up.

Re: Password Rules Are Bullshit

#157

Post by tromp »

GrinningFool wrote: post #125
Raphmedia wrote: post #78

Earlier quoted context omitted.

I simply type passwords in the answers. "What is your mother's maiden name?" - "gHk899iL@"

Annoyingly,some sites have started putting limits and validations on their security question answers...

Imagine the site complaining that your answer has "too much entropy" to be correct...

Re: Password Rules Are Bullshit

#158

Post by blauditore »

lostlogin wrote: post #142
hellcow wrote: post #122

Earlier quoted context omitted.

I can confirm. I spent days locked out of my Apple account (and all associated devices) because I had spaces in my passwords. After several hours with support, who needed to escalate the issue to tier 2, then engineering, the only thing that fixed it was me briefly trying a simple password -- one without spaces. I'm not sure if the issue was ever fixed, but I don't imagine I'll use spaces in an Apple password again a…

Wonder what other sins are there. A couple of years ago when iCloud was first a thing, I did a couple of password changes in quick succession. It resulted in me having different login passwords for different iCloud services. It worked for a short time then broke and another reset fixed it all.

Enforced password reset questions. There's a limited set of about 10 questions (trivial stuff like "where were you born?"), and you have to set 3 of them. About half a year ago, I was forced to do this in order to be able to log in again (I'm only occasionally using it for publishing iOS apps). What is this, Hotmail in 2005?

Re: Password Rules Are Bullshit

#159

Post by problems »

simias wrote: post #25

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…

> if the user getting their password stolen is not a problem for you because it's not your responsibility to handle these issues (like a hacker news account for instance) then just let the user pick whatever they want and deal with the consequences

Yes! Please. Let users determine the value of their accounts for themselves. If I decide that say, my HN account isn't valuable and use a common password that is shared with many websites, I know the risk I'm taking and I'd rather take it than have to mark down a unique password for HN.

On sites I write I advocate for no password rules at all (hit enter is good enough for me, yes we can hash an empty string), have usually compromised on a simple length check.

Proper password storage is important, use the latest bcrypt/scrypt/argon2, don't cheap out there. You can cheap out on password rules. If you want to write a fancy entropy checker, run it client side and tell the user how secure their password is, let them choose whether they want that or not.

Re: Password Rules Are Bullshit

#160

Post by blauditore »

x1798DE wrote: post #109
jondubois wrote: post #28

I'm surprised that this article didn't mention the most important point about password rules: They force you to come up with a new password that you probably haven't used before and so you will probably forget it. There are websites that I don't use often where I literally have to reset the password (and go through all the i-forgot-my-password steps) every time I want to log in because they forced me to come up with…

You really shouldn't be re-using passwords across sites anyway, since all your accounts are compromised if any of them are compromised. Since re-using passwords is a problem solved by using a password manager, I'm assuming you're not using one, in which case you likely won't even remember the list of sites where you have accounts that have a shared password if you need to change it when any of the other sites are com…

I'm quite hesitant towards using a password manager. All secrets are protected by only one single password, and to make the tool useful, it should be accessible from anywhere and I would use it quite often too, increasing the limit of my master PW being stolen (whatever way, keyloggers, shoulder surfers, cameras...). Thus, I rather memorize a handful of unique high-security passwords for important services and one or two low-security ones for all the rest I don't care about.

Of course, it's a different situation when e.g. managing many sensitive servers which you only access from work or so.

Post reply on HN