Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules Are Bullshit

blog.codinghorror.com

Post reply on HN
Print view View original

201–210 of 283 posts

Re: Password Rules Are Bullshit

#201

Post by delecti »

ryandrake wrote: post #151
Raphmedia wrote: post #78

Earlier quoted context omitted.

I simply type passwords in the answers. "What is your mother's maiden name?" - "gHk899iL@"

This is a good idea. Unfortunately if you have ever in the past (foolishly) answered these security questions honestly, you can't just now start answering them with your password, unless you keep track of which sites have your honest answers and which sites you just gave your password again.

That's a problem even if you answer honestly all the time. Does this website think my best friend's name is (example) Jake or Jacob?

My solution is just to keep those answers in the "extra notes" section of my password manager.

Re: Password Rules Are Bullshit

#202

Post by unabridged »

Declanomous wrote: post #180
camiller wrote: post #155

Earlier quoted context omitted.

'legit users' There isn't a day that goes by that I don't get an email intended for someone else, often including personal information, due to a mistyped email address. Whoever decided that email verification was a poor user experience needs to be hit in the head with a shovel after he digs the appropriate sized hole. If you know Catherin (PA) let her know her round trip to vegas is confirmed Carolyn's (NYC) open tab…

What's even more annoying is that some sites ask for verification, but then proceed to email you stuff even if you don't click verify. Someone in Australia created an Apple ID using my email. I ignored the verification, but then I got a bunch of purchase receipts from them later. What I really wish for is a link in emails that say "I am not the intended recipient of this letter." Normal mail works like that. You can…

You better watch out, that's probably a felony depending on where you live.

Re: Password Rules Are Bullshit

#203

Post by drdeadringer »

jondubois wrote: post #118
x1798DE wrote: post #109

Earlier quoted context omitted.

You really shouldn't be re-using passwords across sites anyway, since all your accounts are compromised if any of them are compromised. Since re-using passwords is a problem solved by using a password manager, I'm assuming you're not using one, in which case you likely won't even remember the list of sites where you have accounts that have a shared password if you need to change it when any of the other sites are com…

Most of my accounts use my low-security password, I don't care much if they all get compromised. I only use my high-security password on 1 site. Password managers are horrible - Whenever I change machines, I could never remember all my passwords and I certainly don't want to store my passwords in the cloud.

Why not use a password manager on a USB stick?

Re: Password Rules Are Bullshit

#204

Post by DashRattlesnake »

coldpie wrote: post #49
corobo wrote: post #38

Earlier quoted context omitted.

> if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing You do. A lot of users don't consider automation when it comes to people hacking their account. I've heard "Nobody will ever guess it though" a few times during my career.

I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords. What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on th…

> I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords.

Weren't the celebrity iCloud account compromises due to Apple neglecting to rate-limit a certain authentication API endpoint, allowing the hacker to brute force passwords online?

Also, doesn't some of the current crop of IoT malware brute force device passwords as well (after trying the defaults)?

Re: Password Rules Are Bullshit

#205

Post by paulmd »

DashRattlesnake wrote: post #200
paulmd wrote: post #179

Earlier quoted context omitted.

As someone with an unusual name (used for my public-facing email address) and who uses a fairly unusual email for personal stuff... that's pretty different from my experiences. I've never ended up with someone else's mail at all. That's a solid argument for business cards with vCard QR codes as I see it. Or a pack of stickers with QR codes that you could slap on whatever documents you needed. It's too bad QR code ado…

> As someone with an unusual name...and who uses a fairly unusual email for personal stuff... that's pretty different from my experiences. I've never ended up with someone else's mail at all. I think it's more likely if you use an initial in your email address. I have a fairly unusual last name, but I used my first initial to create my gmail address, so I regularly get stuff meant for a couple of other people. Busine…

> do you really want to carry them around in case you need to put your email on a form?

Yes. Or my name/address/phone number. It's essentially a machine-readable address label, the email is just one part of the vCard.

Do you people really not keep a book of stamps in your car? Such inconvenience!

Re: Password Rules Are Bullshit

#206

Post by clubm8 »

rcar wrote: post #146

The most recent post in one of the Tumblrs linked through the article goes through some of Facebook's password allowances: http://password-shaming.tumblr.com/post/157913813567/not-ent... Essentially, Facebook accepts 4 forms of the password as correct: 1) the correct password, 2) the caps-lock inverted version, 3) the correct password but with the first letter capitalized, and 4) the correct password + 1 character of…

Not a cryptographer, so this may be harebrained:

Would someone who has access to all 4 hashes be more able to crack said hashes than if they only stored one?

(Or would they salt each hash with a different salt to negate this?)

Re: Password Rules Are Bullshit

#207

Post by syntheticnature »

lsaferite wrote: post #13
nerdponx wrote: post #3

Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…

I read a recent anecdote bout a similar issue. The person had their long password silently truncated to 21 chars on the reset page and 20 chars on the login page. That sounds like a super fun thing to track down as an end user.

I ran into one of those... with a bank! Supposed 32-character limit, but the login page truncated at 31 via Javascript (was able to force my way in via using the console). Ever since I usually don't max out the listed length during generation, just in case.

Re: Password Rules Are Bullshit

#208

Post by vlunkr »

neikos wrote: post #82
sverige wrote: post #35

Earlier quoted context omitted.

Yes and yes! Many throwaway accounts I have use some variation of the same password, because I don't care if someone hacks my HN or reddit or youtube account. I don't use my real name on any of them. If I lose control of it, I'll just make a new one. (Karma doesn't pay the bills, and I don't make money from my very excellent youtube comments; someone else does.) This is why all these accounts get an email account tha…

Two ways why I think E-Mails are useful at signup: - Password Recovery (this can be optional though, for my sites it usually is) - 'Legit Users', sending an email and having them confirmed through a code in them gives a bit more confidence in the user

I've always assumed it was for password recovery. People forget those all the time, email is a quick way to verify identity. Since everyone can have an email address for free. If you have a better way, do tell. Also, when your email is your username, that's one less thing to remember.

Re: Password Rules Are Bullshit

#209

Post by wubbfindel »

ryandrake wrote: post #151
Raphmedia wrote: post #78

Earlier quoted context omitted.

I simply type passwords in the answers. "What is your mother's maiden name?" - "gHk899iL@"

This is a good idea. Unfortunately if you have ever in the past (foolishly) answered these security questions honestly, you can't just now start answering them with your password, unless you keep track of which sites have your honest answers and which sites you just gave your password again.

Don't use your password. Generate random passwords for each security question and record them in your password manager.

So-called "security questions" are the dumbest security measure.

Re: Password Rules Are Bullshit

#210

Post by SamBam »

Sean1708 wrote: post #186
camiller wrote: post #155

Earlier quoted context omitted.

'legit users' There isn't a day that goes by that I don't get an email intended for someone else, often including personal information, due to a mistyped email address. Whoever decided that email verification was a poor user experience needs to be hit in the head with a shovel after he digs the appropriate sized hole. If you know Catherin (PA) let her know her round trip to vegas is confirmed Carolyn's (NYC) open tab…

How generic is your email address? This has literally never happened to me (to my recollection).

I have [first-initial][last-name]@gmail.con.

My last name is pretty uncommon, but there are at least a thousand of us or so in the US.

I probably get a dozen emails a month to people who are not me (not counting all the ones that end up in the spam folder after I'm on a damn list).

Susan. Stephen. Another Sam. So many damn S. Lastnames around.

On occasion I've tracked the people down. I've forwarded their emails if they seem important. And whenever I ask that they be more careful and memorize their own email address, they get defensive and tell me someone else made a mistake.

Buddy, this email was was an automated response from a computer after you signed up for something. No, it did not just randomly decide to send to my @gmail instead of your actual @yahoo address. YOU just don't know your own email.

Post reply on HN