Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules Are Bullshit

blog.codinghorror.com

Post reply on HN
Print view View original

241–250 of 283 posts

Re: Password Rules Are Bullshit

#241

Post by nerdponx »

bumblebeard wrote: post #234
criddell wrote: post #64

Somebody got into my bank account and attempted to steal some money. Luckily, we were able to stop it quickly and the bank had the money back in our account the same day. It was pretty upsetting so I sent a letter to them with a lot of questions about their system and eventually somebody from the inside called me. One of the questions I asked was why they limit password length. The (low) limit suggests that they were…

What bank? I wouldn't want to do business with them if that's how they handle security.

Seconded. Name and shame.

Re: Password Rules Are Bullshit

#242

Post by relaytheurgency »

TillE wrote: post #174
jondubois wrote: post #118

Earlier quoted context omitted.

Most of my accounts use my low-security password, I don't care much if they all get compromised. I only use my high-security password on 1 site. Password managers are horrible - Whenever I change machines, I could never remember all my passwords and I certainly don't want to store my passwords in the cloud.

> I certainly don't want to store my passwords in the cloud But you're not. You're storing an encrypted blob in the cloud. You just need a good master password and a password manager that isn't broken.

I wonder why people still think that their passwords are stored on the external site. It's explained on the "how this works" or whatever for most services like LastPass.

Re: Password Rules Are Bullshit

#243

Post by DavideNL »

andrewguenther wrote: post #144

This article starts by using an example of 8 "bad" password rules, but by the end of the post, Jeff ends up suggesting 5 of the 8 anyway. This post really should have been called "special character requirements are bullshit." I'd be willing to bet that a future version of Discourse will also disallow using your previous password as well. Then we'll get another password blog post talking about how hard passwords are a…

> This article starts by using an example of 8 "bad" password rules, but by the end of the post, Jeff ends up suggesting 5 of the 8 anyway.

yea, my thoughts exactly after i read it...

Re: Password Rules Are Bullshit

#244

Post by relaytheurgency »

djrogers wrote: post #238

Another major problem I have with password restrictions - how about you make sure your stupid password dialog is capable of accepting the passwords generated by password managers? How about you just test the 5 or 6 most common ones? I hate it when I accept the suggested password from Safari or 1password and the stupid site won't accept it because it used the wrong kind of special character, or didn't include enough c…

I've been on sites that won't allow you to paste a password in. It's so ridiculous.

Re: Password Rules Are Bullshit

#246

Post by mjevans »

ouid wrote: post #147
bambax wrote: post #74

Earlier quoted context omitted.

Totally agree. If you annoy the user too much, they will not try to circumvent your rules, they will leave and find something else to do with their time. Also, the big question that's missing from the article is: who's the enemy? If the enemy are Russian genius hackers, then certainly very long passwords and maybe other measures are in order. But the enemy is not always remote. I just bought a new iPad and had to res…

I have never come across an authentication mechanism that actually required your security questions. There's always another route to restoring your password, which means that they do not serve a security function, but rather serve a convenience function, at the expense of security. If you are willing to be brave about this then the best way of answering security questions is by typing a random string and NOT writing…

I once did that for a site which I didn't want anyone to recover my password to and thus break the security. I -DID- write down the actual password.

Today, years later, I still can't login to the damn payroll site because there isn't a procedure for just completely resetting the password state of the account and it wouldn't let you log in without those extra things.

Since that point I have recorded every annoying split-password (that's what the 'security questions' actually are, a forced split in the single real password)...

Re: Password Rules Are Bullshit

#247

Post by gry »

syntheticnature wrote: post #183
GrinningFool wrote: post #125

Earlier quoted context omitted.

Annoyingly,some sites have started putting limits and validations on their security question answers...

Ran into one where it demanded I choose from a drop-down list, e.g. "What was your first pet" had "dog", "cat", "hamster", "gerbil", etc. I recall the list having a scrollbar, but there was not even enough choices for eight bits worth of entropy. Oh, and they referred to these security questions as "2FA."

I ran across something similar on United.

https://www.united.com/ual/en/us/account/enroll/default

Derp.

Re: Password Rules Are Bullshit

#248

Post by nerdponx »

camiller wrote: post #155
neikos wrote: post #82

Earlier quoted context omitted.

Two ways why I think E-Mails are useful at signup: - Password Recovery (this can be optional though, for my sites it usually is) - 'Legit Users', sending an email and having them confirmed through a code in them gives a bit more confidence in the user

'legit users' There isn't a day that goes by that I don't get an email intended for someone else, often including personal information, due to a mistyped email address. Whoever decided that email verification was a poor user experience needs to be hit in the head with a shovel after he digs the appropriate sized hole. If you know Catherin (PA) let her know her round trip to vegas is confirmed Carolyn's (NYC) open tab…

This has never happened to me with any email address. Is yours really generic or easily typed by mistake?

Re: Password Rules Are Bullshit

#249

Post by Declanomous »

codeka wrote: post #235
Declanomous wrote: post #180

Earlier quoted context omitted.

What's even more annoying is that some sites ask for verification, but then proceed to email you stuff even if you don't click verify. Someone in Australia created an Apple ID using my email. I ignored the verification, but then I got a bunch of purchase receipts from them later. What I really wish for is a link in emails that say "I am not the intended recipient of this letter." Normal mail works like that. You can…

I had the same problem with someone signing up for an Apple ID with my email address. I even tried calling Apple to get them to cancel the account, but they wouldn't let me because I couldn't answer any of the security questions on the account! The guy on the phone acknowledged that of course I can't answer them, because I didn't create them, bit their policy forbids them from doing anything without the security ques…

Man, now I'm wondering if this is some sort of violation of the CAN-SPAM act. My blood pressure goes up a little every time I get one of these emails and it doesn't have a way to unsubscribe if you aren't the legitimate recipient. Considering the companies that spam me the most with this irrelevant crap are Apple and Wal-Mart, I would feel 0% bad if they lost money over this practice.

Quick Edit: I just read the Wikipedia page, and individuals cannot bring suit against spammers (using CAN-SPAM in any case). Which is a shame really, because spam is really really annoying.

Re: Password Rules Are Bullshit

#250

Post by digler999 »

Symbiote wrote: post #240
coldpie wrote: post #49

Earlier quoted context omitted.

I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords. What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on th…

If you have a server running SSH, you can try the "lastb" command, which shows failed logins. Or, look in the logfile, often /var/log/secure or similar. root ssh:notty 116.31.116.44 Fri Mar 10 22:27 - 22:27 (00:00) root ssh:notty 116.31.116.44 Fri Mar 10 22:27 - 22:27 (00:00) ... My personal server has 153,246 entries from this single IP, from 1 March until now.

did you disable password authentication (to allow only ssh keys) ? If not, why ?
Post reply on HN