Live data from Hacker News

Password Rules Are Bullshit

blog.codinghorror.com

281–283 of 283 posts

Re: Password Rules Are Bullshit

#281
post #178

Earlier quoted context omitted.

Assuming MS means Microsoft then you are incorrect. You can use Google Authenticator just fine with Microsoft accounts (because I'm doing it.)

Then I apologise, it must be an information 'hiding' issue then because they clearly flagged installing their own Authenticator and I was completely ignorant of the use of GA; GA must be the most popular authenticator? Does this all mean I can use a third-party auth for both MS and Google sites or is it only MS that supports third-party authenticators?

You can use any authenticator. Authy is actually probably the best nowadays.

Re: Password Rules Are Bullshit

#282
Saying "less than 8 chars is close to no password" is stupid. It just means, if your service provider hosting your short password get hacked, if they store their users password in a crappy format, then your password is gonna be recovered.

Re: Password Rules Are Bullshit

#283
I don't see much sense in claiming that a mere 2 digit increase would be the crux of the problem. Sure, nowadays since most websites enforce a 8-digit limit, most cracked passwords are 8-digit long. So what? If everybody goes to 10-digit passwords, then aren't we back to the status quo and most cracked passwords are going to be 10-digit long as well? Also, how much does a 2-digit increase make the brute-force computation much harder anyways? By dropping those requirements the cracker's job can literally get much easier instead of harder even with the length increase.

I don't think the point about random password generation is much valid either. Since most websites just have such password requirements in place, why wouldn't those generators just remember to put the upper case and special characters into the final result? They might try to generate them separately and insert them at a random position. That shouldn't compromise the password's security right?

As a side note, I also don't get why for Chinese websites a limit of 6 characters would be a good idea, as he spends the whole article talking about length... Surely many Chinese don't use English words (though many still do actually), but they use pinyin, which is a way to write Chinese characters with Latin alphabet. Literally nobody uses real Chinese characters as passwords, and most websites just downright don't support them. Clearly he doesn't know much about Chinese websites anyways...

In all, I think most of his articles are excellent but this one is really a bit off the mark IMO.

Post reply on HN