71–80 of 140 posts
> must contain letters in mixed case, must contain numbers and must contain symbols Please don't do this. Have a minimum length, but don't force me to miss it up. My password manager shouldn't have to try multiple times to generate matching passphrase.
I mistook this for being about usernames at this hacker forum
Earlier quoted context omitted.
Passwords should be hashed client-side anyway, so the real issue there is how to encode the password hash in a way that satisfies the legacy system. But this is usually plausible, e.g. by base64 or hex encoding the hash to avoid disallowed characters and then appending specific characters that satisfy the set of required characters.
Do you know of any systems that actually do this? It's the first I've heard of this technique.
I hope this gets enough traction. That much orange (on all pages) is unbearable during night if you're using flux.
Topics shouldn't be the same as those found on hackernews, those would be redundant though.
I would suggest using discourse.org instead of rolling your own phpBB instance
Earlier quoted context omitted.
I've sent feedback to a couple dozen sites over this. Most were government website (internal military sites are the worst) but when various financial institutions started updating their policies they forcing this silliness. When they don't allow spaces in passwords either, I worry.
Keep in mind, there are situations where the website you're using is interfacing to backend systems that have constraints that can't easily be changed (colloquially known as "legacy systems"). Feedback is good, but change takes time.
> must contain letters in mixed case, must contain numbers and must contain symbols Please don't do this. Have a minimum length, but don't force me to miss it up. My password manager shouldn't have to try multiple times to generate matching passphrase.
Yeah this is annoying. Simply consider a^b, what makes that expression grow faster, increasing a, or increasing b? b is better mathematically and for mental overhead.
The derivative with respect to a is: b(a^(b-1)).
The derivative with respect to b is: log(a)(a^b) or (a log(a))(a^(b-1)).
So it's better to increase b when alog(a) > b. Which is typically the case where a is 26 for lowercased letters and b is like 10 for password length.
This analysis might not be totally correct since the cost of adding one extra allowed character vs increasing password length by one is not the same but w/e.
> must contain letters in mixed case, must contain numbers and must contain symbols Please don't do this. Have a minimum length, but don't force me to miss it up. My password manager shouldn't have to try multiple times to generate matching passphrase.
I've sent feedback to a couple dozen sites over this. Most were government website (internal military sites are the worst) but when various financial institutions started updating their policies they forcing this silliness. When they don't allow spaces in passwords either, I worry.