Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sites with dumb password rules

github.com

Post reply on HN
Print view View original

31–40 of 327 posts

Re: Sites with dumb password rules

#31

Post by skunkworker »

zeta0134 wrote: post #20
OJFord wrote: post #11

Honestly, I'm past caring about upper length limits, however stupid they are. What really pisses me off is not validating on it, so my too-long password is happily accepted, and I have no idea what it is except that it's some prefix of the one I saved.

Reasonable upper limits don't bother me all that much. If you're going to store a hashed password, you want to choose an expensive hash algorithm (It's been a while since I looked at this, but I don't think bcrypt is standard anymore?) and that complexity is meant to be computationally ridiculous, and probably scales with length. Good security dictates a minimum length, and practical avoidance of your login form bein…

Bcrypt is still widely used. It’s just advised to increase your work factor to something at least 12 if not 14+. And every year or two bump it up another level.

Re: Sites with dumb password rules

#33

Post by _hyn3 »

brokensegue wrote: post #16
panarky wrote: post #14

Chase Bank: Must not include more than 2 identical characters (for example: 111 or aaa) Must not include more than 2 consecutive characters (for example: 123 or abc) First, they apparently mean repeating and not identical characters. But more importantly, perfectly random character strings frequently contain repeating and consecutive characters, so this rule must reduce the entropy of passwords. ------ Edit - Just si…

doesn't any rule decrease password entropy?

It's ironic that allowing low-entropy passwords (for example, one-character) can actually increase the available entropy.

For example, if you set a minimum password length of six characters, an attacker doesn't even need to bother going through all of the 1 through 5 character combinations.

The flip side of the coin is that, obviously, allowing low-entropy passwords will inevitably mean that some users will actually use them, which means that their passwords actually have decreased entropy.

Re: Sites with dumb password rules

#34

Post by skunkworker »

OJFord wrote: post #11

Honestly, I'm past caring about upper length limits, however stupid they are. What really pisses me off is not validating on it, so my too-long password is happily accepted, and I have no idea what it is except that it's some prefix of the one I saved.

Silent truncation. This becomes worse when you realize that a companies web login vs mobile have different hard lengths, in this case it was mint.com. They allowed 16 online and 32 mobile, after letting them know they thankfully made it consistent at 32. Which isn’t perfect but it’s far better than most

Re: Sites with dumb password rules

#35

Post by Thriptic »

The most hilarious rules I've encountered were for a large, well known US hospital:

* Password must be EXACTLY 8 characters long

* Password must start with a letter

* You must use exactly 3/4 of the following: upper case, lower case, numbers, one of three special characters

* Password cannot "resemble" username or past password

Re: Sites with dumb password rules

#36

Post by humblebee »

numakerg wrote: post #13

> Admiral: Restrict the inclusion of a % character. I guess the password is being used in a query template? Seems like a very bad idea.

Or some weird non uniform URI encoding, as % is used to start the being of a hexcode for characters in URLs. Such as %20 being a space.

Re: Sites with dumb password rules

#37

Post by txcwpalpha »

Thriptic wrote: post #35

The most hilarious rules I've encountered were for a large, well known US hospital: * Password must be EXACTLY 8 characters long * Password must start with a letter * You must use exactly 3/4 of the following: upper case, lower case, numbers, one of three special characters * Password cannot "resemble" username or past password

Sounds like they were using z/OS or RACF [1] mainframe as a backend. Oof.

Unfortunately, it's not that uncommon. I've done security consulting work at a few major F500 companies that were using this and had those same password rules. At one of them, it got to the point where almost every security review meeting had to start with "yes yes we already know how bad the password are, don't bring it up, let's talk about something else".

1: https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.1.0/...

Re: Sites with dumb password rules

#38

Post by ademarre »

It's also frustrating when they change password rules and invalidate existing passwords in the process.

Yesterday I had to go through an inconvenient password reset because my bank no longer allows spaces in passwords. The password input inconspicuously removes spaces after you type them. It took several failed attempts before I realized what was happening.

Re: Sites with dumb password rules

#40

Post by vortico »

exabrial wrote: post #25

Want to DDOS somebody? Try their password incorrectly three times. Stupidest password rule ever. Rate limiting after 3 mis-attempts is understandable. That rate limit doesn't need to exceed 1m with passwords over 14 characters.

I don't even think rate limiting after 3 mis-attempts makes sense. I regularly can't remember my password and might need 6 attempts. Nobody's going to guess your password after 300 attempts, so make the limit 30 and you're safe.
Post reply on HN