Sites with dumb password rules • Hacker News Board

Re: Sites with dumb password rules

#291

Post by peterwwillis » Fri, Sep 06, 2019, 4:21 PM UTC

julianwachholz wrote: post #180

transreal wrote: post #153

I've been getting pretty annoyed by the "Security Questions" some sites have you setup. A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.

The name of my childhood pet was "FVrE9msW9DLBAx". Makes for fun conversations on the phone.

That's really the best use for security questions: have fun with customer support.

"Pet's name?"

"ICUP."

"Can you ........ Oh."

Re: Sites with dumb password rules

#292

Post by Twisell » Fri, Sep 06, 2019, 4:33 PM UTC

t34543 wrote: post #256

Twisell wrote: post #217

Earlier quoted context omitted.

I once tried Password1 scheme as a form of protestation for a client corp account I'd connect every 2 month or so but that had a 1 month rotation policy (so that I actually had to change my password every time I connected to them). It worked... Obviously I changed it to something else but regularly tried if still worked. The big payout was when we had an on-site formation from a third party and the teacher needed to…

Why would you get reported?

I don’t know someone from this client could have called my boss and said that I was a disrespectful dipshit that compromised their reputation in front of a third party...

But I guess they also knew my boss would have laughed at them and said he support me. I have a great boss. I really can’t complain on that level.

Re: Sites with dumb password rules

#293

Post by rurp » Fri, Sep 06, 2019, 4:43 PM UTC

Ayesh wrote: post #252

rurp wrote: post #81

Earlier quoted context omitted.

My local bank made a new website that does something similar, where the input for creating the password is truncated to be shorter than the field for entering the password. I forget the exact length but it is pretty short, like 10 characters. It took me forever to figure out why I couldn't log in to their new site.

Reading this and other similar experience, I wonder if one could make a browser extension (or vendors implement on the browser) to warn the user when they are typing behind the maxlength.

I like this idea. It's a general enough issue that making it a browser standard could be quite nice.

Re: Sites with dumb password rules

#294

Post by originalbryan2 » Fri, Sep 06, 2019, 4:46 PM UTC

transreal wrote: post #153

I've been getting pretty annoyed by the "Security Questions" some sites have you setup. A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.

Haha, that's terrible.

I get annoyed by the security questions in a different way. If they are all based on "firsts" such as first school, first address, first friend, etc, I'm screwed. I moved 23 times growing up and went to 9 different schools. I have no idea what my "first" things were.

Re: Sites with dumb password rules

#295

Post by pbreit » Fri, Sep 06, 2019, 4:47 PM UTC

snowe2010 wrote: post #130

pbreit wrote: post #127

Earlier quoted context omitted.

I don't like that at all. 12 chars is much too long. And what does "not be a commonly used password" mean?

Can't tell if you're being sarcastic or not...

Serious. 12 char min for a password is silly. “Common passwords” is silly and meaningless. Together they make no sense.

Re: Sites with dumb password rules

#296

Post by pbreit » Fri, Sep 06, 2019, 4:49 PM UTC

ddeck wrote: post #129

pbreit wrote: post #127

Earlier quoted context omitted.

I don't like that at all. 12 chars is much too long. And what does "not be a commonly used password" mean?

It means it's shouldn't be on this list[1] for example, because it makes brute force guessing from a dictionary of common passwords easy. - Of all the password databases breached in 2016, "123456" made up 4% of them [1]. [1] https://en.wikipedia.org/wiki/List_of_the_most_common_passwo...

123456 is not even a word. “Common passwords” is meaningless. I can’t even think of a “common” 12+ char password.

Re: Sites with dumb password rules

#297

Post by coryfklein » Fri, Sep 06, 2019, 4:54 PM UTC

wool_gather wrote: post #288

joshuaissac wrote: post #208

Earlier quoted context omitted.

It is better to pick names with actual words. An attacker can otherwise say that the answer is just a bunch of random characters, and there is a risk that a naïve customer support representative may accept it.

In order to deploy this successfully, the attacker would have to know that you used a random string...how would they know this without having access to the string itself?

Not necessarily - they're given multiple "tries" so they can just pick "a bunch of random letters" as one of their first few choices in hopes that they guessed correctly.

Re: Sites with dumb password rules

#298

Post by mittonface » Fri, Sep 06, 2019, 5:01 PM UTC

WillDaSilva wrote: post #134

From the GitHub issue about BMO: The original entry didn't even fully capture the stupidity of the BMO password system (which I recognize they have now fixed). The most egregious part was not that your password had to be only 6 characters. It was that whatever password you chose ended up getting mapped to where those characters were on a telephone keypad. So, for example if your password was passwo, you were also abl…

I made this comment.

Since you're curious: I signed into telebanking and it asked for me to input my password. I didn't ever remember setting a phone password, so I tried punching in the numbers that corresponded to my online banking password. It worked.

Obviously the only way this would work is if they stored the numeric keypad representation of your password instead of your actual password. So I experimented a bit and found password horror.

Re: Sites with dumb password rules

#299

Post by thiagomgd » Fri, Sep 06, 2019, 6:42 PM UTC

ashton314 wrote: post #281

Why is this even a thing? Is there any reason, historical or otherwise that limits password length? You just have to hash the password—then everything is the same length, right? Am I missing something?

well... unfortunately some sites don't hash. I remember that once I used the "forgot password" on one, and they emailed me the password. Not a new, random one. My actual password...

Re: Sites with dumb password rules

#300

Post by dredmorbius » Fri, Sep 06, 2019, 6:43 PM UTC

dewey wrote: post #119

ineedasername wrote: post #97

I thought it was fairly well established in the tech community that something like a sentence you can easily remember is better than a weird sequence of 12-20 letters, special chars, etc. But I very, very rarely see any site ever mention or require it or anything. How come it hasn't taken hold?

I think it’s established in the tech community that you use a password manager, then you don’t have to care how the password looks like or how easy it is to remember.

Passphrases are still easier to transcribe between systems. Which, given password managers' brain-damagedness at archiving and migrating passwords, remains frustratingly necessary.