Why don't we have password standards?

#1

Post by vaksel » Wed, Aug 10, 2011, 4:54 PM UTC

It seems like each website has it's own password standards.

Some want 5 letters, some want a minimum of 10, some want a maximum of 8, some want a number, some want a mix of capital and lower case letters, some want an underscore, some want a special character @#$%@#@%@#%...others don't allow special characters etc.

Obviously there is absolutely no need for something that restrictive. All it does, is that people are stuck using uncommon passwords...which in turn means that they end up writing them down or constantly forgetting them, which bypasses the security.

So how about we create a common set of password standards...one that doesn't force the user to deviate from their common passwords, yet one that does the bare minimum to make brute forcing it with bots complicated.

Re: Why don't we have password standards?

#2

Post by Khao » Wed, Aug 10, 2011, 5:01 PM UTC

The only standard we should set is a minimum length that is not too short. Something like 8 characters minimum. I don't care if you use only number or only letter, use whatever you want, it's YOUR security after all! The longer the password, the more likely it is to be unique!

My password has been letters + numbers at the end for a long time and I know it's secure because it's not a common word or numbers that have to do with me. No capitals, no punctuations, only lowercase letters and numbers. When a website forces me to use other letters in my password, I keep forgetting it and I am forced to use "Lost my password" all the time, which makes me want to use that service less and less.

Were you inspired to post this by today's XKCD comic? Link : http://xkcd.com/936/

Re: Why don't we have password standards?

#3

Post by vaksel » Wed, Aug 10, 2011, 5:04 PM UTC

Khao wrote: post #2

The only standard we should set is a minimum length that is not too short. Something like 8 characters minimum. I don't care if you use only number or only letter, use whatever you want, it's YOUR security after all! The longer the password, the more likely it is to be unique! My password has been letters + numbers at the end for a long time and I know it's secure because it's not a common word or numbers that have t…

that and because I needed to login into verizon today, and was reminded with error messages that they don't allow any special characters in their passwords

Re: Why don't we have password standards?

#4

Post by Jbudone » Wed, Aug 10, 2011, 5:11 PM UTC

I find that some of these limitations put me in a worse position than if I were to have full control. eg. you MUST use a symbol, or using both lower AND upper case characters.

This is a joke! We're in the 21st century, people should be able to have their own set of password standards. I know we, as programmers, are always looking out for the most noobish of the end-users. But is it really necessary to go as far as to FORCE EVERYONE into picking a blatantly obviously brute-force-safe password?

In the end, the bulk of these users are just going to forget their password, add it to their password manager, and become frustrated with this chosen system. This in turn is insecure for its own reasons.. I think what we need is to remove these silly limitations altogether (although a set standard minimum/maximum character limit is completely understandable imo), and allow people to pick their own standards. The newbies out there will eventually get their accounts hacked, its inevitable imo. And when that happens they will learn to set better passwords.

Re: Why don't we have password standards?

#5

Post by dfc » Wed, Aug 10, 2011, 5:20 PM UTC

I think the biggest reason for the lack of a password standard is that the risk profile / threat model is not the same across all websites.

Re: Why don't we have password standards?

#6

Post by dfc » Wed, Aug 10, 2011, 5:22 PM UTC

Khao wrote: post #2

The only standard we should set is a minimum length that is not too short. Something like 8 characters minimum. I don't care if you use only number or only letter, use whatever you want, it's YOUR security after all! The longer the password, the more likely it is to be unique! My password has been letters + numbers at the end for a long time and I know it's secure because it's not a common word or numbers that have t…

I do not mean to single you out but this is a viewpoint that I have never really unsderstood. If you do not care about "my security" then why have a length requirement?

Re: Why don't we have password standards?

#7

Post by mooism2 » Wed, Aug 10, 2011, 5:30 PM UTC

We could start by disallowing maximum password lengths, and insisting that all printable characters are allowed in passwords.

The great thing about standards is that there are so many to choose from. Here in Britain the Financial Services Authority sets minimum password standards for online banking. I expect similar regulators in other parts of the world have their own subtly different requirements.

Re: Why don't we have password standards?

#8

Post by dfc » Wed, Aug 10, 2011, 5:42 PM UTC

For what it is worth OWASP has password guidelines:

https://www.owasp.org/index.php/Password_length_&_comple...

That should be enough? I can't imagine that you are lamenting the lack of an oversight body to to adopt and enforce a standard. Were you?

Re: Why don't we have password standards?

#9

Post by mattbot5000 » Wed, Aug 10, 2011, 5:52 PM UTC

dfc wrote: post #6

Khao wrote: post #2

The only standard we should set is a minimum length that is not too short. Something like 8 characters minimum. I don't care if you use only number or only letter, use whatever you want, it's YOUR security after all! The longer the password, the more likely it is to be unique! My password has been letters + numbers at the end for a long time and I know it's secure because it's not a common word or numbers that have t…

I do not mean to single you out but this is a viewpoint that I have never really unsderstood. If you do not care about "my security" then why have a length requirement?

You don't want your product to be the one with hundreds of people having their accounts compromised. This warrants a bare minimum of password requirements.

Re: Why don't we have password standards?

#10

Post by dfc » Wed, Aug 10, 2011, 5:57 PM UTC

mattbot5000 wrote: post #9

dfc wrote: post #6

Earlier quoted context omitted.

I do not mean to single you out but this is a viewpoint that I have never really unsderstood. If you do not care about "my security" then why have a length requirement?

You don't want your product to be the one with hundreds of people having their accounts compromised. This warrants a bare minimum of password requirements.

Exactly. So you do care about the security of the users.