I hate password rules
schneier.com
I hate password rules
1–10 of 447 posts
Re: I hate password rules
#2Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.
Re: I hate password rules
#3Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.
https://chrome.google.com/webstore/detail/dont-fuck-with-pas...
This has been a greatly appreciated plugin for these scenarios (it's on Firefox as well)
Re: I hate password rules
#4I write a Go package because I have similar feelings. https://GitHub.com/wagslane/go-password-validator
Re: I hate password rules
#5It would have been really nice if there had been an RFC or ISO standard for password composition. NIST 800-63B is probably the best advice available, but few people follow it and industry regulations (PCI) typically violate it.
Re: I hate password rules
#6Well I suppose this is trying to avoid people using obvious passwords but I'm not ever sure it works. At least password rotation ( = xxx1, xxx2 etc) has gone out of favour.
Ideally we need AI to say "No! Not your wife's birthday!".
Re: I hate password rules
#7Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.
Drag and drop works for me in those cases.
Re: I hate password rules
#8Well I suppose this is trying to avoid people using obvious passwords but I'm not ever sure it works. At least password rotation ( = xxx1, xxx2 etc) has gone out of favour. Ideally we need AI to say "No! Not your wife's birthday!".
And what 16 characters limit is trying to do?
Re: I hate password rules
#9Instead of requiring people to have special password rules, we should require people to use a password manager.
Then, if you have special password rules, the manager could generate a strong password that fits into the defined rules.
Of course, getting rid of passwords entirely, is the best option (ie: using a decentralized sso solution).
Re: I hate password rules
#10An HTML input field can give your password generator a hint, right? Never looked at it closely but had the impression e.g. Safari's generator could adapt to certain rules and that they were somehow described in the HTML.