11–20 of 447 posts
It would have been really nice if there had been an RFC or ISO standard for password composition. NIST 800-63B is probably the best advice available, but few people follow it and industry regulations (PCI) typically violate it.
Something like: https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...
Well I suppose this is trying to avoid people using obvious passwords but I'm not ever sure it works. At least password rotation ( = xxx1, xxx2 etc) has gone out of favour. Ideally we need AI to say "No! Not your wife's birthday!".
And what 16 characters limit is trying to do?
Character limits are a symptom that the company wants to store some form of the password that hasn't been correctly and securely hashed.
Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.
Instead of requiring people to have special password rules, we should require people to use a password manager. Then, if you have special password rules, the manager could generate a strong password that fits into the defined rules. Of course, getting rid of passwords entirely, is the best option (ie: using a decentralized sso solution).
What if I am storing my passwords in clear text in a Qubes OS [0] virtual machine with no network?
(Yes I evangelize password managers around here. So far I've converted 2-3 people. They are the important people with shit people might want to steal on their computers/accounts, so I'm happy with this.)
Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.
Due to the nature of my job and the age of some of my coworkers, I am sometimes casually given passwords on a piece of paper. Out of a sample size of conservatively 20, I have never even once (!) seen a special character other than !. It just doesn't happen. Password rules and a requirement to change your password every X months are pure security mirage and just create frustration in people who often struggle to gene…
Every place I've ever seen or heard about with a "change every X months" system, everyone just uses a (often shared!) formula to come up with variations that satisfy the is-this-too-close-to-your-last-X-passwords checker, based on the date or whatever.
Earlier quoted context omitted.
And what 16 characters limit is trying to do?
A hashed (and for correctness, salted) password will always have the same number of characters output from the hash whether the input password has one, ten, sixteen, hundred, or million characters. Character limits are a symptom that the company wants to store some form of the password that hasn't been correctly and securely hashed.
Instead of requiring people to have special password rules, we should require people to use a password manager. Then, if you have special password rules, the manager could generate a strong password that fits into the defined rules. Of course, getting rid of passwords entirely, is the best option (ie: using a decentralized sso solution).