Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

21–30 of 447 posts

Re: I hate password rules

#21

Post by tikkabhuna »

mojuba wrote: post #10

An HTML input field can give your password generator a hint, right? Never looked at it closely but had the impression e.g. Safari's generator could adapt to certain rules and that they were somehow described in the HTML.

Apple have "Password Rules"[1]. No idea how many password generators respect it though.

I've created a CodeSandbox example of it being used.[2] 1Password does honour it.

[1] https://developer.apple.com/password-rules/ [2] https://codesandbox.io/s/password-rules-demo-029h5

Re: I hate password rules

#22

Post by randomluck040 »

robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Wait, what? That never happened to me. How do you go and find out your password then? Trial and error?

Re: I hate password rules

#23

Post by rav »

clement_b wrote: post #2

Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.

I use the following bookmarklet to fix issues like this. It's similar to the browser addon discussed in sibling comments, but without installing a browser addon. Simply create a bookmark named e.g. "Don't mess with paste" with the following URL:

javascript:void(document.documentElement.addEventListener('keydown',e=>e.keyCode==9&&e.stopPropagation(),true),document.documentElement.addEventListener('copy',e=>e.stopPropagation(),true),document.documentElement.addEventListener('paste',e=>e.stopPropagation(),true))

Re: I hate password rules

#24

Post by falcolas »

beardyw wrote: post #6

Well I suppose this is trying to avoid people using obvious passwords but I'm not ever sure it works. At least password rotation ( = xxx1, xxx2 etc) has gone out of favour. Ideally we need AI to say "No! Not your wife's birthday!".

> At least password rotation ( = xxx1, xxx2 etc) has gone out of favour.

Not everywhere. Some contracts our org is engaged with specifies yearly password rotations for our single sign on system. Now guess how many folks rotate their passwords.

Re: I hate password rules

#25

Post by WorldMaker »

Hamuko wrote: post #13
clement_b wrote: post #2

Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.

I once had to open up my developer console and manually set the field with JavaScript because they didn't want me pasting into the password field. Although the site was also all kinds of broken so it might have actually been an accident that pasting into the field didn't work.

I do this on quite a few sites. Most of the easy ones have an easy to find onpaste event wired in the DOM and it's a simple delete. I feel like there are so few legitimate uses of onpaste and the browser should have an easy override that if I ctrl+v three times in quick succession or something like that it ignores or disables onpaste events.

Alternatively, my password manager does have a decent "autotype" tool when all else fails.

Re: I hate password rules

#26

Post by Someone1234 »

postalrat wrote: post #20
latchkey wrote: post #9

Instead of requiring people to have special password rules, we should require people to use a password manager. Then, if you have special password rules, the manager could generate a strong password that fits into the defined rules. Of course, getting rid of passwords entirely, is the best option (ie: using a decentralized sso solution).

Why require a password manager when you could require a hardware token instead.

One costs money and requires a physical item, the other is commonly free, and you can sign in from multiple locations/devices.

Hardware tokens have only managed to prove that hardware tokens won't ever take off due to their inherent limitations and liabilities.

Re: I hate password rules

#27

Post by ylere »

randomluck040 wrote: post #22
robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Wait, what? That never happened to me. How do you go and find out your password then? Trial and error?

I had it happen a few times. Usually I would reset it a few times until realizing that it's obviously not saving the password I'm entering, at which point I would try a setting a shorter one.

Re: I hate password rules

#28

Post by [deleted] »

randomluck040 wrote: post #22
robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Wait, what? That never happened to me. How do you go and find out your password then? Trial and error?

[deleted]

Re: I hate password rules

#29

Post by phepranto »

randomluck040 wrote: post #22
robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Wait, what? That never happened to me. How do you go and find out your password then? Trial and error?

They might just truncate the password during login as well. I was able to login to my online banking using only the first five digits of my password not more than 3 years ago.. They fixed it in the meantime but I'm still worried.

Re: I hate password rules

#30

Post by kemotep »

There does need to be some rules or else people would set their password to be blank or a few characters.

I would be happy with consistent password rules.

1. No password that was included in a breach a la the “haveibeenpwned” hash check system[0].

2. No password reuse.

3. A Minimum length. Something like 14-20 characters. And no maximum (or at least something set to at least 127 characters as the max allowed).

4. Reset no more than once a year.

And that’s it. All valid UTF-8 characters accepted. No requirements for special characters or not, just long well randomized passwords, or more aptly, passphrases.

Teaching everyone about password managers and diceware[1] passwords would go a long way too.

[0]:https://haveibeenpwned.com/API/v3 [1]:https://en.wikipedia.org/wiki/Diceware?wprov=sfti1

Post reply on HN