Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

31–40 of 447 posts

Re: I hate password rules

#31

Post by Hamuko »

WorldMaker wrote: post #25
Hamuko wrote: post #13

Earlier quoted context omitted.

I once had to open up my developer console and manually set the field with JavaScript because they didn't want me pasting into the password field. Although the site was also all kinds of broken so it might have actually been an accident that pasting into the field didn't work.

I do this on quite a few sites. Most of the easy ones have an easy to find onpaste event wired in the DOM and it's a simple delete. I feel like there are so few legitimate uses of onpaste and the browser should have an easy override that if I ctrl+v three times in quick succession or something like that it ignores or disables onpaste events. Alternatively, my password manager does have a decent "autotype" tool when a…

I find it easier just to select the DOM element for the field and do

  $0.value = "asd";
instead of finding the onpaste event.

Re: I hate password rules

#32

Post by BeFlatXIII »

kspacewalk2 wrote: post #16

Due to the nature of my job and the age of some of my coworkers, I am sometimes casually given passwords on a piece of paper. Out of a sample size of conservatively 20, I have never even once (!) seen a special character other than !. It just doesn't happen. Password rules and a requirement to change your password every X months are pure security mirage and just create frustration in people who often struggle to gene…

Frequent password rotation causes increases of passwords on post-its stuck to the monitor.

Re: I hate password rules

#33

Post by Maultasche »

randomluck040 wrote: post #22
robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Wait, what? That never happened to me. How do you go and find out your password then? Trial and error?

That happened to me many years ago with Microsoft logins. They were truncating passwords to 12 characters and my generated 16-character passwords never worked. I kept resetting them over and over until I did a Google search for Microsoft password requirements and found out that they were being truncated.

That was likely fixed a long time ago, but I'm still wary of increasing my Microsoft passwords past 12 characters.

Re: I hate password rules

#34

Post by jbarberu »

robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

And then their sign-in page doesn't truncate it and it just fails to login... Absolutely love it!

One of my favorites was Nintendo's user account. The web allows decent passwords when created, but then the actual game console only has room for inputting 15 characters or so for the password :@

Re: I hate password rules

#35

Post by mooreds »

randomluck040 wrote: post #22
robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Wait, what? That never happened to me. How do you go and find out your password then? Trial and error?

> Trial and error?

Bingo. Super frustrating.

See also this comment: https://news.ycombinator.com/item?id=24827031

Re: I hate password rules

#36

Post by latchkey »

postalrat wrote: post #20
latchkey wrote: post #9

Instead of requiring people to have special password rules, we should require people to use a password manager. Then, if you have special password rules, the manager could generate a strong password that fits into the defined rules. Of course, getting rid of passwords entirely, is the best option (ie: using a decentralized sso solution).

Why require a password manager when you could require a hardware token instead.

I'll let you explain that to my 90 year old grandma.

(not that a password manager is really any better in this case)

Re: I hate password rules

#37

Post by reaperducer »

robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me

Or worse, they truncate your password after you've already used it for years and years.

I had a 30-character password with Bank of America. Somewhere along the line, it changed its password requirements to only allow a maximum of 20 or 25 characters (I forget), which automatically invalidated my password.

The password was stored in my password manager, so I knew I wasn't entering it wrong.

BoA support said I should use the "change password" feature to update my password, but I couldn't because it requires me to enter the old password, which it would not accept. For some reason I can't remember, I couldn't use the "forgot password" feature. Maybe it also didn't work right.

I spent an entire day on the phone getting bounced from person to person before finally someone was able to take a new password over the phone.

Since Bank of America can't figure out how to build a web site login, I no longer trust it with my money. I emptied that savings account and paid off the credit card as quickly as I could. I no longer use BoA.

Re: I hate password rules

#38

Post by latchkey »

fsflover wrote: post #15
latchkey wrote: post #9

Instead of requiring people to have special password rules, we should require people to use a password manager. Then, if you have special password rules, the manager could generate a strong password that fits into the defined rules. Of course, getting rid of passwords entirely, is the best option (ie: using a decentralized sso solution).

> we should require people to use a password manager. What if I am storing my passwords in clear text in a Qubes OS [0] virtual machine with no network? [0] https://qubes-os.org

I'm curious how you get your password from there and into a form on a website.

Re: I hate password rules

#39

Post by mooreds »

Is it password rules he hates or the UX around the password rules?

I just read the post and if the system response had been "You must have 2 numbers in your password", well then, okay, easy enough to do. An annoyance rather than a hatred.

Not that I think password rules are great. They can, if used poorly, unnecessarily constrain the space of passwords. But they are often required by certain compliance situations.

I love my password manager and think everyone should use one, myself.

Another alternative is the FIDO passwordless technologies that are being rolled out more and more. Though I saw a tweet the other day that said "Biometric identification is a username not a password" that made me think about that.

Re: I hate password rules

#40

Post by Macha »

randomluck040 wrote: post #22
robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Wait, what? That never happened to me. How do you go and find out your password then? Trial and error?

I once had a bank that used substr(tolower(input_password), 0, 8) as the actual password.
Post reply on HN