Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

41–50 of 447 posts

Re: I hate password rules

#41

Post by pavon »

clement_b wrote: post #2

Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.

Or the site lets your password manager fill the fields, but for some reason their javascript doesn't recognize it and refuses to let you submit because it hasn't verified your password as matching, meeting strength rules, etc. At least in that case deleting and typing just the last character usually fixes it.

Re: I hate password rules

#43

Post by iudqnolq »

mooreds wrote: post #39

Is it password rules he hates or the UX around the password rules? I just read the post and if the system response had been "You must have 2 numbers in your password", well then, okay, easy enough to do. An annoyance rather than a hatred. Not that I think password rules are great. They can, if used poorly, unnecessarily constrain the space of passwords. But they are often required by certain compliance situations. I…

The problem with that is I then have to open my password manager, append "11" to my perfectly secure password, and save it. Just use zxcvbn.

Re: I hate password rules

#44

Post by waltbosz »

kemotep wrote: post #30

There does need to be some rules or else people would set their password to be blank or a few characters. I would be happy with consistent password rules. 1. No password that was included in a breach a la the “haveibeenpwned” hash check system[0]. 2. No password reuse. 3. A Minimum length. Something like 14-20 characters. And no maximum (or at least something set to at least 127 characters as the max allowed). 4. Res…

Max password lengths make no sense to me.

> just long well randomized passwords, or more aptly, passphrases.

Interesting idea. I could imagine a new password prompt with an algorithm to reject passwords that were not random enough. How infuriating would that be? What would the hint message look like: "your password must contain a statistically random arrangement of characters"

Re: I hate password rules

#45

Post by iudqnolq »

kemotep wrote: post #30

There does need to be some rules or else people would set their password to be blank or a few characters. I would be happy with consistent password rules. 1. No password that was included in a breach a la the “haveibeenpwned” hash check system[0]. 2. No password reuse. 3. A Minimum length. Something like 14-20 characters. And no maximum (or at least something set to at least 127 characters as the max allowed). 4. Res…

Just use zxcvbn

Re: I hate password rules

#46

Post by throwawayboise »

robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Supermicro BMC passwords do that. Recently (i.e. this year) I set up a bunch of servers and was setting the BMC password to a known value.

Apparently there is a limit of 20 characters for the password. The password I set was 21 characters (which was accepted without error).

When I tried to log in with this password, the login was rejected.

However if I log in with just the first 20 characters of the password, it works.

Re: I hate password rules

#47

Post by fsflover »

latchkey wrote: post #38
fsflover wrote: post #15

Earlier quoted context omitted.

> we should require people to use a password manager. What if I am storing my passwords in clear text in a Qubes OS [0] virtual machine with no network? [0] https://qubes-os.org

I'm curious how you get your password from there and into a form on a website.

With secure inter-vm copy-pasting: https://www.qubes-os.org/doc/how-to-copy-and-paste-text/

Re: I hate password rules

#48

Post by toto444 »

kemotep wrote: post #30

There does need to be some rules or else people would set their password to be blank or a few characters. I would be happy with consistent password rules. 1. No password that was included in a breach a la the “haveibeenpwned” hash check system[0]. 2. No password reuse. 3. A Minimum length. Something like 14-20 characters. And no maximum (or at least something set to at least 127 characters as the max allowed). 4. Res…

> 4. Reset no more than once a year.

That would make a lot of people's life terrible. I reset my passwords very frequently (almost every time I log out of a website)

Re: I hate password rules

#49

Post by JTbane »

slownews45 wrote: post #17
clement_b wrote: post #2

Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.

No kidding. Govt websites seem to think this is a positive. Of course, these same folks do the 90 day rotation. Result - everyone writing down passwords on post-it notes next to screens.

The TreasuryDirect website requires login with a case-insensitive on-screen keyboard in the page itself. I have no idea why such an idiotic approach would be taken.

Re: I hate password rules

#50

Post by throwawayboise »

I've simplified the rules I enforce because it was just getting out of hand. I enforce a reasonably long minimum length, and enforce a limit on number of repeated characters in a row (so someone can't set a password of "aaaaaaaaaaaaaaaa")

That's it.

Post reply on HN