61–70 of 447 posts
Instead of requiring people to have special password rules, we should require people to use a password manager. Then, if you have special password rules, the manager could generate a strong password that fits into the defined rules. Of course, getting rid of passwords entirely, is the best option (ie: using a decentralized sso solution).
Why require a password manager when you could require a hardware token instead.
Earlier quoted context omitted.
The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me Or worse, they truncate your password after you've already used it for years and years. I had a 30-character password with Bank of America. Somewhere along the line, it changed its password requirements to only allow a maximum of 20 or 25 characters (I forget), which automatically invalidated m…
So, for a bank the maximum is to allow NSA to crack it if they wish, right?
My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).
(This isn't to excuse silent truncation.)
Earlier quoted context omitted.
Why require a password manager when you could require a hardware token instead.
One costs money and requires a physical item, the other is commonly free, and you can sign in from multiple locations/devices. Hardware tokens have only managed to prove that hardware tokens won't ever take off due to their inherent limitations and liabilities.
An HTML input field can give your password generator a hint, right? Never looked at it closely but had the impression e.g. Safari's generator could adapt to certain rules and that they were somehow described in the HTML.
Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.
Or the site lets your password manager fill the fields, but for some reason their javascript doesn't recognize it and refuses to let you submit because it hasn't verified your password as matching, meeting strength rules, etc. At least in that case deleting and typing just the last character usually fixes it.
…though not as annoying as sites that don’t let you copy / paste into their login fields.
Is it password rules he hates or the UX around the password rules? I just read the post and if the system response had been "You must have 2 numbers in your password", well then, okay, easy enough to do. An annoyance rather than a hatred. Not that I think password rules are great. They can, if used poorly, unnecessarily constrain the space of passwords. But they are often required by certain compliance situations. I…
The problem with that is I then have to open my password manager, append "11" to my perfectly secure password, and save it. Just use zxcvbn.
Due to the nature of my job and the age of some of my coworkers, I am sometimes casually given passwords on a piece of paper. Out of a sample size of conservatively 20, I have never even once (!) seen a special character other than !. It just doesn't happen. Password rules and a requirement to change your password every X months are pure security mirage and just create frustration in people who often struggle to gene…
> Password rules and a requirement to change your password every X months are pure security mirage and just create frustration in people who often struggle to generate even one secure password in their entire lifetime. Every place I've ever seen or heard about with a "change every X months" system, everyone just uses a (often shared!) formula to come up with variations that satisfy the is-this-too-close-to-your-last-…