Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

81–90 of 447 posts

Re: I hate password rules

#81

Post by Larrikin »

dataflow wrote: post #63
robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Can I ask what length your passwords are (roughly)? I don't understand the motivation for anything long in the context of randomly generated passwords for websites. 8-10 characters should be plenty. (This isn't to excuse silent truncation.)

Outside of things that need to be extremely secure like my AWS account password I usually prefer readable random words passwords over random text. Even random 2 word passwords usually surpass 20 characters especially after adding in numbers and special characters most sites require.

It's a lot nicer being able to check if I typed in my Peacock login at my parents home at a glance versus a string of random characters.

Re: I hate password rules

#82

Post by frosted-flakes »

kspacewalk2 wrote: post #16

Due to the nature of my job and the age of some of my coworkers, I am sometimes casually given passwords on a piece of paper. Out of a sample size of conservatively 20, I have never even once (!) seen a special character other than !. It just doesn't happen. Password rules and a requirement to change your password every X months are pure security mirage and just create frustration in people who often struggle to gene…

Requirements for uppercase letters, numbers, and special characters mean I stick an "A1!" at the end of my otherwise strong and memorable password. I'm sure I'm not the only one.

Re: I hate password rules

#83

Post by dpifke »

Most attacks on passwords these days are credential stuffing, not brute force.

This means that password rules REDUCE the amount of work an attacker has to do, as they can omit previously breached usernames/passwords which don't meet the password rules for the site being attacked. This means they can try more logins before getting rate-limited.

Re: I hate password rules

#84

Post by crooked-v »

eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

I have multiple financial accounts that still insist on using public-knowledge security questions (which of course I've given fake answers saved in my password manager) instead of just letting me set up proper 2FA. It's infuriating.

Re: I hate password rules

#85

Post by bsid »

eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

Yup. So many people mess this up, it's infuriating. U.S. banks are the worst.

Re: I hate password rules

#86

Post by 63 »

eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

Interestingly, one of the studies they cite finds that blocking common passwords is one of the most frustrating experiences for users. Even though it's more secure, the user has no idea what's wrong with their password or how to correct it.

Re: I hate password rules

#88

Post by Arrath »

kayodelycaon wrote: post #70
handrous wrote: post #18

Earlier quoted context omitted.

> Password rules and a requirement to change your password every X months are pure security mirage and just create frustration in people who often struggle to generate even one secure password in their entire lifetime. Every place I've ever seen or heard about with a "change every X months" system, everyone just uses a (often shared!) formula to come up with variations that satisfy the is-this-too-close-to-your-last-…

I got up to P@ssW0rd12 at one job.

I was working my way to it, when IT rolled out a new policy of "cannot share more than 2 consecutive characters with a previous password" or something like it, included in an email along the lines of "an audit has found this new policy applies to you".

Dicks.

Re: I hate password rules

#89

Post by hnlmorg »

robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

EE does this on their website but not on their mobile app. Took me ages of debugging to figure out why my password manager worked on one platform but not the other. I was so annoyed when I realised what it was.

Re: I hate password rules

#90

Post by Zircom »

robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Yeah you'd be surprised where it happens. I used to work on the help desk for a company that operated nuclear power plants, and their password system would only accept 8 character passwords, alphanumeric only. However, the length checking would randomly fail and users would be able to set a longer password and the system would silently truncate it without throwing an error or alerting the user in any way.
Post reply on HN