Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

101–110 of 447 posts

Re: I hate password rules

#101

Post by Zamicol »

1. Why don't passworded websites provide their own password generators? There's "secure" entropy generation available to JavaScript, e.g. `Crypto.getRandomValues(Uint8Array)`.

2. Shouldn't the only variable for password generation be entropy/information?

Here's a 256 bit password:

1NH8O3C3GH33FNQHM3B7VFKIQ95EMD-QLPOFPPYJ54NCFXMOB3

How could you know?

An easy way is to take the character set and convert the input string to binary. Once you reach a specified information level (say 256 bits), then the password could be considered sufficient.

https://convert.zamicol.com/?in=1NH8O3C3GH33FNQHM3B7VFKIQ95E...

3. Combined, I'd imagine a decent user experience.

4. I can't wait for public key authentication to kill passwords.

Re: I hate password rules

#102

Post by tzs »

rav wrote: post #23
clement_b wrote: post #2

Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.

I use the following bookmarklet to fix issues like this. It's similar to the browser addon discussed in sibling comments, but without installing a browser addon. Simply create a bookmark named e.g. "Don't mess with paste" with the following URL: javascript:void(document.documentElement.addEventListener('keydown',e=>e.keyCode==9&&e.stopPropagation(),true),document.documentElement.addEventListener('copy',e=>e.stopPropa…

Note: keyCode is deprecated (but still works in most browsers). Supposed to use key nowadays.

Re: I hate password rules

#103

Post by singlow »

dataflow wrote: post #77
loa_in_ wrote: post #72

Earlier quoted context omitted.

My passwords are all 20+ characters long

For websites, you're just making your own life harder for no real gain. Even with purely alphanumeric 10 chars, it's not like anyone can exhaust the 36^10 password space over a network with no one noticing. Yet whenever you run into issues with the website or the password manager (or some other non-routine thing... like you're on your phone and need to enter this on a different computer) and have to enter it manually…

I guess you assume that everyone protects their stored hashes.

Re: I hate password rules

#104

Post by antsar »

clement_b wrote: post #2

Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.

Thankfully, Firefox has an easy way to stop that.

about:config

    dom.event.clipboardevents.enabled = false

Re: I hate password rules

#105

Post by prepend »

Every time I run into this, I remember meetings where a dumbass engineer would convince a clueless PM that something was necessary. It seems too specific to be thought up by a non-engineer.

I have no way of knowing this, but I do think companies with dumb password rules have poor talent.

I need to start a list of companies with dumb password rules, but I rarely create new accounts so by the time I get annoyed, I’m distracted onto something else.

Re: I hate password rules

#106

Post by Arrath »

Spivak wrote: post #97
handrous wrote: post #91

Earlier quoted context omitted.

And that's how you ensure everyone writes their password on a sticky note.

Eh, a sticky note is pretty darn secure for the kinds of attacks you care about. If your attack vector is someone breaking into your office the security game changes completely.

Yeah they either need a keycard or some tailgating to get to the bottom of my keyboard at which point they could just take the damn laptop and shuck the drive into an external enclosure and get everything that way, so nbd in my opinion.

Re: I hate password rules

#107

Post by passer_byer »

frosted-flakes wrote: post #82
kspacewalk2 wrote: post #16

Due to the nature of my job and the age of some of my coworkers, I am sometimes casually given passwords on a piece of paper. Out of a sample size of conservatively 20, I have never even once (!) seen a special character other than !. It just doesn't happen. Password rules and a requirement to change your password every X months are pure security mirage and just create frustration in people who often struggle to gene…

Requirements for uppercase letters, numbers, and special characters mean I stick an "A1!" at the end of my otherwise strong and memorable password. I'm sure I'm not the only one.

You would be correct. Mine is "#1". I use compound english words whose meaning is non-sensical in a conversation but easy to remember.

Re: I hate password rules

#108

Post by jjcm »

Here's how I do passwords - require a certain amount of entropy, and compare vs common passwords on the backend. That's it.

Here's a gif of it in action: http://files.jjcm.org/password.gif

And an example webcomponent that implements this: https://github.com/jjcm/soci-frontend/blob/master/components...

The ENTROPY_REQUIREMENT variable means you need a password that has at least 2^n possible combinations, given the character set and the length used. There's no restrictions other than that. If you want to only use lowercase letters, that's fine, as long as the length is long enough. If you include special characters, the length requirement drops.

I use a simple message to tell the user whether or not a password is acceptable, along with a radial progress bar to demonstrate success: "Not strong enough. Add complexity until the circle fills."

Re: I hate password rules

#109

Post by colinclerk »

eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

Disclosure: I am the cofounder https://www.clerk.dev

Here's the direct link to NIST 800-63B - it's really a fantastic document with sensible recommendations on every authentication method: https://pages.nist.gov/800-63-3/sp800-63b.html

The tedious part of NIST's password requirements is "Do check for compromised passwords"

HaveIBeenPwned exists, but most open source tools don't leverage it and this requirement goes overlooked.

At Clerk, we follow NIST guidelines by default, including integration with HIBP. In a world with password reuse and "credential stuffing" attacks, this feature is critical to securing your user accounts (unless you go full passwordless, but that has its own tradeoffs).

Re: I hate password rules

#110

Post by tdrdt »

Since I believe a password is the user's responsibility I use the UI to inform the user what a safe password is because most people have no clue.

For example:

Choose your password: A safe password contains many different characters, for example a sentence.

Post reply on HN