Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

111–120 of 447 posts

Re: I hate password rules

#111

Post by [deleted] »

jbarberu wrote: post #34
robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

And then their sign-in page doesn't truncate it and it just fails to login... Absolutely love it! One of my favorites was Nintendo's user account. The web allows decent passwords when created, but then the actual game console only has room for inputting 15 characters or so for the password :@

[deleted]

Re: I hate password rules

#112

Post by kylebyproxy »

63 wrote: post #86
eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

Interestingly, one of the studies they cite finds that blocking common passwords is one of the most frustrating experiences for users. Even though it's more secure, the user has no idea what's wrong with their password or how to correct it.

I can't say how common this is, but many (most?) online accounts I personally interact with are disposable, represent no sensitive information, and I couldn't care less if they're compromised. They're one-time sign-ups, junk accounts, free trials, free tiers, etc.

> one of the most frustrating experiences

I understand this frustration as a mismatch between the user's non-expectation of security and the service's obeyance to industry security best practices.

Placing a cognitive burden of memorizing a new password just to try out your product strikes me as cruel.

Maybe only enforce password rules as progressive enhancement once sensitive information comes into play? After all, what's the point of protecting junk?

Re: I hate password rules

#113

Post by Causality1 »

memco wrote: post #79
robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

I've also had fun experiences where the "special characters" differ in the description than in the implementation in a few ways. Once I had a password accepted with non-alpha numeric characters which were considered invalid as input on the login screen and so even though my password was correct it would not let me log in because it was validated with different logic after creation. Another issue I've seen is that the…

I spent half a year being charged monthly by Microsoft because Google considers my email address the same whether or not it has a period in it but Microsoft had somehow split my account into two based on that difference.

Re: I hate password rules

#115

Post by logfromblammo »

Arrath wrote: post #88
kayodelycaon wrote: post #70

Earlier quoted context omitted.

I got up to P@ssW0rd12 at one job.

I was working my way to it, when IT rolled out a new policy of "cannot share more than 2 consecutive characters with a previous password" or something like it, included in an email along the lines of "an audit has found this new policy applies to you". Dicks.

If that policy is enforceable, someone would have to be storing passwords in plaintext, or the hashing algorithm is too weak.

IT shouldn't be able to tell anything about plaintext password similarity beyond equals or not-equals.

Re: I hate password rules

#116

Post by Arrath »

logfromblammo wrote: post #115
Arrath wrote: post #88

Earlier quoted context omitted.

I was working my way to it, when IT rolled out a new policy of "cannot share more than 2 consecutive characters with a previous password" or something like it, included in an email along the lines of "an audit has found this new policy applies to you". Dicks.

If that policy is enforceable, someone would have to be storing passwords in plaintext, or the hashing algorithm is too weak. IT shouldn't be able to tell anything about plaintext password similarity beyond equals or not-equals.

I had a similar concern. Or maybe it was a company wide email and that language was in there just because.

Of course, our company-wide email was down for 2-3 months a couple years ago due to a ransomware infection, so our IT isn't stellar. So who knows!

Re: I hate password rules

#117

Post by tomc1985 »

eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

> * Require MFA

Using some kind of OTP authenticator app or device and __NOT__ SMS!

Re: I hate password rules

#118

Post by tzs »

postalrat wrote: post #20
latchkey wrote: post #9

Instead of requiring people to have special password rules, we should require people to use a password manager. Then, if you have special password rules, the manager could generate a strong password that fits into the defined rules. Of course, getting rid of passwords entirely, is the best option (ie: using a decentralized sso solution).

Why require a password manager when you could require a hardware token instead.

Personally, because I do not want a repeat of the great toilet paper escalation of 1984.

I used to buy toilet paper in individual rolls. I'd buy a couple rolls, and when I was on the last roll I'd make a mental not to myself to buy a couple more rolls next time I went grocery shopping.

One day, when I was on my last roll, I ate some bad fast food which left my digestive system in a state that one roll was not sufficient to handle. With much effort I was able to regain sufficient control for a very hasty trip to the convenience store.

From then on, I bought my TP in four packs, and put "get more TP" on my list whenever I had finished two rolls from the current pack.

Alas, another bad fast food experience managed to defeat even that, although I was again able to barely make an emergency trip to the store safely.

So I upped it to buying two 4 packs--but it was too late. I felt nervous even with 8 rolls on hand, so I started making sure I had 12 rolls all the time. Then as soon as I opened a pack I'd get an urge to buy more TP.

Every trip to the store I'd buy some TP.

It took some effort but I managed to realize I had gone off the deep end and bring myself back to more normal TP acquisition habits.

I'm afraid that the if I get a hardware token and a backup token, the first time something happens to the main token I'll end going down that same path I did with TP and end up with a couple dozen tokens.

Re: I hate password rules

#119

Post by mojuba »

bobbylarrybobby wrote: post #66
mojuba wrote: post #10

An HTML input field can give your password generator a hint, right? Never looked at it closely but had the impression e.g. Safari's generator could adapt to certain rules and that they were somehow described in the HTML.

Yep, https://developer.mozilla.org/en-US/docs/Web/HTML/Element/in... there's even an option for a regex pattern that the password must match.

Interesting, that's different from what Safari supports (see sibling comment).

I wonder what the algorithm is to generate a good password that matches a given regex. Also there's a potential problem with patterns that are wrong or contain errors, that may result in simple and insecure passwords. I don't see how Mozilla's approach is better than Safari's.

Re: I hate password rules

#120

Post by dahfizz »

tomc1985 wrote: post #117
eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

> * Require MFA Using some kind of OTP authenticator app or device and __NOT__ SMS!

SMS is perfectly good as an additional authentication factor. i.e. When you log in on a new device using your user name and password, you also need to type in the text message code you were sent. It is a convenient way to strictly increase the security of an account.

What SMS is terrible for is as a single point of account recovery. This is unfortunately how it is often used. "Multi factor authentication" in practice has become "Use any one of multiple available factors for authentication", which is awful.

Post reply on HN