Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

131–140 of 447 posts

Re: I hate password rules

#131

Post by slownews45 »

JTbane wrote: post #49
slownews45 wrote: post #17

Earlier quoted context omitted.

No kidding. Govt websites seem to think this is a positive. Of course, these same folks do the 90 day rotation. Result - everyone writing down passwords on post-it notes next to screens.

The TreasuryDirect website requires login with a case-insensitive on-screen keyboard in the page itself. I have no idea why such an idiotic approach would be taken.

I've used that site - got me to get rid of their inflation protected investments unfortunately! And no cut and paste.

Re: I hate password rules

#132

Post by uncletammy »

tomc1985 wrote: post #117
eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

> * Require MFA Using some kind of OTP authenticator app or device and __NOT__ SMS!

Anything requiring my phone number or a binary that runs on my phone is a deal breaker for me. It has massive privacy implications.

We desperately need to have better MFA options if we're going to require it from users.

Re: I hate password rules

#133

Post by BenjiWiebe »

dataflow wrote: post #77
loa_in_ wrote: post #72

Earlier quoted context omitted.

My passwords are all 20+ characters long

For websites, you're just making your own life harder for no real gain. Even with purely alphanumeric 10 chars, it's not like anyone can exhaust the 36^10 password space over a network with no one noticing. Yet whenever you run into issues with the website or the password manager (or some other non-routine thing... like you're on your phone and need to enter this on a different computer) and have to enter it manually…

For me I have long 20+ character passwords because my password manager remembers them for me, and I can copy/paste or autotype or copy them into the in-browser password manager.

I very rarely have to manually type in a password.

Re: I hate password rules

#134

Post by tpoacher »

I hate MFA. I get the "need", but it's a) generally shittily implemented, and c) frequently manipulated/enforced not for the right reasons (notably to force you to surrender your phone number)

Re: I hate password rules

#135

Post by ufo »

In another blog post, linked from this one, Bruce says that the XKCD scheme of stringing together a series of words is no longer safe:

> Modern password crackers combine different words from their dictionaries. This is why the oft-cited XKCD scheme for generating passwords — string together individual words like “correcthorsebatterystaple” — is no longer good advice. The password crackers are on to this trick.

Is that true? Or does it just mean we need more words in the password?

Re: I hate password rules

#136

Post by klhutchins »

dahfizz wrote: post #120
tomc1985 wrote: post #117

Earlier quoted context omitted.

> * Require MFA Using some kind of OTP authenticator app or device and __NOT__ SMS!

SMS is perfectly good as an additional authentication factor. i.e. When you log in on a new device using your user name and password, you also need to type in the text message code you were sent. It is a convenient way to strictly increase the security of an account. What SMS is terrible for is as a single point of account recovery. This is unfortunately how it is often used. "Multi factor authentication" in practice…

I think people also worry about the SIM card swap attack. Even if you have multiple ways to authenticate, RSA token, MFA app, and sms auth, the SIM card swap makes it way easier for someone else to have the thing only you should have.

Re: I hate password rules

#137

Post by teeray »

I’d really love the W3C to come out with some elements that provide:

1) Communication of complexity requirements

2) Explicit password manager fill targets

3) An endpoint for a password manager to rotate passwords automatically. (and the validity period)

All of these would be backwards compatible with grandmas that write passwords on post-its and mouldering IT policies that snub NIST recommendations. Sure, webauthn is wonderful and all, but it’s a whole lot easier to ask for some simple HTML changes rather than implementing a whole API.

Re: I hate password rules

#138

Post by starwind »

eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

Ironically, most of the government doesn't adhere to these recommendations

Re: I hate password rules

#139

Post by greggman3 »

dahfizz wrote: post #120
tomc1985 wrote: post #117

Earlier quoted context omitted.

> * Require MFA Using some kind of OTP authenticator app or device and __NOT__ SMS!

SMS is perfectly good as an additional authentication factor. i.e. When you log in on a new device using your user name and password, you also need to type in the text message code you were sent. It is a convenient way to strictly increase the security of an account. What SMS is terrible for is as a single point of account recovery. This is unfortunately how it is often used. "Multi factor authentication" in practice…

I guess you don't travel much. it's very common to have internet but not cell service (so no SMS). it's also common to buy a local sim so effectively no SMS or at least not the one you have registered.

So no, SMS is not perfectly good. it's crap and needs to die in a fire.

Re: I hate password rules

#140

Post by dr_kiszonka »

godshatter wrote: post #122
Arrath wrote: post #88

Earlier quoted context omitted.

I was working my way to it, when IT rolled out a new policy of "cannot share more than 2 consecutive characters with a previous password" or something like it, included in an email along the lines of "an audit has found this new policy applies to you". Dicks.

Doesn't that imply that the are saving your previous passwords in plain text somewhere instead of saving hashes of them? How is this more secure?

This would be my guess too. Alternatively, maybe they save hashes of all substrings of length > 2 and check all hashed substrings of the new password against them.

(Which - in my limited understanding of infosec - would be only marginally better than plaintext, but I can be wrong.)

Post reply on HN