Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

141–150 of 447 posts

Re: I hate password rules

#141

Post by shadowgovt »

I use a password scrambler that generates a unique N-character string for every page. It's close to as much entropy as a one-time pad (technically, there is an underlying algorithm, so it could be reverse-engineered... But it'd require stealing my pass from several sites to start attacking it).

... except the sites that require a capital letter and an excalamation point. Those I sign into with "A!".

Good job, site designers. You've done nothing to improve security, but you have annoyed the hell out of me.

Re: I hate password rules

#142

Post by watwut »

greggman3 wrote: post #139
dahfizz wrote: post #120

Earlier quoted context omitted.

SMS is perfectly good as an additional authentication factor. i.e. When you log in on a new device using your user name and password, you also need to type in the text message code you were sent. It is a convenient way to strictly increase the security of an account. What SMS is terrible for is as a single point of account recovery. This is unfortunately how it is often used. "Multi factor authentication" in practice…

I guess you don't travel much. it's very common to have internet but not cell service (so no SMS). it's also common to buy a local sim so effectively no SMS or at least not the one you have registered. So no, SMS is not perfectly good. it's crap and needs to die in a fire.

I used to travel a lot and the exact combination of no signal and internet was not frequent at all.

Re: I hate password rules

#143

Post by OskarS »

uncletammy wrote: post #132
tomc1985 wrote: post #117

Earlier quoted context omitted.

> * Require MFA Using some kind of OTP authenticator app or device and __NOT__ SMS!

Anything requiring my phone number or a binary that runs on my phone is a deal breaker for me. It has massive privacy implications. We desperately need to have better MFA options if we're going to require it from users.

> or a binary that runs on my phone is a deal breaker

Phone numbers, fair enough, but TOTP is an open standard and there are plenty of open source implementations for the client side. It’s also available in most password managers (I use 1passwords implementation).

“MFA can’t require me to run a binary on my phone” is a bit extreme. TOTP is fine.

Re: I hate password rules

#144

Post by jliptzin »

crooked-v wrote: post #84
eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

I have multiple financial accounts that still insist on using public-knowledge security questions (which of course I've given fake answers saved in my password manager) instead of just letting me set up proper 2FA. It's infuriating.

Citibank is particularly egregious. 8 character MAXIMUM length, lots of special characters not permitted while requiring numbers and letters, forced password changing every few months, I absolutely hate it.

Re: I hate password rules

#145

Post by up6w6 »

tikkabhuna wrote: post #21
mojuba wrote: post #10

An HTML input field can give your password generator a hint, right? Never looked at it closely but had the impression e.g. Safari's generator could adapt to certain rules and that they were somehow described in the HTML.

Apple have "Password Rules"[1]. No idea how many password generators respect it though. I've created a CodeSandbox example of it being used.[2] 1Password does honour it. [1] https://developer.apple.com/password-rules/ [2] https://codesandbox.io/s/password-rules-demo-029h5

Bitwarden is on the way to support it.

https://github.com/bitwarden/browser/pull/2047

Re: I hate password rules

#146

Post by NoGravitas »

OskarS wrote: post #143
uncletammy wrote: post #132

Earlier quoted context omitted.

Anything requiring my phone number or a binary that runs on my phone is a deal breaker for me. It has massive privacy implications. We desperately need to have better MFA options if we're going to require it from users.

> or a binary that runs on my phone is a deal breaker Phone numbers, fair enough, but TOTP is an open standard and there are plenty of open source implementations for the client side. It’s also available in most password managers (I use 1passwords implementation). “MFA can’t require me to run a binary on my phone” is a bit extreme. TOTP is fine.

MFA can't require me to run your specific app is a good guideline, though. It still leaves TOTP as fine, as long as I can choose my implementation.

Re: I hate password rules

#147

Post by kibwen »

crooked-v wrote: post #84
eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

I have multiple financial accounts that still insist on using public-knowledge security questions (which of course I've given fake answers saved in my password manager) instead of just letting me set up proper 2FA. It's infuriating.

Treating security questions like passwords and saving them in your password manager is correct, but make sure that your fake answers aren't autogenerated nonsense like ":s^Twd.J;3hzg=Q~". Many password reset flows involve communicating a security question over the phone, and it's easy enough for an attacker to guess "oh, it's just a bunch of random characters lol" and for the phone rep to just laugh and shrug their shoulders and let the person in. Make sure it's a sentence that makes sense (I would even avoid non-sequitur passphrases such as those generated by diceware), while also making sure that it has no relationship whatsoever to the question.

Re: I hate password rules

#148

Post by makecheck »

Complex password rules haven’t been shown to improve security in any way. They have been proven to torpedo security, e.g. they make people forget so they do blatantly-insecure things like writing passwords down or relying more frequently on things that reduce account security like having to reset the password entirely through simple E-mails or codes, etc.

And speaking of banks, I am livid that so many of my financial accounts essentially require absolutely terrible passwords. A lot of them don’t support E-mail for log-in either.

Meanwhile, your basic “correct horse battery staple” [1] works pretty well.

[1] https://xkcd.com/936/

Re: I hate password rules

#149

Post by NoGravitas »

dataflow wrote: post #63
robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Can I ask what length your passwords are (roughly)? I don't understand the motivation for anything long in the context of randomly generated passwords for websites. 8-10 characters should be plenty. (This isn't to excuse silent truncation.)

"correct horse battery staple" is 28 characters. And it really should be two words longer than that these days.

Re: I hate password rules

#150

Post by Sohcahtoa82 »

Arrath wrote: post #106
Spivak wrote: post #97

Earlier quoted context omitted.

Eh, a sticky note is pretty darn secure for the kinds of attacks you care about. If your attack vector is someone breaking into your office the security game changes completely.

Yeah they either need a keycard or some tailgating to get to the bottom of my keyboard at which point they could just take the damn laptop and shuck the drive into an external enclosure and get everything that way, so nbd in my opinion.

> shuck the drive into an external enclosure and get everything that way

Disk encryption (ie, BitLocker) is supposed to prevent that from working.

Post reply on HN