Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

151–160 of 447 posts

Re: I hate password rules

#151

Post by Sohcahtoa82 »

logfromblammo wrote: post #115
Arrath wrote: post #88

Earlier quoted context omitted.

I was working my way to it, when IT rolled out a new policy of "cannot share more than 2 consecutive characters with a previous password" or something like it, included in an email along the lines of "an audit has found this new policy applies to you". Dicks.

If that policy is enforceable, someone would have to be storing passwords in plaintext, or the hashing algorithm is too weak. IT shouldn't be able to tell anything about plaintext password similarity beyond equals or not-equals.

Ad-hoc, this is correct.

But at the time of the password change, no, assuming password changing requires you to enter your current password as well.

Re: I hate password rules

#152

Post by NackerHughes »

Causality1 wrote: post #113
memco wrote: post #79

Earlier quoted context omitted.

I've also had fun experiences where the "special characters" differ in the description than in the implementation in a few ways. Once I had a password accepted with non-alpha numeric characters which were considered invalid as input on the login screen and so even though my password was correct it would not let me log in because it was validated with different logic after creation. Another issue I've seen is that the…

I spent half a year being charged monthly by Microsoft because Google considers my email address the same whether or not it has a period in it but Microsoft had somehow split my account into two based on that difference.

I'm missing something, why would they charge you monthly for that?

Re: I hate password rules

#153

Post by enobrev »

rav wrote: post #23
clement_b wrote: post #2

Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.

I use the following bookmarklet to fix issues like this. It's similar to the browser addon discussed in sibling comments, but without installing a browser addon. Simply create a bookmark named e.g. "Don't mess with paste" with the following URL: javascript:void(document.documentElement.addEventListener('keydown',e=>e.keyCode==9&&e.stopPropagation(),true),document.documentElement.addEventListener('copy',e=>e.stopPropa…

I read this comment earlier and just now had to come back and use it so I could paste an account number during a signup process.

You just improved my day.

Thanks!

Re: I hate password rules

#154

Post by ryandrake »

spookthesunset wrote: post #68
pavon wrote: post #41

Earlier quoted context omitted.

Or the site lets your password manager fill the fields, but for some reason their javascript doesn't recognize it and refuses to let you submit because it hasn't verified your password as matching, meeting strength rules, etc. At least in that case deleting and typing just the last character usually fixes it.

Probably some developer who isn’t fully up to speed with what event hooks to use in order to trigger their JavaScript validation rules. And yes it is super annoying. …though not as annoying as sites that don’t let you copy / paste into their login fields.

Funny, since the problem of “typing stuff into a text field and submitting it to a web site” was solved over 20 years ago, and without JavaScript. Yet web developers today still manage to try and fail to solve it using code. I guess when your only tool is a hammer…

Re: I hate password rules

#155

Post by enriquto »

> I Hate Password Rules

I hate passwords altogether.

In this day and age, nearly all instances of password usage can be replaced by public key cryptography for a vastly improved user experience. And, of course, for a net gain in security.

Re: I hate password rules

#156

Post by NoGravitas »

tpoacher wrote: post #134

I hate MFA. I get the "need", but it's a) generally shittily implemented, and c) frequently manipulated/enforced not for the right reasons (notably to force you to surrender your phone number)

I actually kind of like TOTP, since I can choose the implementation I want to use, and make backups, and so on. I loathe having to use any kind of bespoke MFA app, and I just resent the use of SMS for MFA.

Re: I hate password rules

#157

Post by GoblinSlayer »

prepend wrote: post #105

Every time I run into this, I remember meetings where a dumbass engineer would convince a clueless PM that something was necessary. It seems too specific to be thought up by a non-engineer. I have no way of knowing this, but I do think companies with dumb password rules have poor talent. I need to start a list of companies with dumb password rules, but I rarely create new accounts so by the time I get annoyed, I’m di…

>I need to start a list of companies with dumb password rules

You were heard: https://github.com/duffn/dumb-password-rules

Re: I hate password rules

#158

Post by js2 »

kibwen wrote: post #147
crooked-v wrote: post #84

Earlier quoted context omitted.

I have multiple financial accounts that still insist on using public-knowledge security questions (which of course I've given fake answers saved in my password manager) instead of just letting me set up proper 2FA. It's infuriating.

Treating security questions like passwords and saving them in your password manager is correct, but make sure that your fake answers aren't autogenerated nonsense like ":s^Twd.J;3hzg=Q~". Many password reset flows involve communicating a security question over the phone, and it's easy enough for an attacker to guess "oh, it's just a bunch of random characters lol" and for the phone rep to just laugh and shrug their s…

  openssl rand -hex 8 | sed 's/..../&-/g;s/-$//'
Or if you like upper-case letters:

  openssl rand -hex 8 | sed 's/..../&-/g;s/-$//;y/abcdef/ABCDEF/

Re: I hate password rules

#159

Post by phist_mcgee »

antsar wrote: post #104
clement_b wrote: post #2

Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.

Thankfully, Firefox has an easy way to stop that. about:config dom.event.clipboardevents.enabled = false

Beware that this may break certain applications that read from your clipboard

https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxClipboar...

Re: I hate password rules

#160

Post by time0ut »

kibwen wrote: post #147
crooked-v wrote: post #84

Earlier quoted context omitted.

I have multiple financial accounts that still insist on using public-knowledge security questions (which of course I've given fake answers saved in my password manager) instead of just letting me set up proper 2FA. It's infuriating.

Treating security questions like passwords and saving them in your password manager is correct, but make sure that your fake answers aren't autogenerated nonsense like ":s^Twd.J;3hzg=Q~". Many password reset flows involve communicating a security question over the phone, and it's easy enough for an attacker to guess "oh, it's just a bunch of random characters lol" and for the phone rep to just laugh and shrug their s…

My password generator can make pronounceable nonsense words. It has worked ok so far. Some of them are embarrassing though.
Post reply on HN