Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

171–180 of 447 posts

Re: I hate password rules

#171

Post by banana_giraffe »

clement_b wrote: post #2

Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.

I've had this in my AutoHotkey file for a long time now:

    ; Type in the clipboard
    ^!v::
    MyClip = %clipboard%
    StringReplace, MyClip, MyClip, `r, , All
    SendRaw %MyClip%
    return
So I can hit Ctrl-Alt-V and have it type in whatever's in my clipboard. I use it to scrub the text and deal with stupid sites and forms that don't allow paste. I also have a variant that adds a Sleep so I can do the same thing when something like RDP takes control.

Re: I hate password rules

#172

Post by elischleifer »

Having spent the last weekend trying to explain the arcane rules of 1Password to my mother, I can completely relate to this post. When things are overly complicated people start to work around them ... store master passwords and other codes in local files because it is a giant pain to enter them.

Corporate level password security should not be enforced on individual users who don't have IT support to keep their systems working cleanly.

Re: I hate password rules

#173

Post by enriquto »

Zamicol wrote: post #169
enriquto wrote: post #155

> I Hate Password Rules I hate passwords altogether. In this day and age, nearly all instances of password usage can be replaced by public key cryptography for a vastly improved user experience. And, of course, for a net gain in security.

Do you have any examples of this in the wild?

ssh?

Why can I connect to a remote server without using any password, but still need one to read the mail?

Re: I hate password rules

#174

Post by fragmede »

time0ut wrote: post #160
kibwen wrote: post #147

Earlier quoted context omitted.

Treating security questions like passwords and saving them in your password manager is correct, but make sure that your fake answers aren't autogenerated nonsense like ":s^Twd.J;3hzg=Q~". Many password reset flows involve communicating a security question over the phone, and it's easy enough for an attacker to guess "oh, it's just a bunch of random characters lol" and for the phone rep to just laugh and shrug their s…

My password generator can make pronounceable nonsense words. It has worked ok so far. Some of them are embarrassing though.

My password generator (or just do it manually) can generate word passwords like correct-horse-battery-staple using real words, which is probably a bit easier to read over the phone.

Re: I hate password rules

#176

Post by hansvm »

NackerHughes wrote: post #152
Causality1 wrote: post #113

Earlier quoted context omitted.

I spent half a year being charged monthly by Microsoft because Google considers my email address the same whether or not it has a period in it but Microsoft had somehow split my account into two based on that difference.

I'm missing something, why would they charge you monthly for that?

Extra user fee on some kind of SAAS?

Re: I hate password rules

#177

Post by MomoXenosaga »

eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

I believe in personal responsibility. If someone wants to use 1234 they should be allowed to.

America is strange, any rando nutjob should have access to firearms but US corporations are terrified of being sued.

Re: I hate password rules

#178

Post by thecodrr »

Discloser: I am the co-founder (https://notesnook.com)

We used to ask our users 90% of the standard password requirements (min length 8, 1 special character, 1 digit, 1 capital etc). The result was a lot of people forgetting their password and having a really bad first impression. We were following "best practices" but the user didn't care.

In the end, we took out all the requirements except one: password must be 8 characters long. While we knew this wasn't recommended, especially for a private note taking app, it was a necessary choice because a lot of people either just modified their old passwords or used new ones which they forgot and got locked out. Good security but...if you also get locked out, what's the point? As for people who used password managers, it doesn't matter either way.

A lot of people sign up just to try out the app. Nothing serious. Nothing too critical. If they get locked out after their first usage, it's goodbye from them. I think there are a few things apps can do to improve security without annoying the user too much:

1. Show user a notice inside the app if the password is below a certain strength threshold, recommending them to change it.

2. If the password is reused or compromised, show a permanent warning either on startup or somewhere noticeable inside the app.

3. Promote use of password managers during sign up (and other places)

Ultimately, it should be up to the user to decide if they really want to change their password or risk having their account comprised.

None of these are tested though so I am not sure what the UX would be...

Re: I hate password rules

#179

Post by exolymph »

js2 wrote: post #158
kibwen wrote: post #147

Earlier quoted context omitted.

Treating security questions like passwords and saving them in your password manager is correct, but make sure that your fake answers aren't autogenerated nonsense like ":s^Twd.J;3hzg=Q~". Many password reset flows involve communicating a security question over the phone, and it's easy enough for an attacker to guess "oh, it's just a bunch of random characters lol" and for the phone rep to just laugh and shrug their s…

openssl rand -hex 8 | sed 's/..../&-/g;s/-$//' Or if you like upper-case letters: openssl rand -hex 8 | sed 's/..../&-/g;s/-$//;y/abcdef/ABCDEF/

This would still parse as "random letters and numbers" to your typical support agent, no?

Re: I hate password rules

#180

Post by gxqoz »

I hate a lot of the new paradigms with passwords. This includes things like letting you sign up for an account and placing you in an in-between state until your email is verified (with no indication this is the case until you check your email). Or moving login password entry to a separate screen from entering the username.
Post reply on HN