Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

191–200 of 447 posts

Re: I hate password rules

#191

Post by pixl97 »

toto444 wrote: post #48
kemotep wrote: post #30

There does need to be some rules or else people would set their password to be blank or a few characters. I would be happy with consistent password rules. 1. No password that was included in a breach a la the “haveibeenpwned” hash check system[0]. 2. No password reuse. 3. A Minimum length. Something like 14-20 characters. And no maximum (or at least something set to at least 127 characters as the max allowed). 4. Res…

> 4. Reset no more than once a year. That would make a lot of people's life terrible. I reset my passwords very frequently (almost every time I log out of a website)

I'm pretty sure the user means "required reset", rather than ones ability to reset at will.

Re: I hate password rules

#192

Post by teawrecks »

dataflow wrote: post #77
loa_in_ wrote: post #72

Earlier quoted context omitted.

My passwords are all 20+ characters long

For websites, you're just making your own life harder for no real gain. Even with purely alphanumeric 10 chars, it's not like anyone can exhaust the 36^10 password space over a network with no one noticing. Yet whenever you run into issues with the website or the password manager (or some other non-routine thing... like you're on your phone and need to enter this on a different computer) and have to enter it manually…

It's trivial to choose a smaller pw for sites that are difficult, but for the ones where I'm only ever using a pw manager to access, there's no reason not to use a 20 char unique random string.

Re: I hate password rules

#193

Post by ben0x539 »

eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

> * Require more than 8 characters

If I'm reading this right, it's more than 7 characters. And more than 5 if you don't let users pick the password, which seems surprising.

> Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric.

Re: I hate password rules

#194

Post by globular-toast »

The worst one I've experienced recently is HSBC's online banking. It requires you to set up a 6-10 digit PIN number on the phone and tells you that you must memorise it, not write it down. Yeah right. Like I'm going to commit a 6 digit number to memory while on the phone. This is one where I bet at least half of logins are the "forgot my password" type (the other half probably wrote it down).

Re: I hate password rules

#195

Post by selfhoster11 »

CurrentB wrote: post #3
clement_b wrote: post #2

Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.

https://chrome.google.com/webstore/detail/dont-fuck-with-pas... This has been a greatly appreciated plugin for these scenarios (it's on Firefox as well)

I was going to mention that plugin as well. Its name is explicit with good reason.

Re: I hate password rules

#196

Post by sleavey »

throwawayboise wrote: post #46
robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Supermicro BMC passwords do that. Recently (i.e. this year) I set up a bunch of servers and was setting the BMC password to a known value. Apparently there is a limit of 20 characters for the password. The password I set was 21 characters (which was accepted without error). When I tried to log in with this password, the login was rejected. However if I log in with just the first 20 characters of the password, it work…

They should at least make their sign-up and login password fields have the same max length attributes...

Re: I hate password rules

#197

Post by infogulch »

qwertox wrote: post #185

I had a 16 character password which I used in an PC online-banking application. After an update the password was unable to unlock the database. So I started creating new databases with different passwords to see what was going on, and it turned out that all passwords longer than 10 characters were failing. So I truncated my old password to 10 characters and then it worked. No hint, no nothing in the release notes.

I guess that means that it was silently truncating before the update.

Re: I hate password rules

#198

Post by teawrecks »

randomluck040 wrote: post #22
robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Wait, what? That never happened to me. How do you go and find out your password then? Trial and error?

T-Mobile did this to me a few years ago. Don't know if they still do, but I couldn't believe anyone thought that was ok.

Re: I hate password rules

#199

Post by alliao »

qwertox wrote: post #185

I had a 16 character password which I used in an PC online-banking application. After an update the password was unable to unlock the database. So I started creating new databases with different passwords to see what was going on, and it turned out that all passwords longer than 10 characters were failing. So I truncated my old password to 10 characters and then it worked. No hint, no nothing in the release notes.

yikes? that means they knew your password therefore able to truncate it to 10 characters?!

Re: I hate password rules

#200

Post by Vendan »

Sohcahtoa82 wrote: post #151
logfromblammo wrote: post #115

Earlier quoted context omitted.

If that policy is enforceable, someone would have to be storing passwords in plaintext, or the hashing algorithm is too weak. IT shouldn't be able to tell anything about plaintext password similarity beyond equals or not-equals.

Ad-hoc, this is correct. But at the time of the password change, no, assuming password changing requires you to enter your current password as well.

If just with previous password, then yeah, that's fine, but more then likely they are saying with the previous N passwords, which would require storing the previous N passwords in some kind of plain text or easily reversible form. Even if those old passwords are useless at that point (which might not be the case for something like a laptop that hasn't talked to the domain controller and learned that the password has been updated or something), it's still dangerous (what if they used that password on a vendor's site, or on their own banking login...)
Post reply on HN