My password generator can make pronounceable nonsense words. It has worked ok so far. Some of them are embarrassing though.
My password generator (or just do it manually) can generate word passwords like correct-horse-battery-staple using real words, which is probably a bit easier to read over the phone.
not a password rule but: i use a password length of > 40 characters because why not? signing up for paypal worked with that no problemo until i had to sign in again and the login input ignored everything north of 20 characters or so. It worked after removing the maxlength attribute :(
NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...
How to practically check for common passwords? Ideal would be to have like the most common 1/1000th of the hibp so that it's not too big for deployment in some clever structure (compressed trie? bloom filter?). I don't trust 3rd party services.
The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me Or worse, they truncate your password after you've already used it for years and years. I had a 30-character password with Bank of America. Somewhere along the line, it changed its password requirements to only allow a maximum of 20 or 25 characters (I forget), which automatically invalidated m…
I'm not sure why anyone uses banks like BoA, Wells Fargo, First Niagara, etc. Fidelity is a superior experience in nearly every way - just categorically. I'm not sure if people just don't know that you can use Fidelity this way? The only downsides are no local branches, but that's hardly an issue unless you need a cashiers check. In those rare cases you can spin up an account at shitty bank, get the check, then close…
In what way? I'd be curious to understand what it is you value about them, but your post reads more like marketing than a satisfied customer story.
I used to travel a lot and the exact combination of no signal and internet was not frequent at all.
That heavily depends on where you travel. Even here in Southern California there are populated areas with little to no mobile internet service (like Big Bear Lake, Anza Borrego, or Joshua Tree areas for example)
And they still have internet available to travelers?
My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).
I've also had fun experiences where the "special characters" differ in the description than in the implementation in a few ways. Once I had a password accepted with non-alpha numeric characters which were considered invalid as input on the login screen and so even though my password was correct it would not let me log in because it was validated with different logic after creation. Another issue I've seen is that the…
For a while, Discord had few password restrictions so 5 characters were fine. Then they changed their app to only allow 6+ character passwords.
For websites, you're just making your own life harder for no real gain. Even with purely alphanumeric 10 chars, it's not like anyone can exhaust the 36^10 password space over a network with no one noticing. Yet whenever you run into issues with the website or the password manager (or some other non-routine thing... like you're on your phone and need to enter this on a different computer) and have to enter it manually…
I guess you assume that everyone protects their stored hashes.
Not really. Even if you're worried about that, (36 alphanumeric + 10 symbols)^10 is roughly 4E16. Even at 2B checks/second/CPU (which is incredibly generous if the web developer has any competence) that's around 10M CPU-seconds, i.e. 115 CPU-days. For cracking one single password. An ASIC will speed it up, but again, remember this is one single password, and it can be an overestimate by like a factor of > 1 million if the developer actually used a KDF (and I'm not sure why they wouldn't, if they're already hashing). How paranoid do you have to be (and how big of a target do you have to have made of yourself? and exactly how valuable are your credentials?) to worry about a threat like this for most websites? Maybe it makes sense for your primary email, but do average accounts really benefit? Compared to the inconvenience of when something goes wrong and you have to type a long password manually.
I've also had fun experiences where the "special characters" differ in the description than in the implementation in a few ways. Once I had a password accepted with non-alpha numeric characters which were considered invalid as input on the login screen and so even though my password was correct it would not let me log in because it was validated with different logic after creation. Another issue I've seen is that the…
I spent half a year being charged monthly by Microsoft because Google considers my email address the same whether or not it has a period in it but Microsoft had somehow split my account into two based on that difference.
that's.. really on you I think, and not at all similar to one site having differing validation rules in different places for the same data. What gmail does there isn't some kind of standard, it's a unique special feature google does. You don't want other sites getting clever about this sort of thing, because if the rules change much worse things will happen.
Now, sites that treat email addresses as case sensitive - those are evil.
And that's how you ensure everyone writes their password on a sticky note.
Eh, a sticky note is pretty darn secure for the kinds of attacks you care about. If your attack vector is someone breaking into your office the security game changes completely.
> If your attack vector is someone breaking into your office the security game changes completely.
There are at least two other important attack vectors against "sticky notes": accidental sharing through photographs and/or online meeting cameras, and visitors memorizing visible passwords. Both are defeated by hiding the sticky note below the keyboard, but my guess is that most people leave it visible on the monitor bezel.