Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

231–240 of 447 posts

Re: I hate password rules

#231

Post by vlunkr »

rudian wrote: post #209
scrooched_moose wrote: post #78

Earlier quoted context omitted.

Sounds like we have similar roles. I've never gotten them on paper, but multiple times a month I get emails along the lines of "My account doesn't work. My password is Banana1. Please fix". Every time I reset every single password they have (at least 4 hours of work for them) and inform them not to share passwords. Still, I've had users do it multiple times. I finally got all of our admin/root passwords into a passwo…

Congrats on getting them to use a password manager, now everyone can see all of their password by typing in the master password they stuck to the side of the screen. I'm only half-joking sadly, people just don't understand why password exist in the first place, so they comply maliciously.

I'm sure people do that, but the fact that they only have one password to remember, and (hopefully) don't have to rotate it would hopefully deter them

Re: I hate password rules

#232

Post by PaulHoule »

I had a talk with the head of security at my credit union and told him I was within this much distance of ending my relationship with them over the fact that their password rules were so tough.

I pointed out that there were some banks that had let me keep the same (securely generated) password for 15 years.

American Express tried to sell me on a deposit account to go with my card but they told me I'd need to make a new account to log in. I told them that one reason I kept my AmEx was that they didn't make me change my password every time I wanted to log in and if I had to add a second login it wasn't worth it to me.

Re: I hate password rules

#233

Post by vimy »

KronisLV wrote: post #227
vimy wrote: post #223

For the vast majority of websites password rules are unnecessary. I only care about icloud and gmail, amazon and paypal. I don’t care if my reddit account is “hacked”. Or HN. Or random webshops or whatever. I hate being forced to use strong passwords for accounts I don’t care about.

What cannot be ignored is the fact that many people will attempt to use the same password for multiple sites if given the chance. Furthermore, some of those shops may contain identifiable information which could be problematic. Personally, i take a slightly different approach: i don't care about almost any of my passwords... because they're randomly generated! KeePass gives you very nice choices in regards to this, w…

Well yes, that’s exactly my point. I _want_ to be able to reuse crappy passwords because just typing a password is still simpler than dealing with password managers.

Re: I hate password rules

#234

Post by SAI_Peregrinus »

dataflow wrote: post #63
robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Can I ask what length your passwords are (roughly)? I don't understand the motivation for anything long in the context of randomly generated passwords for websites. 8-10 characters should be plenty. (This isn't to excuse silent truncation.)

All my passwords are passphrases, randomly generated and stored in my password manager. Usually 10 words, for about 130 bits of entropy. EG PledgeRoutineSuitableBunkhouseExceptionCremeReassureChildishPhrasingNuclear, which is 76 ASCII characters but only 10 symbols.

They're stored in a password manager, but they're typeable if needed. My "security question" answers (mother's maiden name, etc) are generated the same way, unique per use, and also stored in my password manager.

Most sites don't need 128 bits of entropy. But things like banking or subscriptions should have at least 112 bits of entropy. And it's easy to just set the generator to 10 words by default.

Re: I hate password rules

#235

Post by zamadatix »

kylebyproxy wrote: post #112
63 wrote: post #86

Earlier quoted context omitted.

Interestingly, one of the studies they cite finds that blocking common passwords is one of the most frustrating experiences for users. Even though it's more secure, the user has no idea what's wrong with their password or how to correct it.

I can't say how common this is, but many (most?) online accounts I personally interact with are disposable, represent no sensitive information, and I couldn't care less if they're compromised. They're one-time sign-ups, junk accounts, free trials, free tiers, etc. > one of the most frustrating experiences I understand this frustration as a mismatch between the user's non-expectation of security and the service's obey…

Passwords often protect things like random niche forum boards from grief more than they protect the user's sensitive information in such cases. 3rd party auth is a great solution but a lot of people don't want to tie their "real" accounts to the low tier sites. MFA is of even greater help for low tier site's pains but if you can't get someone to use a decent password or link their identity how likely are you to set up 2FA for it? In the case of "free" services type signups they want you to onboard your information or link your identity and an account workflow is the easiest way to do that as it's a small percentage that will go through the trouble of burner or temp emails and fake info yet at least you have an easy way to rate limit such users from hijacking your "free" offerings.

Also you're not supposed to be memorizing anything for logins. At the very least you should be letting your browser use the randomly generated password and save it to the browser password store if you're not using a full blown password manager.

Re: I hate password rules

#236

Post by josephcsible »

I like the rule that Nextcloud uses by default: rather than requiring character class minimums or anything like that, it makes sure that the password you picked isn't one of the top 1,000,000 most commonly used passwords.

Re: I hate password rules

#237

Post by amelius »

teeray wrote: post #137

I’d really love the W3C to come out with some elements that provide: 1) Communication of complexity requirements 2) Explicit password manager fill targets 3) An endpoint for a password manager to rotate passwords automatically. (and the validity period) All of these would be backwards compatible with grandmas that write passwords on post-its and mouldering IT policies that snub NIST recommendations. Sure, webauthn is…

W3C can come up with all the elements they like but websites won't use them because they don't match with company style and the latest trends in graphic design.

Re: I hate password rules

#238

Post by zamadatix »

sleavey wrote: post #196
throwawayboise wrote: post #46

Earlier quoted context omitted.

Supermicro BMC passwords do that. Recently (i.e. this year) I set up a bunch of servers and was setting the BMC password to a known value. Apparently there is a limit of 20 characters for the password. The password I set was 21 characters (which was accepted without error). When I tried to log in with this password, the login was rejected. However if I log in with just the first 20 characters of the password, it work…

They should at least make their sign-up and login password fields have the same max length attributes...

It's even worse than that the BMC is a preconfigured part of the server not something you go to a sign up page for. It's literally the _change password functionality_ that does not warn/error on the password being too long!

Re: I hate password rules

#239

Post by vangelis »

reaperducer wrote: post #230
gonehome wrote: post #225

Earlier quoted context omitted.

Cool - so a non-answer and condescending dismissal of genuine questions. Lots of people talk about finances online. See r/personalfinance or r/financialindependence. It’s a good way to learn.

I am not "lots of people." I have no interest in being "lots of people," or in proving myself to strangers on the internet. I cannot convey 50 years of my financial life, experience, and history into what fits in an internet post. Anyone who can probably has a very narrow view of finance. I can say that I know how to manage my finances, and my accountant agrees with my methods and track record. But if you think Reddi…

That response is awfully unconstructive and dismissive. Perhaps you're able to articulate why you believe Reddit, specifically r/personalfinance and other reasonable boards, are bad, no?

Re: I hate password rules

#240

Post by dwighttk »

My fav is when it says "your password is too short" when it actually means "we didn't think anyone would try a password longer than 12 characters and your 48 character password messed up our code."
Post reply on HN