Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

281–290 of 447 posts

Re: I hate password rules

#281

Post by rapht »

crooked-v wrote: post #84
eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

I have multiple financial accounts that still insist on using public-knowledge security questions (which of course I've given fake answers saved in my password manager) instead of just letting me set up proper 2FA. It's infuriating.

Don't get me started on online bank security. Here in France, most banks have decided that security is best achieved by:

- authenticating using a 'client number' (different from your 'account number', sent to you once by a physical mail you lost long ago) combined with a 4-to-6 digit (numeric-only) passcode that you have to input on a virtual keyboard

- confirming web-initiated transactions via their app on your phone... but when it's app-initiated, well, you don't have to confirm anything other than just retype your passcode

- in the end, introducing some awfully long delays between some actions e.g. creating a new beneficiary and being able to send money to her... because 'it's for your own protection that we degrade your client experience'

This just bugs me.

Re: I hate password rules

#282

Post by oehpr »

So... what's all this about XKCD's password scheme not being ok? I found the argument pretty compelling, in that even if you presumed the attacker knew how you generated your password, there would be too much entropy to work out what it was.

I'm going to do some quick googling about this.

edit: oh goodness, this appears to be a holy war, https://security.stackexchange.com/questions/62832/is-the-of...

I'll just plant my flag and wish the rest of you luck, use a password manager.

Re: I hate password rules

#283

Post by [deleted] »

wruza wrote: post #256
kibwen wrote: post #147

Earlier quoted context omitted.

Treating security questions like passwords and saving them in your password manager is correct, but make sure that your fake answers aren't autogenerated nonsense like ":s^Twd.J;3hzg=Q~". Many password reset flows involve communicating a security question over the phone, and it's easy enough for an attacker to guess "oh, it's just a bunch of random characters lol" and for the phone rep to just laugh and shrug their s…

Maybe “:s^Twd.J;3hzg=Q~ if I don’t spell it, it’s not me”?

[deleted]

Re: I hate password rules

#284

Post by duped »

lmilcin wrote: post #273
bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

A few years back, on day 1 of my new job I was given root access to one of the development boxes. So I ask: "Okay, how do I log in?" The IT guy: "What do you mean, you just log in using your personal domain account and then sudo su -. You know what sudo is?" (followed by loud sigh) Me: "You mean like production domain, same that we use for our desktop?" IT guy: "Of course! What do you mean, what other domain would yo…

> There you go, giving a fuck when it wasn't your turn to give a fuck.

>

> - Bunk

Re: I hate password rules

#285

Post by wruza »

tzs wrote: post #118
postalrat wrote: post #20

Earlier quoted context omitted.

Why require a password manager when you could require a hardware token instead.

Personally, because I do not want a repeat of the great toilet paper escalation of 1984. I used to buy toilet paper in individual rolls. I'd buy a couple rolls, and when I was on the last roll I'd make a mental not to myself to buy a couple more rolls next time I went grocery shopping. One day, when I was on my last roll, I ate some bad fast food which left my digestive system in a state that one roll was not suffici…

Well, that was quite a story. Have you considered water-washing? Not that it seemed possible to draw an analogy with hw tokens, but still.

Another way to handle these rare events is to have an emergency-only 12-pack and then go with your regular a couple of rolls mode.

Re: I hate password rules

#286

Post by aeternum »

oehpr wrote: post #282

So... what's all this about XKCD's password scheme not being ok? I found the argument pretty compelling, in that even if you presumed the attacker knew how you generated your password, there would be too much entropy to work out what it was. I'm going to do some quick googling about this. edit: oh goodness, this appears to be a holy war, https://security.stackexchange.com/questions/62832/is-the-of... I'll just plant…

In practice people do not use random words. Instead they use a song lyric or sentence from a popular book.

Many users used this strategy to secure their cryptocurrency 'brain' wallets only to have the funds quickly stolen.

Re: I hate password rules

#287

Post by recursive »

reaperducer wrote: post #230
gonehome wrote: post #225

Earlier quoted context omitted.

Cool - so a non-answer and condescending dismissal of genuine questions. Lots of people talk about finances online. See r/personalfinance or r/financialindependence. It’s a good way to learn.

I am not "lots of people." I have no interest in being "lots of people," or in proving myself to strangers on the internet. I cannot convey 50 years of my financial life, experience, and history into what fits in an internet post. Anyone who can probably has a very narrow view of finance. I can say that I know how to manage my finances, and my accountant agrees with my methods and track record. But if you think Reddi…

I don't necessarily think Reddit is a good route to financial literacy. Nor do I know of a better route. Despite (or because?) of all that, I still think the question was reasonable. If you don't want to answer the question, that's fine. But you don't have to be so antagonistic about it.

Re: I hate password rules

#288

Post by lmilcin »

duped wrote: post #284
lmilcin wrote: post #273

Earlier quoted context omitted.

A few years back, on day 1 of my new job I was given root access to one of the development boxes. So I ask: "Okay, how do I log in?" The IT guy: "What do you mean, you just log in using your personal domain account and then sudo su -. You know what sudo is?" (followed by loud sigh) Me: "You mean like production domain, same that we use for our desktop?" IT guy: "Of course! What do you mean, what other domain would yo…

> There you go, giving a fuck when it wasn't your turn to give a fuck. > > - Bunk

"The standard you walk past is the standard you accept."

Re: I hate password rules

#289

Post by ixacto »

throwawaygh wrote: post #276
jaywalk wrote: post #258

Earlier quoted context omitted.

This level of negligence should be criminal.

The software industry is full of should-be-criminal forms of negligence. Things are already horrendously bad. Basically every American's identity could stolen at this point. If any nation state or other actor decided to operationalize any of the big leaks -- eg OPM or EquiFax -- the ramifications would be catastrophic. Imagine millions of people losing their retirement accounts and all their savings. Even if you coul…

So you’re saying that is a gigantic target for China and Russia to go after lol. It would mean some change for the which might not be bad but that’s kinda like arguing for terrorism, which would be illegal and actually have enforcement behind it.

Re: I hate password rules

#290

Post by Pxtl »

robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

If they truncate on password set but don't truncate on password validation, that's the worst.
Post reply on HN