Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

291–300 of 447 posts

Re: I hate password rules

#291

Post by zahma »

The worst is when some forms set rules but prevent the user from pasting a string into the duplicate field for verification. If this is meant to prevent user error in case of a typo in the first field, then it also thwarts many of us using password managers. Somehow my browser can auto-generate and enter a password, but I can’t. That’s a work-around, but it’s irksome anyway.

On another note, a more constructive metric for password security on a basic website account would be to set a complexity standard that allows multiple ways to get there. A haiku of approximately 60 plain characters, for example, should be as secure as a 30 character alphanumeric string, at least when it comes to brute forcing. It seems to me like plenty of weak passwords could be created to eke out the minimum requirements for a lot of sites, so this standard lends a false sense of security, especially when any password is recycled.

Re: I hate password rules

#292

Post by Symbiote »

latchkey wrote: post #36
postalrat wrote: post #20

Earlier quoted context omitted.

Why require a password manager when you could require a hardware token instead.

I'll let you explain that to my 90 year old grandma. (not that a password manager is really any better in this case)

Would it be that difficult?

Leave a small one connected to her computer (I assume she always uses the same one). The web browser prompts "Now touch your security key", and the light is flashing.

It's also a good defence againt phishing, as the key won't authenticate against a phishing site.

Re: I hate password rules

#293

Post by wruza »

postalrat wrote: post #64
Someone1234 wrote: post #26

Earlier quoted context omitted.

One costs money and requires a physical item, the other is commonly free, and you can sign in from multiple locations/devices. Hardware tokens have only managed to prove that hardware tokens won't ever take off due to their inherent limitations and liabilities.

Make them required, they will take off. Most phones made in the past few years can operate as one.

Do you mean like via NFC? That would be great, are there viable solutions for windows/etc?

Re: I hate password rules

#294

Post by wruza »

amelius wrote: post #241
core-utility wrote: post #175

Can anyone explain to me why even new products have a maximum character limit? I frequently see 16 or 20 maximum characters. If you're hashing the password, why does it matter?

Perhaps to prevent buffer overflow problems. Simplifies development and testing.

Wait, what? Even if they write their auth backends in C or assembly, nothing stops them from “#define MAXPWLEN 100”.

Re: I hate password rules

#295

Post by amelius »

wruza wrote: post #294
amelius wrote: post #241

Earlier quoted context omitted.

Perhaps to prevent buffer overflow problems. Simplifies development and testing.

Wait, what? Even if they write their auth backends in C or assembly, nothing stops them from “#define MAXPWLEN 100”.

That's still a limit.

Re: I hate password rules

#296

Post by dheera »

eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

> Require MFA

But allow at least 2 hardware keys and not only SMS.

Re: I hate password rules

#297

Post by dan-robertson »

jaywalk wrote: post #258
bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

This level of negligence should be criminal.

I don’t see why. I think it’s generally silly to think of your work computer/account as a place for anything private. Even if they won’t normally look at it, it’s all fair game if e.g. someone subpoenas them. My employer had a team which did a similar thing to the GP (had a spreadsheet with everyone’s password) in case someone was out and had some crucial file on their computer. And while they have since stopped doing that, it is because they improved processes such that it wasn’t needed and not because it became acceptable for the team to fail to carry out a large portion of their business activities or obligations because someone important was sick.

The problem is that the spreadsheet meant that exploiting one user meant exploiting the whole team but you can have this kind of privilege escalation in plenty of other ways. An easy way is to give people lots of permissions so that they can get their work done, or to just be bad at revoking permissions once they are no longer needed. Plenty of companies deliberately give people wide read permissions as a part of a culture of openness.

Re: I hate password rules

#298

Post by jjeaff »

throwawaygh wrote: post #276
jaywalk wrote: post #258

Earlier quoted context omitted.

This level of negligence should be criminal.

The software industry is full of should-be-criminal forms of negligence. Things are already horrendously bad. Basically every American's identity could stolen at this point. If any nation state or other actor decided to operationalize any of the big leaks -- eg OPM or EquiFax -- the ramifications would be catastrophic. Imagine millions of people losing their retirement accounts and all their savings. Even if you coul…

I would assume that a few nation state actors have already hoovered up all that leaked information and have it implemented in a system that is ready to steal identities, drain accounts, and otherwise wreak havoc on a large scale. They are just waiting for the higher ups to pull the trigger if and when they decide to deploy it.

Re: I hate password rules

#299

Post by [deleted] »

js2 wrote: post #158
kibwen wrote: post #147

Earlier quoted context omitted.

Treating security questions like passwords and saving them in your password manager is correct, but make sure that your fake answers aren't autogenerated nonsense like ":s^Twd.J;3hzg=Q~". Many password reset flows involve communicating a security question over the phone, and it's easy enough for an attacker to guess "oh, it's just a bunch of random characters lol" and for the phone rep to just laugh and shrug their s…

openssl rand -hex 8 | sed 's/..../&-/g;s/-$//' Or if you like upper-case letters: openssl rand -hex 8 | sed 's/..../&-/g;s/-$//;y/abcdef/ABCDEF/

[deleted]

Re: I hate password rules

#300

Post by kemotep »

memco wrote: post #94
kemotep wrote: post #30

There does need to be some rules or else people would set their password to be blank or a few characters. I would be happy with consistent password rules. 1. No password that was included in a breach a la the “haveibeenpwned” hash check system[0]. 2. No password reuse. 3. A Minimum length. Something like 14-20 characters. And no maximum (or at least something set to at least 127 characters as the max allowed). 4. Res…

> 1. No password that was included in a breach a la the “haveibeenpwned” hash check system[0]. Now imagine that in some years every password below 20 characters has been in some breach on haveibeenpwned and now every user of every system needs a new password that is 21+ characters. Some period of time will occur wherein everyone will upgrade rinse and repeat. > No requirements for special characters or not, just long…

Well randomized as in not your daughter’s name and her birthday as a password. But I get what you mean. Diceware passwords can provide “sufficiently random” passphrases that, if the end user chooses, does not have to have any numbers or special characters.

For the first part, yes at some point in the future, any password n-1 will be in the database. Getting users to get used to generating 20+ character strong passwords is a challenge today. Once we can solve that, through education, we can then move beyond passwords and single factor authentication.

Post reply on HN