Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

311–320 of 447 posts

Re: I hate password rules

#311

Post by otagekki »

lmilcin wrote: post #273
bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

A few years back, on day 1 of my new job I was given root access to one of the development boxes. So I ask: "Okay, how do I log in?" The IT guy: "What do you mean, you just log in using your personal domain account and then sudo su -. You know what sudo is?" (followed by loud sigh) Me: "You mean like production domain, same that we use for our desktop?" IT guy: "Of course! What do you mean, what other domain would yo…

I think even if you were fired, you'd have dodged not a bullet but a cannonball there.

Sometimes being the nice guy full of good faith doesn't pay. Literally

Re: I hate password rules

#312

Post by stjohnswarts »

bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

It also gave you plausible deniability which would have stood up in any court.

Re: I hate password rules

#313

Post by stjohnswarts »

throwawaygh wrote: post #276
jaywalk wrote: post #258

Earlier quoted context omitted.

This level of negligence should be criminal.

The software industry is full of should-be-criminal forms of negligence. Things are already horrendously bad. Basically every American's identity could stolen at this point. If any nation state or other actor decided to operationalize any of the big leaks -- eg OPM or EquiFax -- the ramifications would be catastrophic. Imagine millions of people losing their retirement accounts and all their savings. Even if you coul…

Eh I think you went into hyperbolic assertations here. Might want to walk it back. It's bad but it's not as bad as you say.

Re: I hate password rules

#314

Post by lmilcin »

otagekki wrote: post #311
lmilcin wrote: post #273

Earlier quoted context omitted.

A few years back, on day 1 of my new job I was given root access to one of the development boxes. So I ask: "Okay, how do I log in?" The IT guy: "What do you mean, you just log in using your personal domain account and then sudo su -. You know what sudo is?" (followed by loud sigh) Me: "You mean like production domain, same that we use for our desktop?" IT guy: "Of course! What do you mean, what other domain would yo…

I think even if you were fired, you'd have dodged not a bullet but a cannonball there. Sometimes being the nice guy full of good faith doesn't pay. Literally

Nah, I worked there for a long time and I was sad when I needed to leave. I had best boss and best project ever and I learned and grew a lot.

Re: I hate password rules

#315

Post by Traster »

bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

Pro tip: When you're seeing something really unethical that could eventually rebound on you - write it down. Write down contemporaneously what happened and sign and date it. Much more reliable evidence.

Re: I hate password rules

#316

Post by stjohnswarts »

crooked-v wrote: post #84
eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

I have multiple financial accounts that still insist on using public-knowledge security questions (which of course I've given fake answers saved in my password manager) instead of just letting me set up proper 2FA. It's infuriating.

Yeah my bank does this. I've been meaning to call around and find a credit union that has 2FA and doesn't require this garbage. I changed my questions to a randomly generated password and put it in my password manager.

Re: I hate password rules

#317

Post by hervature »

mumblemumble wrote: post #307
wruza wrote: post #256

Earlier quoted context omitted.

Maybe “:s^Twd.J;3hzg=Q~ if I don’t spell it, it’s not me”?

Will probably work about as well as that time when I was young and decided to spend about a week signing all receipts with a signature that looks nothing like my usual one, just to see if it would ever be challenged. Many people are, contrary to all pretense, mostly paid to not give any actual fucks.

What do you think the signature is for? If a store can provide a signed receipt, the bank eats a chargeback. If they can't, the business pays. No one verifies that it is your signature. It is just an anachronism of how contracts work.

Re: I hate password rules

#318

Post by stjohnswarts »

dahfizz wrote: post #120
tomc1985 wrote: post #117

Earlier quoted context omitted.

> * Require MFA Using some kind of OTP authenticator app or device and __NOT__ SMS!

SMS is perfectly good as an additional authentication factor. i.e. When you log in on a new device using your user name and password, you also need to type in the text message code you were sent. It is a convenient way to strictly increase the security of an account. What SMS is terrible for is as a single point of account recovery. This is unfortunately how it is often used. "Multi factor authentication" in practice…

You absolutely should lock your SIM always. SIM duplication is a thing.

Re: I hate password rules

#319

Post by kristopolous »

I've just given up and use

   $ openssl rand -base64 xx
Recently I had a password reject based on policy even using this.

The minimum character length was 50! That's a subtle way of essentially forcing you to use a password manager of some sort

I'm pretty sure this approach will eventually screw me over. I don't know how but it feels like it'll happen

Re: I hate password rules

#320

Post by otagekki »

I used to have those: 8-24 characters among which 1 uppercase/lowercase, 1 special character among a whitelist, and renew that every 2 months. At renewal, must be different from all your previous passwords and the new password must be at least 3 character different from last one. SSH keys can't be used per security policy and the same rule has been applied to the password manager.

A pain.

And yes the most annoying is that it's never the same rules, and I resort to using Keepass or worse, my browser password-remembering system (stores passwords to Google/Mozilla servers)

Is bruteforcing passwords still a thing nowadays? Once in a while I tend to forget my Wikipedia account password and after a couple of failed attempts I get shown a captcha.

On another day, I got locked out of my own account because I was trying to log in using another mobile device with another SIM in another country.

Post reply on HN