Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

351–360 of 447 posts

Re: I hate password rules

#351

Post by vsareto »

er4hn wrote: post #251
bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

On the plus side, it also gave you plausible deniability it really was you if you wanted to do something illegal or unethical.

Like jeez, GP. Should’ve sold those aerospace secrets to China while you had the chance.

Re: I hate password rules

#352

Post by [deleted] »

waynecochran wrote: post #344

If I have an alphabet of size x and a password of length n there are x^n possibilities. What results in a larger set -- adding 1 more character to the alphabet or adding one to the length; i.e. which is bigger (x + 1)^n or x^(n+1)?

[deleted]

Re: I hate password rules

#353

Post by raldi »

Best rules I ever lived under were “We’re continuously running JTR against all users, and your password can be anything it’s unable to crack.”

Re: I hate password rules

#354

Post by scoot »

colinclerk wrote: post #109
eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

Disclosure: I am the cofounder https://www.clerk.dev Here's the direct link to NIST 800-63B - it's really a fantastic document with sensible recommendations on every authentication method: https://pages.nist.gov/800-63-3/sp800-63b.html The tedious part of NIST's password requirements is "Do check for compromised passwords" HaveIBeenPwned exists, but most open source tools don't leverage it and this requirement goes o…

Off-topic, but this is the second time in two days that I've seem someone on HN correctly use "disclosure" when disclosing something, rather than "disclaimer". A sea change?!

It's clueless, I know, but you'd be amazed at the percentage of people that think disclosing something is a disclaimer (sigh!)

Re: I hate password rules

#355

Post by throwaway984393 »

Password rules often happen because a customer who had a lot of money told somebody who wanted that money that they wanted these specific password rules.

"Oh, you require us to implement these stupid password rules you came up with, in order for us to get your 20 million dollars? We'll have it implemented by end of the week."

And this is also why those rules never seem to change, or only get worse. Nobody remembers when or why those rules were implemented, and nobody is going to risk potential business just to make passwords easier to use or more secure. Product security is always second to short-term gains and job security.

Re: I hate password rules

#356

Post by throwawaygh »

14 wrote: post #343
throwawaygh wrote: post #276

Earlier quoted context omitted.

The software industry is full of should-be-criminal forms of negligence. Things are already horrendously bad. Basically every American's identity could stolen at this point. If any nation state or other actor decided to operationalize any of the big leaks -- eg OPM or EquiFax -- the ramifications would be catastrophic. Imagine millions of people losing their retirement accounts and all their savings. Even if you coul…

I really like that term “Cyber 9/11”. Is that something you made up or is that a term people use describing a bad attack?

Thanks, but I can't take credit :) I think I first came across this term in a foreign affairs article, and from then on used it often in presentations to various brain-dead military officers who all seemed to have degrees in Biblical Studies from colleges whose boards are full of Domionionism types.

In any case, the term has been around for a while. Unfortunately, our officer corps is populated by weak-minded fools who have more allegiance for their quasi-Baptist cults and podcast hosts than their country. They all seemed to have a multi-year education in how to use Hebrew language factoids for isogesis, but had no god-damned clue what a "heap" was, and were effectively mid-level managers of "Cyber Operations"...

Our current state of affairs in the civilian sector isn't too surprising and I have infinitely more confidence in random banks and credit "borough" companies than I do in our military.

All of that to say: a cyber 9/11 attacking civilian infrastructure is a best-case scenario because that's where all the good people are. An actual 9/11 will probably attack the defense sector where all the incompetents work and will be way worse than actual 9/11. You have officers with theology degrees from shit-tier southern bible colleges to thank for it. After we're done bombing whatever rural town the hacker happened to live in, our next two steps should be professionalizing software engineering and writing history books about how christian fundamentalists destroyed the integrity of the US officer corps.

Re: I hate password rules

#357

Post by throwaway984393 »

core-utility wrote: post #175

Can anyone explain to me why even new products have a maximum character limit? I frequently see 16 or 20 maximum characters. If you're hashing the password, why does it matter?

If it's a bank, it's because the 40 year old database they first used to first digitize their 150-year-old accounts had a maximum character limit (which is why you sometimes see 8 character maximum passwords). Old accounts that generate money just by sitting around are also the reason they never need to upgrade anything and can make changes at a snail's pace.

Re: I hate password rules

#359

Post by mihaaly »

kemotep wrote: post #30

There does need to be some rules or else people would set their password to be blank or a few characters. I would be happy with consistent password rules. 1. No password that was included in a breach a la the “haveibeenpwned” hash check system[0]. 2. No password reuse. 3. A Minimum length. Something like 14-20 characters. And no maximum (or at least something set to at least 127 characters as the max allowed). 4. Res…

My favorite is when only a subset of special characters are allowed - and you must use special characters! Oh my god!

Re: I hate password rules

#360

Post by SapporoChris »

throwawaygh wrote: post #276
jaywalk wrote: post #258

Earlier quoted context omitted.

This level of negligence should be criminal.

The software industry is full of should-be-criminal forms of negligence. Things are already horrendously bad. Basically every American's identity could stolen at this point. If any nation state or other actor decided to operationalize any of the big leaks -- eg OPM or EquiFax -- the ramifications would be catastrophic. Imagine millions of people losing their retirement accounts and all their savings. Even if you coul…

Prepare for failure. A good rule, but painful is: The more income tied to an account the greater the difficulty to move the income. I'm too tired to list best practices but for example: Set up canaries, daily emails from your account just for the peace of mind that your email is the primary communication for the account. Biggest assets should take time and multiple steps to transfer or cashout. Know your account managers and be able to contact them directly.
Post reply on HN