Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

361–370 of 447 posts

Re: I hate password rules

#361

Post by throwawaygh »

jjeaff wrote: post #298
throwawaygh wrote: post #276

Earlier quoted context omitted.

The software industry is full of should-be-criminal forms of negligence. Things are already horrendously bad. Basically every American's identity could stolen at this point. If any nation state or other actor decided to operationalize any of the big leaks -- eg OPM or EquiFax -- the ramifications would be catastrophic. Imagine millions of people losing their retirement accounts and all their savings. Even if you coul…

I would assume that a few nation state actors have already hoovered up all that leaked information and have it implemented in a system that is ready to steal identities, drain accounts, and otherwise wreak havoc on a large scale. They are just waiting for the higher ups to pull the trigger if and when they decide to deploy it.

Yes. I'd be astounded if multiple such attacks aren't ready to deploy. At least 6? Maybe as many as 12. What it's waiting for is a desperate enough actor or a weak enough moment. Russia and China learned from Japan and ISIS et al learned from bin Laden -- divide, don't unite.

But eventually there will be a sufficiently naive actor and/or a sufficiently weak moment.

The tragedy, of course, is that all we have to do is address the totally and completely obvious problem. It wouldn't even be that hard. But we won't. Last 4 of SSN is still enough to transfer a SIM even with explicit direction otherwise, and transferring a SIM is still enough to drain a bank account even with explicit direction otherwise.

Re: I hate password rules

#362

Post by U8dcN7vx »

enobrev wrote: post #96
clement_b wrote: post #2

Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.

Far too many sites seem to do this with bank account numbers, where you can't paste into the account number OR the confirmation field. Now I need to drag my tab to another window and type it out (twice) and then read and confirm it. If I'm on mobile - forget it. I'm far more likely to get my account number _and_ confirmation wrong if I type them rather than copy/pasting them in from my bank's site.

Keepass2Android's keyboard solves this for me.

Re: I hate password rules

#363

Post by pitay »

matheusmoreira wrote: post #167
crooked-v wrote: post #84

Earlier quoted context omitted.

I have multiple financial accounts that still insist on using public-knowledge security questions (which of course I've given fake answers saved in my password manager) instead of just letting me set up proper 2FA. It's infuriating.

Yeah, my bank does that too. Asks for my birthday for "security" reasons. They also kill their website's usability by forbidding physical keyboards and forcing users to use a virtual keyboard with randomized key layouts in order to type passwords in a feeble attempt to defeat keyloggers. Some banks even make it extra annoying by generating ambiguous keys like "1 or 7" or "2 or 3". The saddest thing is banks can't be…

My bank used to have a virtual keypad, they now have a normal password field. So they actually saw reason. I think there is reason to be optimistic about bank password security getting better; what is known to be good password policies and interfaces are getting more widespread. It may take some time, but it should get better because it is accidental or ignorant password policies from the past, not deliberate attempts to make their customers trip up (unless someone knows better).

As for the asking birthday for security reasons, relic from the past, getting more useless as time goes by. With so many websites asking for that information, and then they get hacked, sold or leaked. Yes, this said the completely obvious, but it still amazes me that any organisation that I have a financial relationship with asks that for identification over the phone, usually my address as well, but that is almost as public.

Re: I hate password rules

#364

Post by GekkePrutser »

bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

My work is also big on pass phrases but I kinda hate them. It's a lot of extra work to type it every time I unlock my PC. And more characters means there's more chance to make a typo meaning I have to do the whole thing again.

And the weird way my brain works I have no issue remembering "G6bH,vIz#amV" so I still do it like that :)

Also, if an attacker has a hash of my password the damage is already done anyway. They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext. So there's no real benefit there. What matters is online guessing and that is severely limited in the amount of attempts.

I can't wait for passwordless though. I use only smart cards/yubikeys at home and love them.

Re: I hate password rules

#365

Post by PaulHoule »

oehpr wrote: post #280
PaulHoule wrote: post #232

I had a talk with the head of security at my credit union and told him I was within this much distance of ending my relationship with them over the fact that their password rules were so tough. I pointed out that there were some banks that had let me keep the same (securely generated) password for 15 years. American Express tried to sell me on a deposit account to go with my card but they told me I'd need to make a n…

To verify, you're using a password manager? Because it's hard to imagine someone getting upset over having to just update an entry, and obviously the bank can't tell you not to use a password to unlock your own vault. And I can't imagine someone memorizing a password for a bank login only, and never using that in other locations. The internet requires so many accounts to manage... If you did reuse your password then…

I use securely generated passwords based on a cryptographic hash.

I don't use a "password manager". Someday 10^8 people who use a password manager are going to get their passwords stolen in one night and I'm not going to be one of them.

Re: I hate password rules

#366

Post by droopyEyelids »

Buttons840 wrote: post #325
Traster wrote: post #315

Earlier quoted context omitted.

Pro tip: When you're seeing something really unethical that could eventually rebound on you - write it down. Write down contemporaneously what happened and sign and date it. Much more reliable evidence.

Send it in an email too. "Hi IT guy and Boss, I'm concerned about blah, but understand people need access to everyone else's computer and account. Yada yada." Don't be difficult, but get an email out there with a time stamp on it and forward all that to your personal account if you can.

Any UPS store or FedEx should be able to notarize it, in the unlikely event there isn't a registered notary among your coworkers.

Re: I hate password rules

#367

Post by teeray »

amelius wrote: post #237
teeray wrote: post #137

I’d really love the W3C to come out with some elements that provide: 1) Communication of complexity requirements 2) Explicit password manager fill targets 3) An endpoint for a password manager to rotate passwords automatically. (and the validity period) All of these would be backwards compatible with grandmas that write passwords on post-its and mouldering IT policies that snub NIST recommendations. Sure, webauthn is…

W3C can come up with all the elements they like but websites won't use them because they don't match with company style and the latest trends in graphic design.

None of these would be visible. They’d be glorified meta tags.

Re: I hate password rules

#368

Post by jer0me »

robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

I'm not super knowledgeable about these kinds of things, but aren't hashes usually a fixed length? Why would it matter how long your password is?

Re: I hate password rules

#369

Post by unobatbayar »

Had the exact same problem when I made a password generator. The passwords it created never passed any rules.

Changed the algorithm a few times, to make it at least pass the password rules of common websites such as Facebook, Google, etc.

Re: I hate password rules

#370

Post by kazinator »

eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

If you require as few as 9 characters, without requiring special characters, the security is poor. The reason is that users do not choose random strings of letters, so the entropy per character is low.

If we assume an entropy of 2 bits per characters (which is generous if the user uses dictionary words), then 9 characters gives us 18 bits.

A 9 character password could easily be as poor as a random 18 bit integer.

If we permit the user to use nothing but lower case characters from the set a to z, we should probably require a password phrase length of at least 30 characters.

Not forcing the user to reset their password means you need a really strong one, in case the user is using the same password. You're giving attackers all the time in the world to crack a leaked hash, so it better require something resembling all the time in the world.

These recommendations are basically relying on the MFA recommendation to make up for all the others. Like, oh, it's okay for the user to have 18 bits of entropy for a password, because we can trust that the attacker won't have the user's phone.

Post reply on HN