Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

391–400 of 447 posts

Re: I hate password rules

#391

Post by BurningPenguin »

bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

Yeah, it's the similar in the company i work for. Except that we have a mixed bag of passwords. There are some old ones that are like "mouse" and then there are others like "Gt4x;JlK". We have that list for "maintenance reasons". Doing things, that could easily be done by some GPOs and other cool tricks.

Re: I hate password rules

#392

Post by yread »

quickthrower2 wrote: post #306
quickthrower2 wrote: post #213

Earlier quoted context omitted.

Have you heard about https://haveibeenpwned.com/Passwords ?

Sorry I reread and you said hibp so you know! Why not use the entire set?

Because it's 12.6GB compressed! That's just too large to deploy. I want a much smaller part. And I would prefer the actual passwords because I think they could be compressed much better than the (essentially random) hashes.

Re: I hate password rules

#393

Post by raxxorrax »

bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

I think OS miss the ability for an admin to log into a user context. I am very hardline defender of privacy and in principle I support privacy advocates already preparing my pyre for even suggesting that of course.

But if we are honest an admin can already access relevant data anyway and you do indeed need to use a user context to access certain settings of some applications. This is especially true for less digitally affine users.

There are workarounds (Windows->Run as...), but that is sometimes insufficient.

About an admin using your user account to start the nukes? That is mostly possible anyway in the usual corporate Windows configuration. He could just change your AD password and log in as you. I would recommend that approach anyway and then force the user to set a new password and informing him why you sabotaged his workstation would also be nice. Far more secure than having the holy grail Excel file.

Re: I hate password rules

#394

Post by raxxorrax »

throwawaygh wrote: post #276
jaywalk wrote: post #258

Earlier quoted context omitted.

This level of negligence should be criminal.

The software industry is full of should-be-criminal forms of negligence. Things are already horrendously bad. Basically every American's identity could stolen at this point. If any nation state or other actor decided to operationalize any of the big leaks -- eg OPM or EquiFax -- the ramifications would be catastrophic. Imagine millions of people losing their retirement accounts and all their savings. Even if you coul…

The slow guy that still kept paper records would win this.

Re: I hate password rules

#395

Post by toto444 »

Arrath wrote: post #93
toto444 wrote: post #48

Earlier quoted context omitted.

> 4. Reset no more than once a year. That would make a lot of people's life terrible. I reset my passwords very frequently (almost every time I log out of a website)

That seems..excessive. What is your motivation for that?

I don't write down most of my passwords so every time I log in I do a password reset. It is mainly out of laziness not for a security purpose.

Re: I hate password rules

#396

Post by Kavelach »

Once I was asked to implement a system that applied password rules with a few heuristics. If the password was under 12 characters, then it required numbers, special characters and so on. Over that, it required only a number in it. If you went over 16 (or 18, I don't remember exactly) characters, there were no rules. The front-end explained how the whole system worked and gave the user tips on how they can make their password more secure, heavily promoting phrases as passwords. My friend who is still involved in the project told me a few months ago that they send out satisfaction forms to users, and some users mentioned that thanks to the service they now know how to prepare passwords that are safer and easier to remember.

Re: I hate password rules

#397

Post by fsflover »

latchkey wrote: post #304
fsflover wrote: post #47

Earlier quoted context omitted.

With secure inter-vm copy-pasting: https://www.qubes-os.org/doc/how-to-copy-and-paste-text/

Impressive level of paranoia. That said, I'd declare it your 'password manager'.

Actually, it's not just paranoia, also convenience. Qubes allows very convenient separation of different parts of your digital life, like personal files/apps from working ones and from random internet surfing. Also, IMHO it's more convenient to copy-paste passwords without an actual password manager. More details: https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15

Re: I hate password rules

#398

Post by franga2000 »

Traster wrote: post #315
bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

Pro tip: When you're seeing something really unethical that could eventually rebound on you - write it down. Write down contemporaneously what happened and sign and date it. Much more reliable evidence.

Bonus points for writing it digitally and using your favourite proper or janky method of timestamping - dates on paper are meaningless, even with a signature (which is also meaningless itself).

Emailing it to someone seems to be the go-to recommendation online, but you might not want to expose the information at the time. Some alternatives, in descending order of jank: a Google Doc, unlisted Pastebin, either of those but only post the hash and keep the file offline, a proper TSP timestamp - the latter is actually near-trivial these days with something like freeTSA.org.

Re: I hate password rules

#399

Post by neop1x »

jjice wrote: post #163

I hate seeing websites that have odd restrictions like "you can use !, ?, #, and @, but not % or ^". I can't think of a reasonable reason.

Maybe they are storing it plain-text and it causes them issues like variable substitution in some database backup or management scripts.

Re: I hate password rules

#400

Post by jsmith99 »

singlow wrote: post #103
dataflow wrote: post #77

Earlier quoted context omitted.

For websites, you're just making your own life harder for no real gain. Even with purely alphanumeric 10 chars, it's not like anyone can exhaust the 36^10 password space over a network with no one noticing. Yet whenever you run into issues with the website or the password manager (or some other non-routine thing... like you're on your phone and need to enter this on a different computer) and have to enter it manually…

I guess you assume that everyone protects their stored hashes.

So long as passwords are unique, offline cracking isn't an issue. If they have that site's hashes presumably the site is compromised already.
Post reply on HN