Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Requirements: Myths and Madness

franzoni.eu

Post reply on HN
Print view View original

101–110 of 257 posts

Re: Password Requirements: Myths and Madness

#101

Post by Aeolun »

lolinder wrote: post #49
alwayslikethis wrote: post #29

Earlier quoted context omitted.

> > If I use four unicode code points outside the [multi-language characters table], my password is probably very safe already. > Security through obscurity. This is safe until everyone does it. It's not a strong password by virtue of being short, it's strong because this is impossible to input and so nobody uses it and so it doesn't make sense to guess. But you bet that if you ever log into a compromised system, use…

Correct, but the recommendation in the article is still wrong. If I get a password that has four Unicode characters in it, it's possible that it's a strong password that chose truly randomly from the available Unicode characters, but it's much more likely that someone just picked four that they like. In the latter case, the bits per character is going to be much lower, but I can't tell the difference just looking at…

You don’t have to assume this. You can check the length in bytes of the password.

Re: Password Requirements: Myths and Madness

#102

Post by toomuchtodo »

bruce511 wrote: post #94

The article is correct, most password policies are dumb. But it's arguing about one tree while standing in a forest. The real problem with passwords is not individual policies, but rather their shere volume. In my password manager I noticed I have got literally hundreds of the things. Clearly reusing a password on multiple systems is bad. Clearly memorizing more than a handful is impossible. Since I therefore am usin…

> But if a Web-site wanted to be really secure, require a password manager. (how? I've no idea...)

https://passkeys.dev/

Re: Password Requirements: Myths and Madness

#103

Post by teeray »

I have accepted that these sites aren’t going to change their ways. What I’d like though is direct integration with my password manager. Communicate whatever Byzantine password requirements you have via some standard hidden fields or meta tags so my password manager will generate only compliant passwords.

Re: Password Requirements: Myths and Madness

#104

Post by thayne »

Spooky23 wrote: post #65
_dan wrote: post #32

In the b2b world it's basically impossible to improve password policies. Most of the onerous examples only exist because some other entity (a customer, insurance company, parent company, etc) has demanded them. The problem is that the demand isn't being made by security professionals, it's being made by risk management people who are only interested in a simple way to mitigate risk - it's simply much easier for them…

It’s much easier than ever before. You centralize identity to an IDP and require SAML or OAuth for applications. Then you manage it once. Typically you can get rid of most of the password bullshit by adding MFA, with some exceptions. Unless you’re a DoD contractor or handling taxpayer data the came from the IRS on behalf of a client, MFA should meet or exceed compliance requirements.

Some customers require that your employees have to comply with their password requirements. Using an IdP means there is just one password to worry about, but you still might have to periodically change your password because some big customer has it in their contract.

And then there are customers who have requirements about passwords, even though they are only going to be using an IDP anyway. It is probably because they have the same standard list of requirements that they give to everyone, and probably was copied from somewhere else, and you can usually contest it. But it is still a waste of time for everyone.

Re: Password Requirements: Myths and Madness

#105

Post by LeoPanthera »

cirrus3 wrote: post #38
LeoPanthera wrote: post #22

Earlier quoted context omitted.

This particular tool is misleading at best. It counts only characters, and so misleadingly overrates passwords which are strings of words. Compare it with this one, which actually identifies words and other patterns, for a more accurate guess of the search space: https://www.bennish.net/password-strength-checker/

I only said check it out, there is a lot of content there useful to the wider topic and the page clearly states what it is and isn't. >>> IMPORTANT!!! What this calculator is NOT . . . It is NOT a “Password Strength Meter.” Since it could be easily confused for one, it is very important for you to understand what it is, and what it isn't: The #1 most commonly used password is “123456”, and the 4th most common is “Pas…

My point is that a "search space calculator" isn't useful. The only thing it will ever achieve is misleading people. Especially as that definition is also wrong, because the search space of a dictionary is achieved by counting words, not letters.

Re: Password Requirements: Myths and Madness

#106

Post by nigerianbrince »

bruce511 wrote: post #94

The article is correct, most password policies are dumb. But it's arguing about one tree while standing in a forest. The real problem with passwords is not individual policies, but rather their shere volume. In my password manager I noticed I have got literally hundreds of the things. Clearly reusing a password on multiple systems is bad. Clearly memorizing more than a handful is impossible. Since I therefore am usin…

Our computers should have a specific port for a physical key which we would carry around in our keychain.

Re: Password Requirements: Myths and Madness

#107

Post by Aeolun »

water-your-self wrote: post #74

Rotating passwords is an old idea but mathematically it does reduce the probability of bring compromised. Otherwise I can know for certain when something is not your password each time I get it wrong.

That’s only true if people keep making similarly strong passwords every time.

The first password may be secure, but I can practically guarantee that the security will have degraded significantly by the 4th time you change your password that year.

Re: Password Requirements: Myths and Madness

#108

Post by AussieWog93 »

II2II wrote: post #91
Bilal_io wrote: post #71

Earlier quoted context omitted.

Expiring passwords are the bane of my existence. My current job does that. It was originally a requirement by Microsoft and they've been recommending against it, but it catches up slowly.

Expiring passwords are the bane of my existence when the period is short. I can live with changing a password once a year, but every three months is only encouraging me to pick weak passwords. Why can I accept it? I constantly see colleagues sharing passwords and constantly have to say "please don't" when they try to share their password with me. While forcing people to change their passwords doesn't eliminate the un…

My old man's work used to make them change their passwords once a month.

For the next 10 years, his password was a particular insulting phrase directed at the IT guys, followed by a number that would increment each time he had to change it. Got into the hundreds before he left the company.

Re: Password Requirements: Myths and Madness

#110

Post by csydas »

koolba wrote: post #78
csydas wrote: post #52

Earlier quoted context omitted.

> The problem is that the demand isn't being made by security professionals, it's being made by risk management people I'm actually not sure how true this is. There is a huge "security checklist" industry backed by persons with some fancy Security title that provide security analysis checklists for companies to follow, often citing very interesting interpretations of best practices from actual security orgs. These ch…

> Past password similarity checking (I'm actually not even sure how they do this unless they somehow have access to the plaintext version of user passwords; if there's a benign/secure way of doing this I'd be very curious) Most systems that allow you to change your password require the current password as a verification. This means the software performing the validation of the new password also has access to your old…

ah, that's reasonable and logical I guess to just do common "simple" transformations and check the hash. Thanks!
Post reply on HN