Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules

portal.cs.oag.state.tx.us

Post reply on HN
Print view View original

11–20 of 157 posts

Re: Password Rules

#11

Post by kijin »

jiggy2011 wrote: post #3

Is there any reasoning at all behind the thinking that requires passwords such as this? These sorts of rules are so commonplace that there must be some reasoning for it?

To begin with, preventing SQL injection when passwords are stored in plain text without any escaping. (CHAR(8) field. No special characters allowed.)

Re: Password Rules

#12

Post by ecoffey »

haberman wrote: post #4

Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer I gave to a security question. I bought a house last month, and the biggest thorn in my side throughout all of the financial arrangements was security questions (I'm not even joking). Here's a Facebook status update I posted (I had already been complaining abou…

This may not have helped your specific case, but I recently bought 1Password, and updated all my security questions with randomly generated 16 character string answers, and just put those strings in the "notes" section of a website. So when they do challenge me I can just copy/paste them in. It's been awesome!

Re: Password Rules

#13

Post by xbryanx »

I've worked with rules like this, and it's even worse when it's some domain password used across multiple crappy systems. Often a 3rd party system that has integrated with this password doesn't accept the $, or has to be 7 characters or something. So the IT folks tell you to follow the rules, but if you use the accounting system, make sure not to put $ in there. #facepalm

Re: Password Rules

#14

Post by jiggy2011 »

kijin wrote: post #11
jiggy2011 wrote: post #3

Is there any reasoning at all behind the thinking that requires passwords such as this? These sorts of rules are so commonplace that there must be some reasoning for it?

To begin with, preventing SQL injection when passwords are stored in plain text without any escaping. (CHAR(8) field. No special characters allowed.)

That's an utterly horrible reason but I take the point.

I imagine many sites implementing these policies (some banks etc) are hashing their passwords properly and sanitizing SQL though!

Re: Password Rules

#15

Post by xbryanx »

jiggy2011 wrote: post #3

Is there any reasoning at all behind the thinking that requires passwords such as this? These sorts of rules are so commonplace that there must be some reasoning for it?

I am sure operability and not security are the primary factors behind these rules.

Re: Password Rules

#16

Post by nextstep »

haberman wrote: post #4

Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer I gave to a security question. I bought a house last month, and the biggest thorn in my side throughout all of the financial arrangements was security questions (I'm not even joking). Here's a Facebook status update I posted (I had already been complaining abou…

Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish to answer the questions honestly.

Re: Password Rules

#18

Post by FaceKicker »

nextstep wrote: post #16
haberman wrote: post #4

Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer I gave to a security question. I bought a house last month, and the biggest thorn in my side throughout all of the financial arrangements was security questions (I'm not even joking). Here's a Facebook status update I posted (I had already been complaining abou…

Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish…

Security questions are usually just used to decide whether to send you an email with a password reset link (or more annoyingly, a new password), aren't they? I've never seen a system where being able to answer the security question(s) is equivalent to knowing your password. Anyone who knows my mother's maiden name probably also knows my email address and could more easily spam me directly than using a website to send me password reset links.

Re: Password Rules

#19

Post by x1 »

sunwooz wrote: post #7

If you had to create a list(or non-list) of requirements a password must pass what would it be? (Ex. Case sensitivity, length, cannot be the same as username etc etc) The bare minimum with the least frustration for the user? I was very surprised by the news-piece that blizzard was using case-insensitive passwords and that got me thinking...

I wouldn't, I would apply something like this http://www.passwordmeter.com/ and show the user how secure or insecure their password is. Depending on the service they are using maybe only allow passwords at Strong or better but base that off the complexity of the passwords. %09(0m is stronger than minneapolisminnesota

Re: Password Rules

#20

Post by LinaLauneBaer »

x1 wrote: post #19
sunwooz wrote: post #7

If you had to create a list(or non-list) of requirements a password must pass what would it be? (Ex. Case sensitivity, length, cannot be the same as username etc etc) The bare minimum with the least frustration for the user? I was very surprised by the news-piece that blizzard was using case-insensitive passwords and that got me thinking...

I wouldn't, I would apply something like this http://www.passwordmeter.com/ and show the user how secure or insecure their password is. Depending on the service they are using maybe only allow passwords at Strong or better but base that off the complexity of the passwords. %09(0m is stronger than minneapolisminnesota

Doesn't the strength of a password also depend on the cardinality of the underlying alphabet? So your example makes only sense when you also say something about the used alphabet or am I missing something here?
Post reply on HN