Password Rules • Hacker News Board

Re: Password Rules

#21

Post by ot » Sun, Jun 03, 2012, 6:01 PM UTC

homosaur wrote: post #5

WOW. I was expecting something dumb but this is next level dumb. You're basically forcing a 7 character password since I already know one of them is one of those three special characters. Then you've just given me like 5 more rules that limit what the password can be. Any password cracking service would crack this in hours. IT people should understand the basics about security before they are allowed to set policy.

> You're basically forcing a 7 character password since I already know one of them is one of those three special characters.

Not exactly, because you don't know where the special character is. If the allowed characters are k, the number of 8-character passwords would be k^8. With this rule, even assuming that only one special character is used the number becomes 7^k * (3 * 8) = 7^k * 24, so if k ~= 60 the entropy is reduced by roughly 1 bit.

Still, it is an incredibly stupid rule.

Re: Password Rules

#22

Post by pbreit » Sun, Jun 03, 2012, 6:03 PM UTC

FaceKicker wrote: post #18

nextstep wrote: post #16

Earlier quoted context omitted.

Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish…

Security questions are usually just used to decide whether to send you an email with a password reset link (or more annoyingly, a new password), aren't they? I've never seen a system where being able to answer the security question(s) is equivalent to knowing your password. Anyone who knows my mother's maiden name probably also knows my email address and could more easily spam me directly than using a website to send…

You are mostly correct and thus it is generally safe to use accurate answers. But, sadly, I have seen some systems skip the email step.

Re: Password Rules

#23

Post by droithomme » Sun, Jun 03, 2012, 6:04 PM UTC

njloof wrote: post #9

After coming up with a password that obeys all those rules, I recommend writing it down on a yellow sticky note and putting it on your monitor.

Which I have seen at secure facilities, as we all have, I think.

Re: Password Rules

#24

Post by pbreit » Sun, Jun 03, 2012, 6:07 PM UTC

Stupid password rules is probably the leading source of consternation for this internets user.

Has anyone ever analysed if password rules help at all? Aren't most compromises social-based or otherwise accidental? No one breaks in by slamming millions of login attempts at a server, do they?

Re: Password Rules

#25

Post by nnnnnnnn » Sun, Jun 03, 2012, 6:09 PM UTC

FaceKicker wrote: post #18

nextstep wrote: post #16

Earlier quoted context omitted.

Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish…

Security questions are usually just used to decide whether to send you an email with a password reset link (or more annoyingly, a new password), aren't they? I've never seen a system where being able to answer the security question(s) is equivalent to knowing your password. Anyone who knows my mother's maiden name probably also knows my email address and could more easily spam me directly than using a website to send…

Yes, but if you compromise email then they become easily guessable password equivalents.

Re: Password Rules

#26

Post by notatoad » Sun, Jun 03, 2012, 6:09 PM UTC

sunwooz wrote: post #7

If you had to create a list(or non-list) of requirements a password must pass what would it be? (Ex. Case sensitivity, length, cannot be the same as username etc etc) The bare minimum with the least frustration for the user? I was very surprised by the news-piece that blizzard was using case-insensitive passwords and that got me thinking...

Minimum eight characters long. Beyond that, use whatever you want.

Re: Password Rules

#27

Post by jaybill » Sun, Jun 03, 2012, 6:13 PM UTC

ot wrote: post #21

homosaur wrote: post #5

WOW. I was expecting something dumb but this is next level dumb. You're basically forcing a 7 character password since I already know one of them is one of those three special characters. Then you've just given me like 5 more rules that limit what the password can be. Any password cracking service would crack this in hours. IT people should understand the basics about security before they are allowed to set policy.

> You're basically forcing a 7 character password since I already know one of them is one of those three special characters. Not exactly, because you don't know where the special character is. If the allowed characters are k, the number of 8-character passwords would be k^8. With this rule, even assuming that only one special character is used the number becomes 7^k * (3 * 8) = 7^k * 24, so if k ~= 60 the entropy is…

I'm pretty sure the password guesser I wrote to give me passwords on terminals in Fallout 3 would easily give me these passwords.

Re: Password Rules

#28

Post by PezCuckow » Sun, Jun 03, 2012, 6:14 PM UTC

This demonstrates what is wrong with what the world expects a password policy to be, very few of these even increase password cracking complexity. They are just dumb rules to annoy your users. Sigh!

Re: Password Rules

#29

Post by experiment0 » Sun, Jun 03, 2012, 6:18 PM UTC

FaceKicker wrote: post #18

nextstep wrote: post #16

Earlier quoted context omitted.

Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish…

Security questions are usually just used to decide whether to send you an email with a password reset link (or more annoyingly, a new password), aren't they? I've never seen a system where being able to answer the security question(s) is equivalent to knowing your password. Anyone who knows my mother's maiden name probably also knows my email address and could more easily spam me directly than using a website to send…

AppleID's can be reset by knowing your email address, date of birth and normally 2 security questions.

Re: Password Rules

#30

Post by jonamato » Sun, Jun 03, 2012, 6:21 PM UTC

The sub-password "similarity" rules (#8) mean that it is incredibly unlikely that the system is storing the password history hashed, and basically impossible that they're storing it salted. What could possibly go wrong?