Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules

portal.cs.oag.state.tx.us

Post reply on HN
Print view View original

41–50 of 157 posts

Re: Password Rules

#41

Post by skymt »

FaceKicker wrote: post #18
nextstep wrote: post #16

Earlier quoted context omitted.

Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish…

Security questions are usually just used to decide whether to send you an email with a password reset link (or more annoyingly, a new password), aren't they? I've never seen a system where being able to answer the security question(s) is equivalent to knowing your password. Anyone who knows my mother's maiden name probably also knows my email address and could more easily spam me directly than using a website to send…

In 2008 Sarah Palin's Yahoo! Mail account was broken into simply by looking up the answers to the security questions.

Re: Password Rules

#42

Post by unfletch »

ecoffey wrote: post #12
haberman wrote: post #4

Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer I gave to a security question. I bought a house last month, and the biggest thorn in my side throughout all of the financial arrangements was security questions (I'm not even joking). Here's a Facebook status update I posted (I had already been complaining abou…

This may not have helped your specific case, but I recently bought 1Password, and updated all my security questions with randomly generated 16 character string answers, and just put those strings in the "notes" section of a website. So when they do challenge me I can just copy/paste them in. It's been awesome!

I've used 1Password generated passwords for years. You're right, it is awesome, but only until you have to relay one of those generated strings to a support person over the phone:

"...left curly brace. No, it's like the parenthesis, but squiggly. Are you using a regular keyboard? Hold shift and type the left square bracket. The square one. It's to the right of the P..."

Nightmare.

Re: Password Rules

#43

Post by entropy_ »

wetherbeei wrote: post #35
lordlicorice wrote: post #34

Earlier quoted context omitted.

I typically take the classic step of choosing "What is my password?" as a custom security question.

Probably not a good idea, considering the answers to security questions are often not encrypted or hashed.

Why would that be the case? It just seems stupid to do so. A security answer is pretty much functionally identical to a password. Doesn't make sense not to hash it(there are no uses of the answer where you would need it in non-hashed form)

Re: Password Rules

#44

Post by steve-howard »

NelsonMinar wrote: post #31

Everyone's making fun of this, and it is dumb. But really this is just an example about how passwords are a stupid form of authentication. Not just this site, all passworded sites. We really need something better. I favor OpenID or something like it. Single strong form of authentication, delegate login authority from that to non-critical sites like Hacker News. OpenID has enough of a bad reputation now it's probably…

I don't know that passwords are all bad. For an alternative approach to complex rules, see:

http://xkcd.com/936/

The last time I changed a password for a service I set it to a phrase that I can easily remember but which no human or current machine will easily guess. I'd say that the only good rule is "Make it at least 9 characters" (which is at least long enough to disallow "password").

Re: Password Rules

#45

Post by angry-hacker »

nextstep wrote: post #16
haberman wrote: post #4

Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer I gave to a security question. I bought a house last month, and the biggest thorn in my side throughout all of the financial arrangements was security questions (I'm not even joking). Here's a Facebook status update I posted (I had already been complaining abou…

Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish…

Ashamed to admit but I used to "hack" my classmates (girls) hotmail accounts like that when I was young. I tried to recover their password and if I didn't know the answer to their security question (I often did) I just asked... I was curious if they write something about me in their emails, never did...

Re: Password Rules

#47

Post by amalcon »

steve-howard wrote: post #44
NelsonMinar wrote: post #31

Everyone's making fun of this, and it is dumb. But really this is just an example about how passwords are a stupid form of authentication. Not just this site, all passworded sites. We really need something better. I favor OpenID or something like it. Single strong form of authentication, delegate login authority from that to non-critical sites like Hacker News. OpenID has enough of a bad reputation now it's probably…

I don't know that passwords are all bad. For an alternative approach to complex rules, see: http://xkcd.com/936/ The last time I changed a password for a service I set it to a phrase that I can easily remember but which no human or current machine will easily guess. I'd say that the only good rule is "Make it at least 9 characters" (which is at least long enough to disallow "password").

11 is also a sane minimum, to disallow 1234567890.

Re: Password Rules

#48

Post by darkarmani »

sunwooz wrote: post #7

If you had to create a list(or non-list) of requirements a password must pass what would it be? (Ex. Case sensitivity, length, cannot be the same as username etc etc) The bare minimum with the least frustration for the user? I was very surprised by the news-piece that blizzard was using case-insensitive passwords and that got me thinking...

Only enforce a minimum password length.

Re: Password Rules

#49

Post by duaneb »

NelsonMinar wrote: post #31

Everyone's making fun of this, and it is dumb. But really this is just an example about how passwords are a stupid form of authentication. Not just this site, all passworded sites. We really need something better. I favor OpenID or something like it. Single strong form of authentication, delegate login authority from that to non-critical sites like Hacker News. OpenID has enough of a bad reputation now it's probably…

So if you share a computer with someone, how do you stop that person from logging into your account to read your email?

Re: Password Rules

#50

Post by seats »

sunwooz wrote: post #7

If you had to create a list(or non-list) of requirements a password must pass what would it be? (Ex. Case sensitivity, length, cannot be the same as username etc etc) The bare minimum with the least frustration for the user? I was very surprised by the news-piece that blizzard was using case-insensitive passwords and that got me thinking...

What if we started saying 'passphrase' instead of 'password' and made the minimum be 4 words and 18+ characters.

It wouldn't be overwhelming to new users if they had examples of what a memorable passphrase is. You'd likely need to disallow specifically using the example passphrase but other than that, I'd be curious to see how well non-technical users respond to an interface asking them for a phrase.

Post reply on HN