Password Rules • Hacker News Board

Re: Password Rules

#51

Post by darkarmani » Sun, Jun 03, 2012, 7:49 PM UTC

x1 wrote: post #10

Yeah. As someone who prefers passwords in the 12-24 character length I get really annoyed when a site comes back and tells me my password isn't good enough because it doesn't follow various rules. Oh you really think someone is going to brute force $MILKAndDailyCheeseRe because it doesn't have a number in it?

Even worse is when they limit to 12 characters, but don't enforce it in the UI. I couldn't login once because the bank website truncated my password silently to 12 characters. On a whim, i tried the first 12 characters and i was able to login.

Re: Password Rules

#52

Post by darkarmani » Sun, Jun 03, 2012, 7:51 PM UTC

NelsonMinar wrote: post #31

Everyone's making fun of this, and it is dumb. But really this is just an example about how passwords are a stupid form of authentication. Not just this site, all passworded sites. We really need something better. I favor OpenID or something like it. Single strong form of authentication, delegate login authority from that to non-critical sites like Hacker News. OpenID has enough of a bad reputation now it's probably…

That's a bad argument. Passwords are a decent trade-off for certain problems.

The problem is when the usability/security trade-off doesn't match the situation.

Re: Password Rules

#53

Post by RandallBrown » Sun, Jun 03, 2012, 7:54 PM UTC

droithomme wrote: post #23

njloof wrote: post #9

After coming up with a password that obeys all those rules, I recommend writing it down on a yellow sticky note and putting it on your monitor.

Which I have seen at secure facilities, as we all have, I think.

If it's a secure facility, it's probably pretty safe.

Re: Password Rules

#54

Post by unimpressive » Sun, Jun 03, 2012, 7:55 PM UTC

steve-howard wrote: post #44

NelsonMinar wrote: post #31

Everyone's making fun of this, and it is dumb. But really this is just an example about how passwords are a stupid form of authentication. Not just this site, all passworded sites. We really need something better. I favor OpenID or something like it. Single strong form of authentication, delegate login authority from that to non-critical sites like Hacker News. OpenID has enough of a bad reputation now it's probably…

I don't know that passwords are all bad. For an alternative approach to complex rules, see: http://xkcd.com/936/ The last time I changed a password for a service I set it to a phrase that I can easily remember but which no human or current machine will easily guess. I'd say that the only good rule is "Make it at least 9 characters" (which is at least long enough to disallow "password").

Character minimums hurt your entropy too. Stripping the entire search space up to nine characters isn't really a good idea.

In my opinion it'd be better to just find a list of the top 10K passwords and disallow them.

One out of 50 people use one of the top 20 passwords. [0]

I'd bet that over half of passwords used are in the top ten thousand.

[0]: http://xato.net/passwords/how-i-collect-passwords

Re: Password Rules

#55

Post by Achshar » Sun, Jun 03, 2012, 7:59 PM UTC

Banking passwords are always fun. Mine has to be changed every 30 days, cannot be same as last 3, must contain at least one number, special character, capital, lowercase. I essentially end up where i have to store password in plain text (!) in a password protected file. ridiculous but there is no way around it. People really have go understand that such things don't help at all, they increase user frustration if anything.

I have never understood the number/uppercase requirement, if someone somehow put a key logger it won't matter or if some one is using brute force, it wont matter either.

Re: Password Rules

#56

Post by Dove » Sun, Jun 03, 2012, 8:01 PM UTC

LinaLauneBaer wrote: post #20

x1 wrote: post #19

Earlier quoted context omitted.

I wouldn't, I would apply something like this http://www.passwordmeter.com/ and show the user how secure or insecure their password is. Depending on the service they are using maybe only allow passwords at Strong or better but base that off the complexity of the passwords. %09(0m is stronger than minneapolisminnesota

Doesn't the strength of a password also depend on the cardinality of the underlying alphabet? So your example makes only sense when you also say something about the used alphabet or am I missing something here?

Sort of. The strength of a password, at the most basic level, is based on the number of passwords it could have been. That is to say, the number of live possibilities in your password-generating algorithm.

In theory, large alphabets and long passwords lead to increased password strength because they mean your password could have been many other things. In practice, the vast majority of those other things were never live possibilities, so the password is not that strong even if it is long or the symbol set is large.

For example, suppose you choose to base your password on your dog's name, Rover. This is one of maybe half a dozen likely choices for you, so is not a strong password. If you modify it for length and symbol set into Fetch4meRover!, this is still one of maybe a dozen things you would have chosen to do with the name, so is still not that strong in spite of the length and character set.

In general, you should not trust yourself to generate random information, and particularly passwords. Use a script to randomly generate a password -- a script with a known large number of live possibilities. This is the only way to ensure those possibilities -- the ones that make a password secure -- were ever actually live.

Re: Password Rules

#57

Post by taylorbuley » Sun, Jun 03, 2012, 8:03 PM UTC

Achshar wrote: post #55

Banking passwords are always fun. Mine has to be changed every 30 days, cannot be same as last 3, must contain at least one number, special character, capital, lowercase. I essentially end up where i have to store password in plain text (!) in a password protected file. ridiculous but there is no way around it. People really have go understand that such things don't help at all, they increase user frustration if anyt…

Except whereas those rules sound like they would enhance your personal security, following these rules work against it ("must be exactly 8 characters"?!)

Re: Password Rules

#58

Post by kijin » Sun, Jun 03, 2012, 8:06 PM UTC

NelsonMinar wrote: post #31

Everyone's making fun of this, and it is dumb. But really this is just an example about how passwords are a stupid form of authentication. Not just this site, all passworded sites. We really need something better. I favor OpenID or something like it. Single strong form of authentication, delegate login authority from that to non-critical sites like Hacker News. OpenID has enough of a bad reputation now it's probably…

> Single strong form of authentication, delegate login authority from that to non-critical sites

How does that solve the problem of internet banking passwords? Banks are not "non-critical sites", so whatever form of authentication I use for my Reddit account is unlikely to be suitable for my bank. As a matter of fact, I don't trust LastPass with my banking passwords.

Re: Password Rules

#59

Post by Firehed » Sun, Jun 03, 2012, 8:09 PM UTC

entropy_ wrote: post #43

wetherbeei wrote: post #35

Earlier quoted context omitted.

Probably not a good idea, considering the answers to security questions are often not encrypted or hashed.

Why would that be the case? It just seems stupid to do so. A security answer is pretty much functionally identical to a password. Doesn't make sense not to hash it(there are no uses of the answer where you would need it in non-hashed form)

They're often used by support agents as a workaround for giving them your password (which the entire world has been diligently trained not to do, right?). They're also often case-insensitive and ignore punctuation, and while it's quite easy to handle that in a hashed scenario, they're usually implemented by programmers that don't get security.

Of course, the same apps with security questions are probably the ones not hashing your actual password in the first place.

Re: Password Rules

#60

Post by kijin » Sun, Jun 03, 2012, 8:09 PM UTC

unfletch wrote: post #42

ecoffey wrote: post #12

Earlier quoted context omitted.

This may not have helped your specific case, but I recently bought 1Password, and updated all my security questions with randomly generated 16 character string answers, and just put those strings in the "notes" section of a website. So when they do challenge me I can just copy/paste them in. It's been awesome!

I've used 1Password generated passwords for years. You're right, it is awesome, but only until you have to relay one of those generated strings to a support person over the phone: "...left curly brace. No, it's like the parenthesis, but squiggly. Are you using a regular keyboard? Hold shift and type the left square bracket. The square one. It's to the right of the P..." Nightmare.

I can't imagine the horror of having to recite any password to an actual human being. What kind of company asks you to tell them your password by phone?

"No, the backslash. The one that leans backwards, no, I mean, to the left. Above the Enter key." Surprise, the backslash is not above the Enter key on Canadian bilingual keyboards.