Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules

portal.cs.oag.state.tx.us

Post reply on HN
Print view View original

61–70 of 157 posts

Re: Password Rules

#61

Post by FiloSottile »

entropy_ wrote: post #43
wetherbeei wrote: post #35

Earlier quoted context omitted.

Probably not a good idea, considering the answers to security questions are often not encrypted or hashed.

Why would that be the case? It just seems stupid to do so. A security answer is pretty much functionally identical to a password. Doesn't make sense not to hash it(there are no uses of the answer where you would need it in non-hashed form)

Yeah it is stupid, probably because security answers are needed to trigger some system on the server side (not to decrypt anything) and if an attacker has access to the DB, probably can already trigger the process. But actually they are even more sensible to reuse than passwords, so they should be hashed.

Re: Password Rules

#62

Post by Firehed »

Achshar wrote: post #55

Banking passwords are always fun. Mine has to be changed every 30 days, cannot be same as last 3, must contain at least one number, special character, capital, lowercase. I essentially end up where i have to store password in plain text (!) in a password protected file. ridiculous but there is no way around it. People really have go understand that such things don't help at all, they increase user frustration if anyt…

First, get 1Password or something similar.

Second, the mixed case alphanumeric definitely aids against brute force attacks, particularly in the case of an online attack (for an offline attack, there are probably hundreds of thousands of attempts per second so the only effective protection is a slow hashing function that limits attack speed)

Re: Password Rules

#63

Post by ecoffey »

unfletch wrote: post #42
ecoffey wrote: post #12

Earlier quoted context omitted.

This may not have helped your specific case, but I recently bought 1Password, and updated all my security questions with randomly generated 16 character string answers, and just put those strings in the "notes" section of a website. So when they do challenge me I can just copy/paste them in. It's been awesome!

I've used 1Password generated passwords for years. You're right, it is awesome, but only until you have to relay one of those generated strings to a support person over the phone: "...left curly brace. No, it's like the parenthesis, but squiggly. Are you using a regular keyboard? Hold shift and type the left square bracket. The square one. It's to the right of the P..." Nightmare.

Heh, yeah luckily I haven't had to do that, but I have chosen some obscene answers to them, and then later had to recite, and spell them out to a horrified Indian call center worker.

Re: Password Rules

#64

Post by runn1ng »

" Characters in the first, second, and third positions cannot be identical. "

Any reason for that? Using pretty similar passwords with minor differences is how I manage to remember passwords for all those fifty different services I have to know password for...

Re: Password Rules

#65

Post by For_Iconoclasm »

unfletch wrote: post #42
ecoffey wrote: post #12

Earlier quoted context omitted.

This may not have helped your specific case, but I recently bought 1Password, and updated all my security questions with randomly generated 16 character string answers, and just put those strings in the "notes" section of a website. So when they do challenge me I can just copy/paste them in. It's been awesome!

I've used 1Password generated passwords for years. You're right, it is awesome, but only until you have to relay one of those generated strings to a support person over the phone: "...left curly brace. No, it's like the parenthesis, but squiggly. Are you using a regular keyboard? Hold shift and type the left square bracket. The square one. It's to the right of the P..." Nightmare.

I use LastPass, but also use generated passwords to answer security questions. For these questions, one can enable the options for only using alphanumeric, unambiguous characters.

Re: Password Rules

#66

Post by JWhiteaker »

Having overly restrictive password rules like this, combined with requiring a new password every x months, just leads to more users writing down the passwords on notes stuck to their monitor.

Re: Password Rules

#67

Post by donpdonp »

FaceKicker wrote: post #18
nextstep wrote: post #16

Earlier quoted context omitted.

Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish…

Security questions are usually just used to decide whether to send you an email with a password reset link (or more annoyingly, a new password), aren't they? I've never seen a system where being able to answer the security question(s) is equivalent to knowing your password. Anyone who knows my mother's maiden name probably also knows my email address and could more easily spam me directly than using a website to send…

Paypal's two-factor authentication, a hardware token in my case, has a screen to enter the security code but a link that says 'i dont have my token with me'. Clicking on that link prompts for the answers to two 'security questions'. Answer them correctly and you're in!

Re: Password Rules

#68

Post by r00fus »

unfletch wrote: post #42
ecoffey wrote: post #12

Earlier quoted context omitted.

This may not have helped your specific case, but I recently bought 1Password, and updated all my security questions with randomly generated 16 character string answers, and just put those strings in the "notes" section of a website. So when they do challenge me I can just copy/paste them in. It's been awesome!

I've used 1Password generated passwords for years. You're right, it is awesome, but only until you have to relay one of those generated strings to a support person over the phone: "...left curly brace. No, it's like the parenthesis, but squiggly. Are you using a regular keyboard? Hold shift and type the left square bracket. The square one. It's to the right of the P..." Nightmare.

It's a good point towards passphrases instead.

1Password gladly generates "pronounceable" passwords (e.g. "thax-lers-ponc-werv"). I usually think a bit about whether digits or symbols are required (some services and websites - Skype notably) don't like them.

A 20-char passphrase with spaces, dashes, or character-based (e.g. "S") word-boundary delimiter is often good enough to provide excellent (80+ bits) entropy.

Re: Password Rules

#69

Post by valuegram »

unimpressive wrote: post #40

Of course this is totally ridiculous, and shoots their entropy with a shotgun. But my heart goes out to whoever was logging into the child support page at the texas attorney general website. That sucks.

I was the one who posted this. It's the same login used to report new hires to the attorney general... Luckily no child support issues here.

Re: Password Rules

#70

Post by georgefox »

kijin wrote: post #60
unfletch wrote: post #42

Earlier quoted context omitted.

I've used 1Password generated passwords for years. You're right, it is awesome, but only until you have to relay one of those generated strings to a support person over the phone: "...left curly brace. No, it's like the parenthesis, but squiggly. Are you using a regular keyboard? Hold shift and type the left square bracket. The square one. It's to the right of the P..." Nightmare.

I can't imagine the horror of having to recite any password to an actual human being. What kind of company asks you to tell them your password by phone? "No, the backslash. The one that leans backwards, no, I mean, to the left. Above the Enter key." Surprise, the backslash is not above the Enter key on Canadian bilingual keyboards.

I assume the support person is asking the security question, but the user entered his mother's maiden name as -K$%3{Tm,fsj$k8L or something similar.
Post reply on HN