Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules

portal.cs.oag.state.tx.us

Post reply on HN
Print view View original

71–80 of 157 posts

Re: Password Rules

#71

Post by r00fus »

duaneb wrote: post #49
NelsonMinar wrote: post #31

Everyone's making fun of this, and it is dumb. But really this is just an example about how passwords are a stupid form of authentication. Not just this site, all passworded sites. We really need something better. I favor OpenID or something like it. Single strong form of authentication, delegate login authority from that to non-critical sites like Hacker News. OpenID has enough of a bad reputation now it's probably…

So if you share a computer with someone, how do you stop that person from logging into your account to read your email?

Strong passwords. Password manager. Separate Accounts. Keypass or 1Password (which I prefer on OSX) are quite good.

I use gmail + 2-step auth. You can configure it to be quite paranoid.

Re: Password Rules

#72

Post by lucb1e »

lordlicorice wrote: post #34
nextstep wrote: post #16

Earlier quoted context omitted.

Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish…

I typically take the classic step of choosing "What is my password?" as a custom security question.

I use it as password hint if I can (e.g. make it show the first character of my password, I'll remember it then). As answer I enter like 50 random characters which I don't write down or remember or anything, since I should simply know the password or use my recovery e-mail.

The problem is that most sites won't let you set your own question. More about my idea on security questions: http://lucb1e.com/!65

Re: Password Rules

#73

Post by lucb1e »

angry-hacker wrote: post #45
nextstep wrote: post #16

Earlier quoted context omitted.

Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish…

Ashamed to admit but I used to "hack" my classmates (girls) hotmail accounts like that when I was young. I tried to recover their password and if I didn't know the answer to their security question (I often did) I just asked... I was curious if they write something about me in their emails, never did...

Simply brilliant. You should submit this together with a security issue report to Facebook and Hotmail and whoever else uses security questions.

Do you mind if I quote you (with link) on my blog?

Re: Password Rules

#74

Post by r00fus »

njloof wrote: post #9

After coming up with a password that obeys all those rules, I recommend writing it down on a yellow sticky note and putting it on your monitor.

Or the digital (secure) equivalent: a password manager.

Seriously, any decently sized organization should strongly recommend or mandate usage of such - they are also great when a transition needs to be made - known external credentials can be exported or passed during knowledge transfer and passwords reset.

Re: Password Rules

#75

Post by hahainternet »

jaybill wrote: post #27
ot wrote: post #21

Earlier quoted context omitted.

> You're basically forcing a 7 character password since I already know one of them is one of those three special characters. Not exactly, because you don't know where the special character is. If the allowed characters are k, the number of 8-character passwords would be k^8. With this rule, even assuming that only one special character is used the number becomes 7^k * (3 * 8) = 7^k * 24, so if k ~= 60 the entropy is…

I'm pretty sure the password guesser I wrote to give me passwords on terminals in Fallout 3 would easily give me these passwords.

I don't know whether this is cool or sad. Fallout 3 passwords were trivially easy to infer from a single guess. They took extra time to reduce the ambiguity and make it easy once you understood the principle.

Were you running a mod?

Re: Password Rules

#76

Post by angry-hacker »

lucb1e wrote: post #73
angry-hacker wrote: post #45

Earlier quoted context omitted.

Ashamed to admit but I used to "hack" my classmates (girls) hotmail accounts like that when I was young. I tried to recover their password and if I didn't know the answer to their security question (I often did) I just asked... I was curious if they write something about me in their emails, never did...

Simply brilliant. You should submit this together with a security issue report to Facebook and Hotmail and whoever else uses security questions. Do you mind if I quote you (with link) on my blog?

Go ahead... hotmail by the way still let's you take over someones account by only knowing email address and answer to security question which is often maiden middle name, name of first pet, best childhood friend etc... you can find that information freely from facebook for an example. Or just ask :)

Re: Password Rules

#77

Post by sukuriant »

pbreit wrote: post #24

Stupid password rules is probably the leading source of consternation for this internets user. Has anyone ever analysed if password rules help at all? Aren't most compromises social-based or otherwise accidental? No one breaks in by slamming millions of login attempts at a server, do they?

My Diablo 3 account was hacked because my password was 'abcd1234'. This is no longer the case.

So yes, sometimes. And no, I'm not certain why on earth I set that as my password...

Re: Password Rules

#79

Post by dekz »

its_so_on wrote: post #36

I swear one day we will see. "Unfortunately time and again we have come to observe the inability of employees to follow simple rules during password creation. For example, despite our warnings, employees often create a password containing more than one consecutive non-numeral; other employees attempt to createa a password consisting only of numbers, only of letters, or an insecure mix of numbers and letters - e.g. 5:…

> The password must be exactly 8 characters long.

This is probably the root cause of bad passwords. In the case of Average Joe, he is now having to choose something memorable which is 8 characters long. 'PassworD'

Re: Password Rules

#80

Post by georgefox »

jiggy2011 wrote: post #3

Is there any reasoning at all behind the thinking that requires passwords such as this? These sorts of rules are so commonplace that there must be some reasoning for it?

There is reasoning; it's just not valid reasoning.
Post reply on HN