Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules

portal.cs.oag.state.tx.us

Post reply on HN
Print view View original

81–90 of 157 posts

Re: Password Rules

#81

Post by jgeralnik »

FaceKicker wrote: post #18
nextstep wrote: post #16

Earlier quoted context omitted.

Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish…

Security questions are usually just used to decide whether to send you an email with a password reset link (or more annoyingly, a new password), aren't they? I've never seen a system where being able to answer the security question(s) is equivalent to knowing your password. Anyone who knows my mother's maiden name probably also knows my email address and could more easily spam me directly than using a website to send…

Gmail, at least as of two years ago, let you choose a new password after correctly answering the security question. I once tried to answer the security questions to all of my close friends' accounts. I then sent the ones the I succeeded on (and was presented with a choose your new password screen which I then closed) and email suggesting that they change their security questions to something more secure.

Re: Password Rules

#82

Post by tomjen3 »

sunwooz wrote: post #7

If you had to create a list(or non-list) of requirements a password must pass what would it be? (Ex. Case sensitivity, length, cannot be the same as username etc etc) The bare minimum with the least frustration for the user? I was very surprised by the news-piece that blizzard was using case-insensitive passwords and that got me thinking...

Create the password and email it to the user.

That is a trade-of because they will write it down and put it next to their monitor.

But then the bad guy has to physically get it and the password isn't going to be used anywhere else so you nuke the two biggest issues with passwords.

Re: Password Rules

#83

Post by redacted »

steve-howard wrote: post #44
NelsonMinar wrote: post #31

Everyone's making fun of this, and it is dumb. But really this is just an example about how passwords are a stupid form of authentication. Not just this site, all passworded sites. We really need something better. I favor OpenID or something like it. Single strong form of authentication, delegate login authority from that to non-critical sites like Hacker News. OpenID has enough of a bad reputation now it's probably…

I don't know that passwords are all bad. For an alternative approach to complex rules, see: http://xkcd.com/936/ The last time I changed a password for a service I set it to a phrase that I can easily remember but which no human or current machine will easily guess. I'd say that the only good rule is "Make it at least 9 characters" (which is at least long enough to disallow "password").

I wrote a small script to generate passwords after reading that comic [1]. Using a good wordlist one can easily produce memorable and secure passwords.

Unfortunately, many sites enforce rules that preclude this password style (e.g., must contain a number).

[1] https://github.com/redacted/XKCD-password-generator/

Re: Password Rules

#84

Post by elithrar »

lucb1e wrote: post #73
angry-hacker wrote: post #45

Earlier quoted context omitted.

Ashamed to admit but I used to "hack" my classmates (girls) hotmail accounts like that when I was young. I tried to recover their password and if I didn't know the answer to their security question (I often did) I just asked... I was curious if they write something about me in their emails, never did...

Simply brilliant. You should submit this together with a security issue report to Facebook and Hotmail and whoever else uses security questions. Do you mind if I quote you (with link) on my blog?

> You should submit this together with a security issue report to Facebook and Hotmail and whoever else uses security questions.

Google, too. I suggest you run through the recovery process yourself (on a dummy account, or your own) to see the kinds of questions asked. Questions like "when did you last access the account?" are easily answered; as is "name 5 regular contacts"; and so on. I could (but would not) perform the recovery process (and gain access to) acquaintances accounts, given how simple the questions are.

The key is just knowing "enough" in aggregate to pass their bar.

Re: Password Rules

#85

Post by Terretta »

dekz wrote: post #79
its_so_on wrote: post #36

I swear one day we will see. "Unfortunately time and again we have come to observe the inability of employees to follow simple rules during password creation. For example, despite our warnings, employees often create a password containing more than one consecutive non-numeral; other employees attempt to createa a password consisting only of numbers, only of letters, or an insecure mix of numbers and letters - e.g. 5:…

> The password must be exactly 8 characters long. This is probably the root cause of bad passwords. In the case of Average Joe, he is now having to choose something memorable which is 8 characters long. 'PassworD'

Sorry, "PassworD" doesn't validate. You're missing a symbol, and you have a character repeated. Try "P@s5w0rd" instead. Or, better yet, "abc#1234" as suggested in the examples.

Re: Password Rules

#86

Post by Terretta »

angry-hacker wrote: post #76
lucb1e wrote: post #73

Earlier quoted context omitted.

Simply brilliant. You should submit this together with a security issue report to Facebook and Hotmail and whoever else uses security questions. Do you mind if I quote you (with link) on my blog?

Go ahead... hotmail by the way still let's you take over someones account by only knowing email address and answer to security question which is often maiden middle name, name of first pet, best childhood friend etc... you can find that information freely from facebook for an example. Or just ask :)

Forward all your "friends" one of those "50 Things You Didn't Know About Me: Fill In Your Answers and Forward!" question lists that includes the security questions you're targeting.

Re: Password Rules

#87

Post by jfasi »

haberman wrote: post #4

Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer I gave to a security question. I bought a house last month, and the biggest thorn in my side throughout all of the financial arrangements was security questions (I'm not even joking). Here's a Facebook status update I posted (I had already been complaining abou…

My favorite thing is when the answer to the security question is allowed to be remembered by the browser, meaning anyone who gets my password can saunter up to any computer I've used in the past and bypass the stupid security question.

Re: Password Rules

#88

Post by dekz »

Terretta wrote: post #85
dekz wrote: post #79

Earlier quoted context omitted.

> The password must be exactly 8 characters long. This is probably the root cause of bad passwords. In the case of Average Joe, he is now having to choose something memorable which is 8 characters long. 'PassworD'

Sorry, "PassworD" doesn't validate. You're missing a symbol, and you have a character repeated. Try "P@s5w0rd" instead. Or, better yet, "abc#1234" as suggested in the examples.

We've moved on to a fictitious setup. I was so disgusted with my bank and their password policies and authentication measures. They too restrict to 8 characters, but they happen to also offer a SecurID token. This token can be used in conjunction with the initial authentication. I would happily switch to any bank where I can know my data is secure. How do we trust them?

Re: Password Rules

#90

Post by goatslacker »

haberman wrote: post #4

Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer I gave to a security question. I bought a house last month, and the biggest thorn in my side throughout all of the financial arrangements was security questions (I'm not even joking). Here's a Facebook status update I posted (I had already been complaining abou…

Agreed. Shame to see so many reputable companies not give a rat's ass about security when they seriously prompt for security questions like "Where was your honeymoon?" or "What was your first car?" -- I've even seen "Where did you graduate High School?"
Post reply on HN