Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules

portal.cs.oag.state.tx.us

Post reply on HN
Print view View original

101–110 of 157 posts

Re: Password Rules

#101

Post by yuliyp »

TylerE wrote: post #99
r00fus wrote: post #68

Earlier quoted context omitted.

It's a good point towards passphrases instead. 1Password gladly generates "pronounceable" passwords (e.g. "thax-lers-ponc-werv"). I usually think a bit about whether digits or symbols are required (some services and websites - Skype notably) don't like them. A 20-char passphrase with spaces, dashes, or character-based (e.g. "S") word-boundary delimiter is often good enough to provide excellent (80+ bits) entropy.

Or how about everybody that uses these fucking inane rules just do something sensible - like lock an account out if there are more than 5 failed logins in a row. Using a setup like that even "4321" is probably secure enough. Obviously use a secure hash on the backend as well.

OK, let's do that. How long do you lock it for? What if it's a common email address? How can the real owner unlock it?

Re: Password Rules

#102

Post by shard »

namityadav wrote: post #100
ecoffey wrote: post #63

Earlier quoted context omitted.

Heh, yeah luckily I haven't had to do that, but I have chosen some obscene answers to them, and then later had to recite, and spell them out to a horrified Indian call center worker.

I see why you had to mention that the call center worker was "Indian". If you hadn't, your entire statement wouldn't have made any sense. Right?

Well, the implied ethnicity of the poster is non-Indian, so in addition to the embarrassment of having to spell out obscene words, there's the cultural gap as well. The poster can't judge how offended the call center worker was, and probably feels like he's poorly representing his culture. I've had many similar experiences, especially since I've been living in Korea recently, and it's very uncomfortable not knowing exactly how big of a faux pas you committed.

Re: Password Rules

#103

Post by asciident »

16s wrote: post #98

There needs to be an ISO standard for passwords. Things like this are ridiculous.

What I want to know is whether there is a subset of passwords that will be valid against almost all password rules. Like if I make a password that has 12 characters, one symbol and one number, will that fit in 99.9% of cases?

Re: Password Rules

#104

Post by jerf »

unimpressive wrote: post #54
steve-howard wrote: post #44

Earlier quoted context omitted.

I don't know that passwords are all bad. For an alternative approach to complex rules, see: http://xkcd.com/936/ The last time I changed a password for a service I set it to a phrase that I can easily remember but which no human or current machine will easily guess. I'd say that the only good rule is "Make it at least 9 characters" (which is at least long enough to disallow "password").

Character minimums hurt your entropy too. Stripping the entire search space up to nine characters isn't really a good idea. In my opinion it'd be better to just find a list of the top 10K passwords and disallow them. One out of 50 people use one of the top 20 passwords. [0] I'd bet that over half of passwords used are in the top ten thousand. [0]: http://xato.net/passwords/how-i-collect-passwords

"Character minimums hurt your entropy too."

Not really. If X is the number of characters your password can be made up of, there are 8^X possible passwords that are 8 characters long, and 8^X-1 possible passwords that are less than 8 characters long. Even here, right on the border, you've only lost 1 bit of entropy (half banned, half allowed), and you win big the moment someone makes it even one character longer than the minimum who wouldn't have otherwise.

Re: Password Rules

#105

Post by duaneb »

r00fus wrote: post #71
duaneb wrote: post #49

Earlier quoted context omitted.

So if you share a computer with someone, how do you stop that person from logging into your account to read your email?

Strong passwords. Password manager. Separate Accounts. Keypass or 1Password (which I prefer on OSX) are quite good. I use gmail + 2-step auth. You can configure it to be quite paranoid.

Sorry, I meant to say with the BrowserID.

Re: Password Rules

#106

Post by prodigal_erik »

namityadav wrote: post #100
ecoffey wrote: post #63

Earlier quoted context omitted.

Heh, yeah luckily I haven't had to do that, but I have chosen some obscene answers to them, and then later had to recite, and spell them out to a horrified Indian call center worker.

I see why you had to mention that the call center worker was "Indian". If you hadn't, your entire statement wouldn't have made any sense. Right?

Indian culture is pretty uptight in certain ways, and knowing that would make me feel a lot more guilty about making them uncomfortable.

http://news.bbc.co.uk/2/hi/7871304.stm

Re: Password Rules

#108

Post by epistasis »

jaybill wrote: post #96

I get annoyed when I can't use spaces, because my general password strategy is to click my link bar shortcut to Random Wikipedia Page, pick five or six words and use that as my password. Easy to remember, hard to guess, even harder to brute force. Thanks XKCD! I use Keepass to store passwords for the various things I use, and even though my hive is stored on a web server (uses SSL and requires a password, of course)…

This is a terrible way to choose passwords, and in no way equivalent to the XKCD method. It's not equivalent because additional length in your password is very predictable rather than random.

To brute force your password, all somebody has to do is choose a starting word in Wikipedia and some number of consecutive words. This is log2(size of Wikipedia) + log2(entropy of your "5 or 6" distribution). This is less than 32 bits of entropy, or about a six character password in a 64 character alphabet, i.e. it's trivial to brute force this password if you have the hash.

Re: Password Rules

#109

Post by creativeembassy »

X-Istence wrote: post #97
dekz wrote: post #88

Earlier quoted context omitted.

We've moved on to a fictitious setup. I was so disgusted with my bank and their password policies and authentication measures. They too restrict to 8 characters, but they happen to also offer a SecurID token. This token can be used in conjunction with the initial authentication. I would happily switch to any bank where I can know my data is secure. How do we trust them?

I have a student loan that is limited to 8 character passwords. Thing is, when you go to set your password the first time it will happily take the password and use it, good luck getting in though because the next time you go to enter your password the web form truncates it for you (using JavaScript upon submitting)! Then when you go to reset your password they keep telling you that your password doesn't meet the requ…

I had this problem with Windows 8 and creating a Microsoft Account. When creating the account, they had a hard limit of something like 15 characters. (My passwords are pretty long.) Which got automatically truncated. So when I rebooted my computer running Windows 8 Preview, I couldn't log in with the password I had used, until I figured out that I should only type the first 15 characters of it. Terrible web form design.

Re: Password Rules

#110

Post by petitmiam »

raldi wrote: post #39
jonamato wrote: post #30

The sub-password "similarity" rules (#8) mean that it is incredibly unlikely that the system is storing the password history hashed, and basically impossible that they're storing it salted. What could possibly go wrong?

You don't need unhashed password storage to enforce similarity rules. Presumably, the user has to type in their current password when they set a new password. When processing that request, you have all the information you need to do the similarity check.

What about the 7 passwords prior?
Post reply on HN