Password Rules

#1

Post by valuegram » Sun, Jun 03, 2012, 4:43 PM UTC

Password Rules
portal.cs.oag.state.tx.us

Re: Password Rules

#2

Post by fiatmoney » Sun, Jun 03, 2012, 5:31 PM UTC

Ironically, each of these restrictions reduces the space of possible passwords for a brute-force attack, which is already pretty small given the inane 8-characters-exactly requirement.

Re: Password Rules

#3

Post by jiggy2011 » Sun, Jun 03, 2012, 5:37 PM UTC

Is there any reasoning at all behind the thinking that requires passwords such as this? These sorts of rules are so commonplace that there must be some reasoning for it?

Re: Password Rules

#4

Post by haberman » Sun, Jun 03, 2012, 5:37 PM UTC

Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer I gave to a security question.

I bought a house last month, and the biggest thorn in my side throughout all of the financial arrangements was security questions (I'm not even joking). Here's a Facebook status update I posted (I had already been complaining about security questions a bunch):

"Just got challenged with a security question, which was "Thank you for your loan application." Wtf, that is not a question. And I've never filled out any security questions for this website, so I have no idea what it's expecting me to enter.

"I swear, security questions are out to get me."

Re: Password Rules

#5

Post by homosaur » Sun, Jun 03, 2012, 5:37 PM UTC

WOW. I was expecting something dumb but this is next level dumb. You're basically forcing a 7 character password since I already know one of them is one of those three special characters. Then you've just given me like 5 more rules that limit what the password can be.

Any password cracking service would crack this in hours. IT people should understand the basics about security before they are allowed to set policy.

Re: Password Rules

#6

Post by astangl » Sun, Jun 03, 2012, 5:37 PM UTC

fiatmoney wrote: post #2

Ironically, each of these restrictions reduces the space of possible passwords for a brute-force attack, which is already pretty small given the inane 8-characters-exactly requirement.

I have pointed this out to people before too. It doesn't seem to deter their slavish adherence to what they declare to be "best practices", which seems to correspond to something they read in some magazine or blog.

Re: Password Rules

#7

Post by sunwooz » Sun, Jun 03, 2012, 5:40 PM UTC

If you had to create a list(or non-list) of requirements a password must pass what would it be? (Ex. Case sensitivity, length, cannot be the same as username etc etc) The bare minimum with the least frustration for the user? I was very surprised by the news-piece that blizzard was using case-insensitive passwords and that got me thinking...

Re: Password Rules

#8

Post by healsdata » Sun, Jun 03, 2012, 5:40 PM UTC

Of those ten rules, nearly half of them hurt password strength. The others make it harder for users to remember their passwords which will lead them to frustration and, ultimately, bad passwords.

Austin#1 is a perfectly valid password according to those rules. zxcvbn says it'd take 2.508 seconds to crack that.

Re: Password Rules

#9

Post by njloof » Sun, Jun 03, 2012, 5:41 PM UTC

After coming up with a password that obeys all those rules, I recommend writing it down on a yellow sticky note and putting it on your monitor.

Re: Password Rules

#10

Post by x1 » Sun, Jun 03, 2012, 5:43 PM UTC

Yeah. As someone who prefers passwords in the 12-24 character length I get really annoyed when a site comes back and tells me my password isn't good enough because it doesn't follow various rules. Oh you really think someone is going to brute force $MILKAndDailyCheeseRe because it doesn't have a number in it?