Why don't we have password standards? • Hacker News Board

Re: Why don't we have password standards?

#11

Post by dfc » Wed, Aug 10, 2011, 6:02 PM UTC

mooism2 wrote: post #7

We could start by disallowing maximum password lengths, and insisting that all printable characters are allowed in passwords. The great thing about standards is that there are so many to choose from. Here in Britain the Financial Services Authority sets minimum password standards for online banking. I expect similar regulators in other parts of the world have their own subtly different requirements.

In the states this is handled by the FFIEC but there is no specific complexity requirement. In accordance with the rest of the guidelines the complexity requirements are supposed to be based on a risk assessment.

Re: Why don't we have password standards?

#12

Post by millzlane » Wed, Aug 10, 2011, 6:27 PM UTC

dfc wrote: post #10

mattbot5000 wrote: post #9

Earlier quoted context omitted.

You don't want your product to be the one with hundreds of people having their accounts compromised. This warrants a bare minimum of password requirements.

Exactly. So you do care about the security of the users.

No, he cares about the reputation of his product being spoiled by the intellectually challenged.

Re: Why don't we have password standards?

#13

Post by maze » Wed, Aug 10, 2011, 9:33 PM UTC

Put a standard of 8 character minimum, and hackers will start targeting 8 characters+

For example, if they are using brute force they will start it using 8characters, or use dictionary words with 8c +. Still 8c is better then 6.

Just install a password manager, or "develop" your own "algorithm" of how you create your passwords. For example a password "Hackernews"; move each character once to the left, which would give: Jsvlrtmrd. Obviously this "algorithm" has to be change every few websites, or somebody will find out your pattern.