Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

121–130 of 447 posts

Re: I hate password rules

#121

Post by bluGill »

Ajedi32 wrote: post #92
frosted-flakes wrote: post #82

Earlier quoted context omitted.

Requirements for uppercase letters, numbers, and special characters mean I stick an "A1!" at the end of my otherwise strong and memorable password. I'm sure I'm not the only one.

Yeah, at least there's a good work-around for the numbers/symbols requirement. What's more annoying is when sites have a low maximum length so you _have_ to use special characters to get good entropy, or when they have other bizarre requirements like "can't contain more than 3 of the same character".

Todays computers can brute force passwords of their maximum length in a few hours.

I suppose someone somewhere has a maximum length that is hard to brute force, but I've never seen it.

Re: I hate password rules

#122

Post by godshatter »

Arrath wrote: post #88
kayodelycaon wrote: post #70

Earlier quoted context omitted.

I got up to P@ssW0rd12 at one job.

I was working my way to it, when IT rolled out a new policy of "cannot share more than 2 consecutive characters with a previous password" or something like it, included in an email along the lines of "an audit has found this new policy applies to you". Dicks.

Doesn't that imply that the are saving your previous passwords in plain text somewhere instead of saving hashes of them? How is this more secure?

Re: I hate password rules

#123

Post by lxgr »

fsflover wrote: post #73
postalrat wrote: post #64

Earlier quoted context omitted.

Make them required, they will take off. Most phones made in the past few years can operate as one.

> Most phones Are you going to force people to use specific smartphones?

How many smartphones these days are not running iOS or Android?

Even then, nothing keeps the vendors of alternative smartphone OSes from implementing a FIDO platform authenticator.

Re: I hate password rules

#124

Post by fsflover »

lxgr wrote: post #123
fsflover wrote: post #73

Earlier quoted context omitted.

> Most phones Are you going to force people to use specific smartphones?

How many smartphones these days are not running iOS or Android? Even then, nothing keeps the vendors of alternative smartphone OSes from implementing a FIDO platform authenticator.

> How many smartphones these days are not running iOS or Android?

Those that fight the duopoly and allow user freedom: Librem 5 and Pinephone.

I really hope that it could use an open standard. Then, it's probably fine.

Re: I hate password rules

#125

Post by reaperducer »

gonehome wrote: post #80
reaperducer wrote: post #37

Earlier quoted context omitted.

The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me Or worse, they truncate your password after you've already used it for years and years. I had a 30-character password with Bank of America. Somewhere along the line, it changed its password requirements to only allow a maximum of 20 or 25 characters (I forget), which automatically invalidated m…

I'm not sure why anyone uses banks like BoA, Wells Fargo, First Niagara, etc. Fidelity is a superior experience in nearly every way - just categorically. I'm not sure if people just don't know that you can use Fidelity this way? The only downsides are no local branches, but that's hardly an issue unless you need a cashiers check. In those rare cases you can spin up an account at shitty bank, get the check, then close…

You state that you don't understand why people use large, complex banks. Then state that you have a very simple, financially uninteresting life.

You answered your own question.

Re: I hate password rules

#126

Post by GoblinSlayer »

dataflow wrote: post #77
loa_in_ wrote: post #72

Earlier quoted context omitted.

My passwords are all 20+ characters long

For websites, you're just making your own life harder for no real gain. Even with purely alphanumeric 10 chars, it's not like anyone can exhaust the 36^10 password space over a network with no one noticing. Yet whenever you run into issues with the website or the password manager (or some other non-routine thing... like you're on your phone and need to enter this on a different computer) and have to enter it manually…

Websites are not the only system that can enjoy a password, and there's no excuse for their egocentrism.

Re: I hate password rules

#127

Post by clement_b »

antsar wrote: post #104
clement_b wrote: post #2

Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.

Thankfully, Firefox has an easy way to stop that. about:config dom.event.clipboardevents.enabled = false

Nice! Will try that one.

Re: I hate password rules

#128

Post by gonehome »

reaperducer wrote: post #125
gonehome wrote: post #80

Earlier quoted context omitted.

I'm not sure why anyone uses banks like BoA, Wells Fargo, First Niagara, etc. Fidelity is a superior experience in nearly every way - just categorically. I'm not sure if people just don't know that you can use Fidelity this way? The only downsides are no local branches, but that's hardly an issue unless you need a cashiers check. In those rare cases you can spin up an account at shitty bank, get the check, then close…

You state that you don't understand why people use large, complex banks. Then state that you have a very simple, financially uninteresting life. You answered your own question.

I have a pretty complex financial situation, but Fidelity can just do all of it more easily than retail banks.

Is there something banks like BoA do better that I'm missing? When I've asked people I know this I haven't gotten any good answers. I'm genuinely asking.

My impression is that BoA, Wells Fargo, etc. mostly take advantage of customers that don't know better options exist.

Re: I hate password rules

#129

Post by pdonis »

latchkey wrote: post #9

Instead of requiring people to have special password rules, we should require people to use a password manager. Then, if you have special password rules, the manager could generate a strong password that fits into the defined rules. Of course, getting rid of passwords entirely, is the best option (ie: using a decentralized sso solution).

> we should require people to use a password manager.

And how could this possibly be checked except by allowing any random website that wants to use passwords to pwn my computer?

Re: I hate password rules

#130

Post by lxgr »

fsflover wrote: post #124
lxgr wrote: post #123

Earlier quoted context omitted.

How many smartphones these days are not running iOS or Android? Even then, nothing keeps the vendors of alternative smartphone OSes from implementing a FIDO platform authenticator.

> How many smartphones these days are not running iOS or Android? Those that fight the duopoly and allow user freedom: Librem 5 and Pinephone. I really hope that it could use an open standard. Then, it's probably fine.

FIDO is an open standard!

https://fidoalliance.org/fido2/

Nothing is preventing either OS from implementing it, either as a platform authenticator or via NFC, USB or Bluetooth support for external authenticators.

Post reply on HN