Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules Are Bullshit

blog.codinghorror.com

Post reply on HN
Print view View original

141–150 of 283 posts

Re: Password Rules Are Bullshit

#141

Post by [deleted] »

MarkMc wrote: post #124
prairiedock wrote: post #101

Can anyone explain why all authentication systems don't enforce a (say) 2-second delay on repeated password attempts? Wouldn't this solve nearly all insufficient entropy problems? Even a 5-character password should suffice in this situation, and a human user would never even notice the 2-second delay. How would malevolent password-crackers get around this?

Even with a delay of 2 seconds, I can check your password against the most-common 10,000 passwords list in 6 hours. And I can run the check in parallel. So if I have 1,000 email addresses I can find all the users with low-entropy passwords in just 6 hours.

[deleted]

Re: Password Rules Are Bullshit

#142

Post by lostlogin »

hellcow wrote: post #122
koolba wrote: post #31

Earlier quoted context omitted.

> Why? Because my password in the "create" page was silently truncated on the front end, but the same truncation does not occur in all places, so I would type a longer password on the login page then what was registered in the system and it would fail. Here's an even worse one than truncating the end of long passwords: truncating internal whitespace The change/reset password dialog for Apple ID does this. If your pas…

I can confirm. I spent days locked out of my Apple account (and all associated devices) because I had spaces in my passwords. After several hours with support, who needed to escalate the issue to tier 2, then engineering, the only thing that fixed it was me briefly trying a simple password -- one without spaces. I'm not sure if the issue was ever fixed, but I don't imagine I'll use spaces in an Apple password again a…

Wonder what other sins are there. A couple of years ago when iCloud was first a thing, I did a couple of password changes in quick succession. It resulted in me having different login passwords for different iCloud services. It worked for a short time then broke and another reset fixed it all.

Re: Password Rules Are Bullshit

#143

Post by TuringTest »

lostlogin wrote: post #138
coldtea wrote: post #60

Earlier quoted context omitted.

> I am being serious when I ask this question: does anybody brute force passwords? Very many people. And not all systems stop them from doing so. And database leaks happen all the time too...

It wouldn't really matter how good your password was in the leak/breach scenario would it?

It would, if [some fields of] the database is encrypted. Then the attacker could only get the content from accounts with weak passwords, not yours.

Re: Password Rules Are Bullshit

#144

Post by andrewguenther »

This article starts by using an example of 8 "bad" password rules, but by the end of the post, Jeff ends up suggesting 5 of the 8 anyway. This post really should have been called "special character requirements are bullshit."

I'd be willing to bet that a future version of Discourse will also disallow using your previous password as well. Then we'll get another password blog post talking about how hard passwords are and how we need more rules for passwords. Experience is a funny thing.

Re: Password Rules Are Bullshit

#145

Post by lostlogin »

redwood wrote: post #46
jondubois wrote: post #28

I'm surprised that this article didn't mention the most important point about password rules: They force you to come up with a new password that you probably haven't used before and so you will probably forget it. There are websites that I don't use often where I literally have to reset the password (and go through all the i-forgot-my-password steps) every time I want to log in because they forced me to come up with…

Related, some of these sites you forget what you used and have to create a new password - and some of them do this horrible "You cannot re-use your four last passwords" thing which leaves you in this sort of permanent "I'm never going to remember and always have to come up with something new" loop (for sites you go to only periodically, e.g. an HR portal, let's say). But hey, nothing important lives in an HR portal,…

Employee of a university here. Not only are the password requirements annoying, unless you close the browser you aren't logged out. Clicking "logout" makes it look logged out, but the next person to use email/payroll enters their credentials and gets the prior users account. Hilarity ensues with people applying for each other's leave, emailing responses to messages that weren't for them etc. The interim response is for people to set a theme in their email to make it more dictinctly different. I kid you not.

Re: Password Rules Are Bullshit

#146

Post by rcar »

The most recent post in one of the Tumblrs linked through the article goes through some of Facebook's password allowances: http://password-shaming.tumblr.com/post/157913813567/not-ent...

Essentially, Facebook accepts 4 forms of the password as correct: 1) the correct password, 2) the caps-lock inverted version, 3) the correct password but with the first letter capitalized, and 4) the correct password + 1 character of any type. Each of #2-4 seems to be designed to prevent a failed login for the real user under common error cases, particularly when logging in on a phone.

Since each of those options can be easily stored as hashes (with #4 being done by also testing the entered password with the last character omitted against the correct password hash), the only weakness I can see this introducing is that if hashes were leaked, there's 3 valid passwords that could be found by an attacker rather than just 1, but with good hashing practices, that doesn't seem like a big deal since the search space will still be quite large.

With that in mind, that seems like a user-friendly addition that doesn't introduce any major weaknesses. Anything I'm missing that would make this a crazy scheme to have implemented?

Re: Password Rules Are Bullshit

#147

Post by ouid »

bambax wrote: post #74
simias wrote: post #25

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…

Totally agree. If you annoy the user too much, they will not try to circumvent your rules, they will leave and find something else to do with their time. Also, the big question that's missing from the article is: who's the enemy? If the enemy are Russian genius hackers, then certainly very long passwords and maybe other measures are in order. But the enemy is not always remote. I just bought a new iPad and had to res…

I have never come across an authentication mechanism that actually required your security questions. There's always another route to restoring your password, which means that they do not serve a security function, but rather serve a convenience function, at the expense of security.

If you are willing to be brave about this then the best way of answering security questions is by typing a random string and NOT writing it down. You will never need that value again.

Re: Password Rules Are Bullshit

#148

Post by Tyrannosaur »

nerdponx wrote: post #3

Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…

I have had that weird truncation happen several times. It is very frustrating, especially for someone who is first learning to make great long passwords, because they've never come across that problem before and now have to debug it.

Recently I had another scenario happen to me: signing up for a job application login, use my password manager to make a password, everything's great. Then when I go to login, "please remove the disallowed symbol (") from the password input before continuing". Needless to say, I could not log in. And they made me wait 24 hours before resetting my password. I was much less keen on applying for jobs there after that.

Re: Password Rules Are Bullshit

#149

Post by elastic_church »

sverige wrote: post #35
simias wrote: post #25

I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…

Yes and yes! Many throwaway accounts I have use some variation of the same password, because I don't care if someone hacks my HN or reddit or youtube account. I don't use my real name on any of them. If I lose control of it, I'll just make a new one. (Karma doesn't pay the bills, and I don't make money from my very excellent youtube comments; someone else does.) This is why all these accounts get an email account tha…

Got to steer the discussion somehow
Post reply on HN