Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules

portal.cs.oag.state.tx.us

Post reply on HN
Print view View original

141–150 of 157 posts

Re: Password Rules

#141

Post by darkarmani »

Tichy wrote: post #130
Achshar wrote: post #55

Banking passwords are always fun. Mine has to be changed every 30 days, cannot be same as last 3, must contain at least one number, special character, capital, lowercase. I essentially end up where i have to store password in plain text (!) in a password protected file. ridiculous but there is no way around it. People really have go understand that such things don't help at all, they increase user frustration if anyt…

Well the "not the same as last 3" rule is easy to circumvent: Just add a number at the end, password1, password2, password3...

So schemes notice the incrementing value, so I ended up doing !,@,#,... which is equivalent to 1,2,3...

The bonus is that I could still track how many quarters I worked for that place before leaving (lasted into the 6 quarter).

Re: Password Rules

#142

Post by homosaur »

ot wrote: post #21
homosaur wrote: post #5

WOW. I was expecting something dumb but this is next level dumb. You're basically forcing a 7 character password since I already know one of them is one of those three special characters. Then you've just given me like 5 more rules that limit what the password can be. Any password cracking service would crack this in hours. IT people should understand the basics about security before they are allowed to set policy.

> You're basically forcing a 7 character password since I already know one of them is one of those three special characters. Not exactly, because you don't know where the special character is. If the allowed characters are k, the number of 8-character passwords would be k^8. With this rule, even assuming that only one special character is used the number becomes 7^k * (3 * 8) = 7^k * 24, so if k ~= 60 the entropy is…

Ah, should have done the math. You're right, it's less impact that it seems at first.

Re: Password Rules

#143

Post by X-Istence »

codeodor wrote: post #131
X-Istence wrote: post #97

Earlier quoted context omitted.

I have a student loan that is limited to 8 character passwords. Thing is, when you go to set your password the first time it will happily take the password and use it, good luck getting in though because the next time you go to enter your password the web form truncates it for you (using JavaScript upon submitting)! Then when you go to reset your password they keep telling you that your password doesn't meet the requ…

> And unfortunately I can't leave them because it is a loan and not just a checking account. You may be able to refinance the loan through another bank, which would pay off this one and let you go with someone more reasonable.

If I could get the same interest rate or lower I would do it, but as of right now I would get lucky if I could find one that gave me 3x the interest let alone higher...

Re: Password Rules

#144

Post by seats »

FuzzyDunlop wrote: post #136
rwallace wrote: post #133

Earlier quoted context omitted.

We also need to get rid of the stupid habit of blanking out the password on the screen as it's typed, which imposes a time penalty exponential in the password length, or at least make it optional and disabled by default.

Re: this. Just have an option to 'display password' on the field itself somewhere, like you get when entering your WiFi password, or passwords on your phone. Re: GP. Attackers would just switch to brute-forcing with common phrases. Song lyrics, expressions, etc. Then your passphrase rules will change to accommodate that, and be even more confusing. "The quick brown fox jumps over the lazy dog" and other long, memorab…

Really interesting article and absolutely a fair point, but from the article itself, pass phrases are still better. Just not a cure all. The title ("... only marginally better ...") does not match the body ("... vast improvement ...")

>> The "30 bits of security" means the chances of a single guess cracking a four-word passphrase would be one in 230. What's more, the two-word phrases cracked in the study provided just 220.8 (or 20,656/0.0113) bits of security. Another way of expressing the same finding is that a dictionary of slightly less than 21,000 phrases is enough to guess the login credentials that slightly more than 1 percent of people in the real world will use.

To be sure, that's a vast improvement over the security of normal passwords. Analyses of compromised passwords leaked onto the 'Net, including a corpus of 32 million plaintext codes dumped following the 2009 hack of online games provider RockYou, show that it's trivial to crack a sizable proportion of real-world codes. A dictionary of just two of the most common passwords—123456 and 12345 respectively—typically guess 1 percent of login credentials.

Re: Password Rules

#145

Post by peeters »

dekz wrote: post #88
Terretta wrote: post #85

Earlier quoted context omitted.

Sorry, "PassworD" doesn't validate. You're missing a symbol, and you have a character repeated. Try "P@s5w0rd" instead. Or, better yet, "abc#1234" as suggested in the examples.

We've moved on to a fictitious setup. I was so disgusted with my bank and their password policies and authentication measures. They too restrict to 8 characters, but they happen to also offer a SecurID token. This token can be used in conjunction with the initial authentication. I would happily switch to any bank where I can know my data is secure. How do we trust them?

> We've moved on to a fictitious setup.

Fictitious? Did you read the rules in the original post?

> 2. It must contain at least one letter, one number, and one special character.

> ...

> 5. Two of the same characters sitting next to each other are considered to be a “set.” No “sets” are allowed.

Re: Password Rules

#146

Post by lindenr »

jerf wrote: post #104
unimpressive wrote: post #54

Earlier quoted context omitted.

Character minimums hurt your entropy too. Stripping the entire search space up to nine characters isn't really a good idea. In my opinion it'd be better to just find a list of the top 10K passwords and disallow them. One out of 50 people use one of the top 20 passwords. [0] I'd bet that over half of passwords used are in the top ten thousand. [0]: http://xato.net/passwords/how-i-collect-passwords

"Character minimums hurt your entropy too." Not really. If X is the number of characters your password can be made up of, there are 8^X possible passwords that are 8 characters long, and 8^X-1 possible passwords that are less than 8 characters long. Even here, right on the border, you've only lost 1 bit of entropy (half banned, half allowed), and you win big the moment someone makes it even one character longer than…

If X is the number of different characters your password can contain then the total number of possible passwords exactly 8 characters long is X^8.

The number of passwords that are less than 8 characters long is X + X^2 + ... + X^7 which is significantly less than X^8 for large X.

So your point is even more valid.

Re: Password Rules

#147

Post by pbreit »

sukuriant wrote: post #77
pbreit wrote: post #24

Stupid password rules is probably the leading source of consternation for this internets user. Has anyone ever analysed if password rules help at all? Aren't most compromises social-based or otherwise accidental? No one breaks in by slamming millions of login attempts at a server, do they?

My Diablo 3 account was hacked because my password was 'abcd1234'. This is no longer the case. So yes, sometimes. And no, I'm not certain why on earth I set that as my password...

Are you sure it was brute-forced? And the website owner had nothing in place to see that it was getting hit with brute-force password attack?

Re: Password Rules

#149

Post by jaybill »

epistasis wrote: post #108
jaybill wrote: post #96

I get annoyed when I can't use spaces, because my general password strategy is to click my link bar shortcut to Random Wikipedia Page, pick five or six words and use that as my password. Easy to remember, hard to guess, even harder to brute force. Thanks XKCD! I use Keepass to store passwords for the various things I use, and even though my hive is stored on a web server (uses SSL and requires a password, of course)…

This is a terrible way to choose passwords, and in no way equivalent to the XKCD method. It's not equivalent because additional length in your password is very predictable rather than random. To brute force your password, all somebody has to do is choose a starting word in Wikipedia and some number of consecutive words. This is log2(size of Wikipedia) + log2(entropy of your "5 or 6" distribution). This is less than 3…

I didn't say I picked consecutive words. You'd be right otherwise, though.

Re: Password Rules

#150

Post by namityadav »

ecoffey wrote: post #115
shard wrote: post #102

Earlier quoted context omitted.

Well, the implied ethnicity of the poster is non-Indian, so in addition to the embarrassment of having to spell out obscene words, there's the cultural gap as well. The poster can't judge how offended the call center worker was, and probably feels like he's poorly representing his culture. I've had many similar experiences, especially since I've been living in Korea recently, and it's very uncomfortable not knowing e…

Yes I'm non-Indian, and that was just a way to indirectly reference my culture and language gap with him.

Makes sense. Thanks to both of you for taking the time to clarify.
Post reply on HN