Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop forcing arbitrary password rules

ryanwinchester.ca

Post reply on HN
Print view View original

151–160 of 196 posts

Re: Stop forcing arbitrary password rules

#151

Post by D-Coder »

peeters wrote: post #135
codedokode wrote: post #34

What we really need is to stop using passwords. Passwords are awful UX design solution. The users have to think of and remember some meaningless phrase to get the service they really needed. If you use easy password, your account can be hacked. If you use difficult password, you won't remember it in a week. For some people remembering a password or login might be especially difficult. You can use software to generate…

Hardware might be a nicer UX (though god forbid you forget your dongle one day and are completely screwed). But I fail to see how it's more secure without a second form of authentication.

"though god forbid you forget your dongle one day and are completely screwed"

No, I always know where my dongle is.

Re: Stop forcing arbitrary password rules

#152

Post by coldcode »

Often the stupidest limitations in passwords come from the backend system being an ancient banking/insurance/healthcare system running on a mainframe using rules that were prevalent 30-40 years ago. Having worked for a smallish financial/banking company we had an AS/400 with code mostly written in a 4GL tool as the system of record. The database didn't even have unique keys. Everything modern (like web apps) was limited by what this system supported.

Re: Stop forcing arbitrary password rules

#153

Post by xjay »

Truncation: The browser could have warned users for years already. Pasting something that gets cut off is data loss. Relying on a JavaScript implementation to do this is a hack that only covers some sites (yes, you could have an add-on, but no, that would require JavaScript, and it's still a hack).

Binary Passwords: I could just copy/paste blocks of hexadecimal digits into the password field using a fixed number of digits corresponding with the key size, and they would be interpreted as a stream of unsigned binary octets. The only thing you'd need to know was the length.

A suitable format is using hexadecimal. If you're using a password manager, you already don't care about what the characters are, only that it is secure.

Passwords are also no longer limited to use printable characters.

How would you implement that for all users? Adding a prefix like 0x to enter hex mode?

Re: Stop forcing arbitrary password rules

#154

Post by Retric »

sokoloff wrote: post #145
Retric wrote: post #142

Earlier quoted context omitted.

Must contain 2 of the following, (upper case letter), (lower case letter), (number), or (Symbol) is higher entropy than 8 lower case letters.

Mathematically, but not socially. It means that humans reduce the entropy across the board to (more than, IMO) compensate for the mathematical advantage.

Do you have any data on this? Last I check pick to was a slightly better option.

Re: Stop forcing arbitrary password rules

#157

Post by aianus »

ErrantX wrote: post #136
aianus wrote: post #88

Earlier quoted context omitted.

> especially given people tend to use common words You don't pick the words yourself, you choose them at random. That's the whole point. > Given the sort of compute power you can obtain cheaply nowadays, attacking 4-word schemas (especially given people tend to use common words) is not hard. If the password is hashed with bcrypt with a work factor of 10 (the default in Rails), it would take ~5500 years to crack a sin…

Except, how can you be sure your password was stored securely? You should never assume that. > You don't pick the words yourself, you choose them at random. That's the whole point. Suggest: you're supposed to choose them at random. In practice (source: 5 years as a security analyst) this does not happen. People are predictable!

> Except, how can you be sure your password was stored securely? You should never assume that.

You don't have to. You can use a password manager with an open protocol (like 1Password) where you can tell the db is encrypted using a key correctly and slowly derived from your master xkcd-style password.

If done correctly, it's a much better scheme than randomly generated characters because at the same level of entropy you wind up with a password you can actually remember and type quickly and use consistently in conjunction with a password manager.

Re: Stop forcing arbitrary password rules

#158

Post by qiemem »

CHY872 wrote: post #37
codedokode wrote: post #34

What we really need is to stop using passwords. Passwords are awful UX design solution. The users have to think of and remember some meaningless phrase to get the service they really needed. If you use easy password, your account can be hacked. If you use difficult password, you won't remember it in a week. For some people remembering a password or login might be especially difficult. You can use software to generate…

No. They are not superior to passwords - they merely provide different tradeoffs. For example, the site that requires your hypothetical key-type key would require that either all of their customers have spent money on such a key (bad) or that they are willing to pay for keys for all of their customers. This is something that has been thought about in detail - see https://vtllf.org/blog/ssh-web-sign-in/quest-to-replac…

What about fingerprints? You don't need to buy anything, phones and such are already coming out with fingerprint readers and the technology is improving all the time. Finally, you can't lose your finger print (except in the case of extreme accidents, which exist for any type of security).

Re: Stop forcing arbitrary password rules

#159

Post by mkobit »

coldcode wrote: post #152

Often the stupidest limitations in passwords come from the backend system being an ancient banking/insurance/healthcare system running on a mainframe using rules that were prevalent 30-40 years ago. Having worked for a smallish financial/banking company we had an AS/400 with code mostly written in a 4GL tool as the system of record. The database didn't even have unique keys. Everything modern (like web apps) was limi…

One that comes to recent memory is Schwab. A few points from this (http://www.jeremytunnell.com/posts/swab-password-policies-an...) article from December 2014:

> "Schwab.com passwords are limited to eight characters, cannot contain symbols, and are case insensitive. " > "I now know that on the backend, my secure 16 digit password got stored in the system as only the first eight characters." > "So what they do is allow UP TO eight characters to represent the password, which is stripped from the contents of the password field. Assuming that the user is activating a token, there will be characters left over. Instead of using the LAST six characters to check the token code, they pull the NEXT 6 characters."

Seems like these companies just do not want to put the effort or deal with the customer pain of updating to a newer model.

Re: Stop forcing arbitrary password rules

#160

Post by M2Ys4U »

qiemem wrote: post #158
CHY872 wrote: post #37

Earlier quoted context omitted.

No. They are not superior to passwords - they merely provide different tradeoffs. For example, the site that requires your hypothetical key-type key would require that either all of their customers have spent money on such a key (bad) or that they are willing to pay for keys for all of their customers. This is something that has been thought about in detail - see https://vtllf.org/blog/ssh-web-sign-in/quest-to-replac…

What about fingerprints? You don't need to buy anything, phones and such are already coming out with fingerprint readers and the technology is improving all the time. Finally, you can't lose your finger print (except in the case of extreme accidents, which exist for any type of security).

Fingerprints are usernames, not passwords.

You can't lose your fingerprint, but you can't replace it either - so what happens when somebody clones it?

Post reply on HN