Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

181–190 of 447 posts

Re: I hate password rules

#181

Post by tomc1985 »

dahfizz wrote: post #120
tomc1985 wrote: post #117

Earlier quoted context omitted.

> * Require MFA Using some kind of OTP authenticator app or device and __NOT__ SMS!

SMS is perfectly good as an additional authentication factor. i.e. When you log in on a new device using your user name and password, you also need to type in the text message code you were sent. It is a convenient way to strictly increase the security of an account. What SMS is terrible for is as a single point of account recovery. This is unfortunately how it is often used. "Multi factor authentication" in practice…

No it isn't. If you lose your phone you are in for a world of hurt, let alone all the various ways there are to intercept/redirect SMS messages and/or entire mobile accounts. To say nothing of the fact that internet access is not yet globally ubiquitous, or if you forget to pay your bill, or all these other possibilities.

A proper OTP app works offline, and more than one of them can exist for any given authentication, so you can have backups if your phone is stolen.

Re: I hate password rules

#182

Post by GuB-42 »

godshatter wrote: post #122
Arrath wrote: post #88

Earlier quoted context omitted.

I was working my way to it, when IT rolled out a new policy of "cannot share more than 2 consecutive characters with a previous password" or something like it, included in an email along the lines of "an audit has found this new policy applies to you". Dicks.

Doesn't that imply that the are saving your previous passwords in plain text somewhere instead of saving hashes of them? How is this more secure?

Usually, when you change your password, you have to enter your old password. With both plaintexts, the check is trivial.

It also means it should be possible to bypass that by changing the password twice or by "forgetting" your old password.

Another possibility is that they simply lie to you and the rule that is actually checked is much more permissive. I've often seen requirements that are not actually checked

Re: I hate password rules

#183

Post by MomoXenosaga »

kylebyproxy wrote: post #112
63 wrote: post #86

Earlier quoted context omitted.

Interestingly, one of the studies they cite finds that blocking common passwords is one of the most frustrating experiences for users. Even though it's more secure, the user has no idea what's wrong with their password or how to correct it.

I can't say how common this is, but many (most?) online accounts I personally interact with are disposable, represent no sensitive information, and I couldn't care less if they're compromised. They're one-time sign-ups, junk accounts, free trials, free tiers, etc. > one of the most frustrating experiences I understand this frustration as a mismatch between the user's non-expectation of security and the service's obey…

Yes every service considers itself critical. But users don't give a shit if some forum they signed up for 3 years ago gets hacked.

For me I just see it as a sign of pretentiousness when you expect me to come up with a 20 character password. Luckily Firefox has a built in password generator now.

Re: I hate password rules

#184

Post by tomc1985 »

watwut wrote: post #142
greggman3 wrote: post #139

Earlier quoted context omitted.

I guess you don't travel much. it's very common to have internet but not cell service (so no SMS). it's also common to buy a local sim so effectively no SMS or at least not the one you have registered. So no, SMS is not perfectly good. it's crap and needs to die in a fire.

I used to travel a lot and the exact combination of no signal and internet was not frequent at all.

That heavily depends on where you travel. Even here in Southern California there are populated areas with little to no mobile internet service (like Big Bear Lake, Anza Borrego, or Joshua Tree areas for example)

Re: I hate password rules

#185

Post by qwertox »

I had a 16 character password which I used in an PC online-banking application.

After an update the password was unable to unlock the database.

So I started creating new databases with different passwords to see what was going on, and it turned out that all passwords longer than 10 characters were failing.

So I truncated my old password to 10 characters and then it worked. No hint, no nothing in the release notes.

Re: I hate password rules

#186

Post by colinclerk »

amanzi wrote: post #166
colinclerk wrote: post #109

Earlier quoted context omitted.

Disclosure: I am the cofounder https://www.clerk.dev Here's the direct link to NIST 800-63B - it's really a fantastic document with sensible recommendations on every authentication method: https://pages.nist.gov/800-63-3/sp800-63b.html The tedious part of NIST's password requirements is "Do check for compromised passwords" HaveIBeenPwned exists, but most open source tools don't leverage it and this requirement goes o…

The important part is that the NIST password advice is meant to be read as a whole. Often I see people quote snippets out of the advice, but unless you read and understand the whole document, you run the risk of reducing your security posture.

What's crazy to me is that NIST compliance isn't part of SOC-2 certifications or similar.

A portion of our customers will ask us about NIST, but it's slimmer than I would have expected.

Re: I hate password rules

#187

Post by Igelau »

PascLeRasc wrote: post #164

A few weeks ago I signed up for a local credit union and received a membership packet in my email including a reminder of what my password is. I called them to tell them about this security flaw and received a single dollar as a bug bounty, but they still haven't changed it.

100 Call them again

200 Get another dollar

300 Goto 100

Re: I hate password rules

#188

Post by teawrecks »

dr_kiszonka wrote: post #140
godshatter wrote: post #122

Earlier quoted context omitted.

Doesn't that imply that the are saving your previous passwords in plain text somewhere instead of saving hashes of them? How is this more secure?

This would be my guess too. Alternatively, maybe they save hashes of all substrings of length > 2 and check all hashed substrings of the new password against them. (Which - in my limited understanding of infosec - would be only marginally better than plaintext, but I can be wrong.)

Yeah, having hashes of substrings of a password would help a LOT when brute forcing. If I have a 10 char pass, and I'm storing 1 hash of the full pass + 9 hashes of the 2-char substrings, I can now brute force all those 2-char hashes and then fit them together in the few valid ways they could go together (assuming there is more than 1) until I find the final hash. Salts wouldn't matter.

Re: I hate password rules

#189

Post by bsid »

thecodrr wrote: post #178

Discloser: I am the co-founder ( https://notesnook.com ) We used to ask our users 90% of the standard password requirements (min length 8, 1 special character, 1 digit, 1 capital etc). The result was a lot of people forgetting their password and having a really bad first impression. We were following "best practices" but the user didn't care. In the end, we took out all the requirements except one: password must be 8…

you really need a way for people to get in if they forgot their password...

Re: I hate password rules

#190

Post by teawrecks »

robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

This has happened to me on one site. As far as I'm concerned, this is just a bug.
Post reply on HN