Stop forcing arbitrary password rules • Hacker News Board

Re: Stop forcing arbitrary password rules

#191

Post by Houshalter » Sun, Oct 25, 2015, 12:32 AM UTC

Estragon wrote: post #183

Retric wrote: post #139

Earlier quoted context omitted.

As long as you throttle login attempts short passwords are fine. EX: 6 digit pin on a debit card might seem useless, but if you only get 3 tries per day that's just not an issue. ~10-20 failed attempts per day per IP + some rules to check for multiple IP's per account and 8 lowercase letters - most common passwords is actually reasonable.

> As long as you throttle login attempts short passwords are fine. Not if the password-hash database leaks.

If someone has hacked into your bank, you have bigger problems than the hackers knowing your password.

Re: Stop forcing arbitrary password rules

#192

Post by Someone » Sun, Oct 25, 2015, 1:18 AM UTC

smoothgrips wrote: post #166

Someone wrote: post #91

Earlier quoted context omitted.

Happened to me this week. "Luckily", they also implemented the "feature" where they can send you your password by email directly after you set it, so when I couldn't get in with the password I set, I reset the password, got a mail with a new password, logged in, changed the password to a new random long string, and this timeasked them to send the password to me. The password they sent was chopped off. That told me th…

So, they emailed your password to you? Plaintext? They store passwords in plaintext? Paypal?

directly after you set it

Re: Stop forcing arbitrary password rules

#193

Post by elinchrome » Sun, Oct 25, 2015, 1:45 AM UTC

gravypod wrote: post #155

I also hate companies that won't let you use a space in your password. What kind of crazy stuff is that? Stuff like "I like spaces" would not work.

Maybe it's because spaces are unicode characters and they are worried that their password system isn't unicode compatible.

Re: Stop forcing arbitrary password rules

#194

Post by WhitneyLand » Sun, Oct 25, 2015, 3:14 AM UTC

dagss wrote: post #44

WhitneyLand wrote: post #40

Earlier quoted context omitted.

This sounds a little obsessive. How often are hackers brute forcing a random 16 character hash?

Point is you can use passphrases that are easier for humans to remember, but you then need to measure entropy as numbers of words and size of dictionary and 16 characters is too little. https://xkcd.com/936/

Pass phrases can be a problem because they are attacked using dictionaries just like words are. Choose carefully.

Re: Stop forcing arbitrary password rules

#195

Post by sokoloff » Sun, Oct 25, 2015, 11:20 AM UTC

Retric wrote: post #154

sokoloff wrote: post #145

Earlier quoted context omitted.

Mathematically, but not socially. It means that humans reduce the entropy across the board to (more than, IMO) compensate for the mathematical advantage.

Do you have any data on this? Last I check pick to was a slightly better option.

I don't have any real data. I know my own behavior for "sites I don't care about" and every once in a while I'm exposed to someone else's password (when they tell me their password for a site they don't care about, or where I see a password in plaintext in our shared password manager).

There's an awful lot of "capitalize the first letter" and "replace e by 3, a by 4, o by 0" and "sometimes append a bang". That results in meeting the password complexity rules without any additional entropy in the first 2 rules and 1 bit of entropy for the last rule.

Re: Stop forcing arbitrary password rules

#196

Post by JoeAltmaier » Mon, Oct 26, 2015, 12:54 PM UTC

just_curioussss wrote: post #170

JoeAltmaier wrote: post #118

Earlier quoted context omitted.

Right, for word choice it is significant. I was thinking, rejecting the whole password pattern.

By rejecting a certain pattern you weakening the whole password scheme. It is no longer random, it is human chosen. An attacker can under certain circumstances exploit this behavior. For example, if they notice you are picking shorter words or words that consist of certain characters, they will have an easier time to crack the password. Whole categories or patterns can be rejected because of that, reducing the search…

Curious notion. So, if a guy got that "human chosen" pattern randomly, they got rooked? He has a very breakable password, while the rest of us got good ones? Sounds like the whole algorithm is busted.