Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

201–210 of 447 posts

Re: I hate password rules

#201

Post by yread »

eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

How to practically check for common passwords? Ideal would be to have like the most common 1/1000th of the hibp so that it's not too big for deployment in some clever structure (compressed trie? bloom filter?). I don't trust 3rd party services.

Re: I hate password rules

#202

Post by [deleted] »

godshatter wrote: post #122
Arrath wrote: post #88

Earlier quoted context omitted.

I was working my way to it, when IT rolled out a new policy of "cannot share more than 2 consecutive characters with a previous password" or something like it, included in an email along the lines of "an audit has found this new policy applies to you". Dicks.

Doesn't that imply that the are saving your previous passwords in plain text somewhere instead of saving hashes of them? How is this more secure?

[deleted]

Re: I hate password rules

#203

Post by tmountain »

bluGill wrote: post #121
Ajedi32 wrote: post #92

Earlier quoted context omitted.

Yeah, at least there's a good work-around for the numbers/symbols requirement. What's more annoying is when sites have a low maximum length so you _have_ to use special characters to get good entropy, or when they have other bizarre requirements like "can't contain more than 3 of the same character".

Todays computers can brute force passwords of their maximum length in a few hours. I suppose someone somewhere has a maximum length that is hard to brute force, but I've never seen it.

What max length? Once a password reaches 128 bits of entropy the key space is unfathomably large. You could have a password of length 1 with 10^100 possible values, and it could take a VERY long time to crack. In short, it has nothing to do with length, it has to do with bits of entropy, and there are still very real limits to what even the most powerful computers can brute force. Several years back, it was stated by Peerio that an 81-bit password would cost a billion dollars to crack. It becomes less feasible and more expensive from there.

Re: I hate password rules

#205

Post by iso1631 »

alliao wrote: post #199
qwertox wrote: post #185

I had a 16 character password which I used in an PC online-banking application. After an update the password was unable to unlock the database. So I started creating new databases with different passwords to see what was going on, and it turned out that all passwords longer than 10 characters were failing. So I truncated my old password to 10 characters and then it worked. No hint, no nothing in the release notes.

yikes? that means they knew your password therefore able to truncate it to 10 characters?!

Not neccersarily, if the previous version truncated the passed password to 10 characters, hashed, then stored, but the new version no longer truncated, the hash wouldn't match unless you used 10 characters

if your password was qwerty123456, it might have allowed you in with qwerty1234999

Re: I hate password rules

#206

Post by iso1631 »

nzach wrote: post #74
reaperducer wrote: post #37

Earlier quoted context omitted.

The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me Or worse, they truncate your password after you've already used it for years and years. I had a 30-character password with Bank of America. Somewhere along the line, it changed its password requirements to only allow a maximum of 20 or 25 characters (I forget), which automatically invalidated m…

>Or worse, they truncate your password after you've already used it for years and years. Worse than that must be the sudden realization that your bank probably saves your password in plain text somewhere.

As it's a bank that's probably the case, but you could have a change on the server side from

  hash($password) == $storedhash
to

  hash(substr($password,0,20)) == $storedhash
And you wouldn't get in, with any password (including just putting in the first 20 characters)

Re: I hate password rules

#207

Post by iso1631 »

dataflow wrote: post #63
robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Can I ask what length your passwords are (roughly)? I don't understand the motivation for anything long in the context of randomly generated passwords for websites. 8-10 characters should be plenty. (This isn't to excuse silent truncation.)

If you're using a random password, c29b90b0e25ece3f2dabcef496d22103 is fine for a password, 2^128 bits. It's a right pain to type in on a console though.

On the other hand, "rundown skyline pluck shawl pastrami radar refueling poach prankster durable" is far easier to type and is about the same entropy

Re: I hate password rules

#208

Post by reaperducer »

gonehome wrote: post #128
reaperducer wrote: post #125

Earlier quoted context omitted.

You state that you don't understand why people use large, complex banks. Then state that you have a very simple, financially uninteresting life. You answered your own question.

I have a pretty complex financial situation, but Fidelity can just do all of it more easily than retail banks. Is there something banks like BoA do better that I'm missing? When I've asked people I know this I haven't gotten any good answers. I'm genuinely asking. My impression is that BoA, Wells Fargo, etc. mostly take advantage of customers that don't know better options exist.

Your impression may come from the fact that many people don't talk openly about their finances to random people on the internet.

For me, Fidelity is a non-starter, for reasons that are none of your business.

It's nice that you like Fidelity. But it's a good idea to recognize that your finances and life situation are unique to you.

Re: I hate password rules

#209

Post by rudian »

scrooched_moose wrote: post #78
kspacewalk2 wrote: post #16

Due to the nature of my job and the age of some of my coworkers, I am sometimes casually given passwords on a piece of paper. Out of a sample size of conservatively 20, I have never even once (!) seen a special character other than !. It just doesn't happen. Password rules and a requirement to change your password every X months are pure security mirage and just create frustration in people who often struggle to gene…

Sounds like we have similar roles. I've never gotten them on paper, but multiple times a month I get emails along the lines of "My account doesn't work. My password is Banana1. Please fix". Every time I reset every single password they have (at least 4 hours of work for them) and inform them not to share passwords. Still, I've had users do it multiple times. I finally got all of our admin/root passwords into a passwo…

Congrats on getting them to use a password manager, now everyone can see all of their password by typing in the master password they stuck to the side of the screen.

I'm only half-joking sadly, people just don't understand why password exist in the first place, so they comply maliciously.

Re: I hate password rules

#210

Post by rudian »

My internet-first bank’s passwords are limited to 8 characters. I'd take password rules over this idiocy any day. I reported it maybe 5 years ago and of course radio silence. I bet they plaintext it.

Oh and of course I also have literally 4 different digit-based pins to do operations.

Post reply on HN