Password Rules Are Bullshit

I have an uncommon name spelling and I still get misdirected emails.

Not to the extent of the above, but for instance, last year I received someone's job offer in Colorado. I did respond to the sender to let them know of the mistake of course.

This is perhaps not the place for this, but as a user of a password manager, here's and idea in this area that I've had for a while.

I'd like the various password manager vendors to get together and produce a standard/specification to take us (users) out of the process of registering and rotating passwords as much as possible in much the same way that they have the login process. Among other things, the spec should define a format for expressing password validation rules, a password rotation endpoint/policy, common registration fields and a url handler for triggering the registration process.

So then site operators could add a "Register with a Password Manager" link that, perhaps, looked like: "register://example.com/path/to/registration/policy.json" The various browser extensions could easily recognize that and change to "Register with 1Password" or "Register with LastPass" or whatever is appropriate. That policy document would have the registration endpoint, rotation endpoint, rotation period, password rules, required registration fields, what sort of identifier is used (username, email, etc), terms of service and possibly and endpoint for determining the uniqueness of potential usernames. Clicking the link would open up the password manager where the user would agree to the terms of service, enter any missing fields, approve the sending of fields the password manager already knows about and select a username, if necessary. Once completed, the password manager would generate a legal password of maximum length/complexity, send everything to the registration endpoint and save the login details, terms of service and rotation endpoint for future use/reference. Over time, the password manager could update the password in the background to limit the danger should the password be compromised.

I'm curious whether others think this could work. I realize there's an http://xkcd.com/927 problem in it, but it seems like if all the password manager applications could agree to work together, enough site operators would be willing to implement it that it could be useful. And if enough people saw "Register with a Password Manager" links during the registration process, they might get curious enough to start using one. But most of all, I'd like to stop having to care about what a site's password policy is...just let sites make the decision and offload the responsibility for adapting to it to my password manager.

Password managers suck as soon as you need to share a password - like the password for a SaaS admin panel used by several people at a business. Not all services support multiple users (or multiple admin) users.

Instagram does this. They let anybody sign up for an account using any email address, and the account is immediately live. While they send a verification email, you don't have to click on it to still use the account. And most likely if you hadn't signed up for the service you'd think it's a phishing attempt and ignore it anyways.

I found this out the hard way when someone else had created an account under my email address and because some of my friends had uploaded their address book, my friends were following this stranger, perhaps thinking it was me. When I eventually did choose to sign up, I had to jump through a bunch of hoops just to be able to use my own email address.

>only 5 of the top 25 passwords are 10 characters, so if we require 10 character passwords, we've already reduced our exposure to the most common passwords by 80%.

That's not an accurate measure. Like, take two of the example common passwords: 123456789 and 1234567890. What do you bet that the people who'd pick the first would pick the second if they had to use 10 characters? Plus, attackers don't have to try passwords that fail your requirements.