Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

251–260 of 447 posts

Re: I hate password rules

#251

Post by er4hn »

bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

On the plus side, it also gave you plausible deniability it really was you if you wanted to do something illegal or unethical.

Re: I hate password rules

#252

Post by jaywalk »

cactus2093 wrote: post #247
eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

Why do basically zero companies seem to follow this? Banks and airlines are of course some of the most egregious offenders, but even tech companies like Apple and FB have complexity requirements on capital letters and numbers. Surely the login security teams at these companies are aware of the NIST recommendations. Yet a tiny 3 person startup launching a simple crud app is more likely to google the NIST requirements…

Big companies have big bureaucracies and third-party auditors that define stuff like this. Getting them to change their requirements is a herculean task.

Re: I hate password rules

#253

Post by hannasanarion »

NoGravitas wrote: post #149
dataflow wrote: post #63

Earlier quoted context omitted.

Can I ask what length your passwords are (roughly)? I don't understand the motivation for anything long in the context of randomly generated passwords for websites. 8-10 characters should be plenty. (This isn't to excuse silent truncation.)

"correct horse battery staple" is 28 characters. And it really should be two words longer than that these days.

20 characters is fine. Even using only lowercase letters, in a worst-case scenario it'll take millions of years to guess by choosing characters, and a dictionary attack won't fare any better if you use four words that are moderately rare. Even if they're only in the top 1000, four words means the search space is 1 trillion guesses. Increase the search space to 10,000, by including such obscure words as "villager" and "conserve" and "missionary" (9950, 9973, and 9991, respectively) the search space increases to the quadrillions, equivalent of a 12-character random password with symbols, 53 bits.

Is correct-horse-battery-staple guaranteed secure to the heat death of the universe? No, but good enough that it'll take a targeted attack several months to guess.

Re: I hate password rules

#254

Post by skeaker »

cactus2093 wrote: post #247
eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

Why do basically zero companies seem to follow this? Banks and airlines are of course some of the most egregious offenders, but even tech companies like Apple and FB have complexity requirements on capital letters and numbers. Surely the login security teams at these companies are aware of the NIST recommendations. Yet a tiny 3 person startup launching a simple crud app is more likely to google the NIST requirements…

I'd imagine that for at least some of them it has to do with appearance. "Facebook is so secure! It's got ten whole password requirements!"

Re: I hate password rules

#255

Post by gregmac »

Andrew_nenakhov wrote: post #204

I also hate when they force you to change passwords from time to time and forbid you to set one of your previous passwords. One particular offender is russian website HeadHunter [1]. I hope such people will go to very special hell after they die. [1]: https://hh.ru

I've asked IT people that set these policies to tell me their previous password -- after all, they changed it to something completely different, as per policy, right??

No one has ever agreed to this.

Re: I hate password rules

#256

Post by wruza »

kibwen wrote: post #147
crooked-v wrote: post #84

Earlier quoted context omitted.

I have multiple financial accounts that still insist on using public-knowledge security questions (which of course I've given fake answers saved in my password manager) instead of just letting me set up proper 2FA. It's infuriating.

Treating security questions like passwords and saving them in your password manager is correct, but make sure that your fake answers aren't autogenerated nonsense like ":s^Twd.J;3hzg=Q~". Many password reset flows involve communicating a security question over the phone, and it's easy enough for an attacker to guess "oh, it's just a bunch of random characters lol" and for the phone rep to just laugh and shrug their s…

Maybe “:s^Twd.J;3hzg=Q~ if I don’t spell it, it’s not me”?

Re: I hate password rules

#257

Post by [deleted] »

dataflow wrote: post #217
singlow wrote: post #103

Earlier quoted context omitted.

I guess you assume that everyone protects their stored hashes.

Not really. Even if you're worried about that, (36 alphanumeric + 10 symbols)^10 is roughly 4E16. Even at 2B checks/second/CPU (which is incredibly generous if the web developer has any competence) that's around 10M CPU-seconds, i.e. 115 CPU-days. For cracking one single password . An ASIC will speed it up, but again, remember this is one single password, and it can be an overestimate by like a factor of > 1 million…

[deleted]

Re: I hate password rules

#258

Post by jaywalk »

bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

This level of negligence should be criminal.

Re: I hate password rules

#259

Post by er4hn »

cactus2093 wrote: post #247
eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

Why do basically zero companies seem to follow this? Banks and airlines are of course some of the most egregious offenders, but even tech companies like Apple and FB have complexity requirements on capital letters and numbers. Surely the login security teams at these companies are aware of the NIST recommendations. Yet a tiny 3 person startup launching a simple crud app is more likely to google the NIST requirements…

Inertia and other standards are a big force here.

The NIST standards recommending this (SP 800-63B I believe, under "memorized secrets") came out in around 2017, many years after large companies had settled on prior standards. Prior standards were closer to what banks / other biggies were doing and they just kept on doing it. In addition you may have other non US govt policies (UK for example likes to publish policy docs, see: https://www.ncsc.gov.uk/collection/passwords/updating-your-a... for their slightly different modern take) which the company prefers to use because of either their own HQ location or large customer pull.

Better yet many different countries requirements and a couple industry docs are cobbled together into a frankenstein set of requirements. That requirements docs is then treated as though it came from Mount Sinai and should not be altered without getting the approval of 3 senior VPs, a professor of cryptography, and the head of IT.

Re: I hate password rules

#260

Post by mixmastamyk »

watwut wrote: post #142
greggman3 wrote: post #139

Earlier quoted context omitted.

I guess you don't travel much. it's very common to have internet but not cell service (so no SMS). it's also common to buy a local sim so effectively no SMS or at least not the one you have registered. So no, SMS is not perfectly good. it's crap and needs to die in a fire.

I used to travel a lot and the exact combination of no signal and internet was not frequent at all.

The other part was under another mobile system, say in another country. Can calls/texts find your phone today overseas at a reasonable price?

I know that frequencies are different in some parts.

Post reply on HN