Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

261–270 of 447 posts

Re: I hate password rules

#261

Post by bananasbandanas »

nzach wrote: post #74
reaperducer wrote: post #37

Earlier quoted context omitted.

The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me Or worse, they truncate your password after you've already used it for years and years. I had a 30-character password with Bank of America. Somewhere along the line, it changed its password requirements to only allow a maximum of 20 or 25 characters (I forget), which automatically invalidated m…

>Or worse, they truncate your password after you've already used it for years and years. Worse than that must be the sudden realization that your bank probably saves your password in plain text somewhere.

More likely they just updated the password during a successful login.

Re: I hate password rules

#262

Post by teekert »

I have seen sites where I can happily enter a 25 char long random string but then you can’t log in. A lot of trial end error and it turns out they simply truncate at 16 chars :s

Re: I hate password rules

#263

Post by [deleted] »

eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

[deleted]

Re: I hate password rules

#264

Post by mixmastamyk »

OskarS wrote: post #143
uncletammy wrote: post #132

Earlier quoted context omitted.

Anything requiring my phone number or a binary that runs on my phone is a deal breaker for me. It has massive privacy implications. We desperately need to have better MFA options if we're going to require it from users.

> or a binary that runs on my phone is a deal breaker Phone numbers, fair enough, but TOTP is an open standard and there are plenty of open source implementations for the client side. It’s also available in most password managers (I use 1passwords implementation). “MFA can’t require me to run a binary on my phone” is a bit extreme. TOTP is fine.

FYI: https://en.wikipedia.org/wiki/Time-based_One-Time_Password

Re: I hate password rules

#266

Post by thamer »

robotears wrote: post #14

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

Worse: I once set my E*Trade password to something it accepted but wouldn't recognize when I tried to log in… because it was too long.

After changing it I got locked out of my account and had to call support to resolve the issue. The worst part was that after verifying my identity over the phone they kept sending me reset links and I kept using long passwords generated by 1Password (30 characters IIRC) and it always accepted them when resetting but still would never let me log in.

It took many attempts and new reset links until they suggested trying a shorter password, which was eventually accepted both during reset AND login. Of course the reset page didn't mention a maximum length.

Re: I hate password rules

#267

Post by helmsb »

It also doesn't help that the complexity rules are inversely proportional to the importance of the application.

My former mortgage company's password requirements were 8 characters max, no special characters.

The app for scheduling appointments at my barber (no payment info) requires a minimum 12 character password with 2 or more special characters, 2 or more uppercase characters and 2 or more numbers.

Re: I hate password rules

#268

Post by tenebrisalietum »

bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

Well, was the Excel spreadsheet accessible to everyone? If not, this model could work in some strange way - if someone needs access to your computer, they are provided the password, then it is changed and you and password custodian now have a password not known by everyone else.

One side effect of this is that if you know someone else has the password, you're probably very unlikely to do any personal business on that machine.

Re: I hate password rules

#270

Post by Galxeagle »

cactus2093 wrote: post #247
eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

Why do basically zero companies seem to follow this? Banks and airlines are of course some of the most egregious offenders, but even tech companies like Apple and FB have complexity requirements on capital letters and numbers. Surely the login security teams at these companies are aware of the NIST recommendations. Yet a tiny 3 person startup launching a simple crud app is more likely to google the NIST requirements…

I’ve actually raised with a security executive in my large consulting firm - the biggest blocker is apparently that requirements like frequent forced password changes are written in to many contracts signed with clients as boilerplate ‘we promise to do x/y/z practises to keep your data secure’. Newer contracts have much better language and there have been some improvements that way (our reset period duration tripled recently), but it takes time to trickle through.
Post reply on HN