Dumb Password Rules • Hacker News Board

Re: Dumb Password Rules

#31

Post by Nadya » Mon, Dec 05, 2016, 4:40 PM UTC

pilif wrote: post #6

Some of the restrictions of special characters I can somewhat understand: Depending on the keyboard layout, many of these often disallowed characters require proper right-alt support to be set up in order to be typed. People tend to get these wrong or to be unaware of the currently set keyboard layout which will cause support issues. Same goes for non-ASCII characters where this also depends on the browser configurat…

What? If a person is using a password that contains such a character, they'll know how to type it or at least find it to copy/paste...

QWERTY isn't the only keyboard layout. Nor do you need right-alt support to type things like é or ç, you just need to enable the US-International Keyboard layout (on Windows, I'm sure equivalents exist for other operating systems).

>Case in point is me setting up new linux boxes and always using a safe initial password (long but pure ASCII) knowing that I'can't be absolutely sure I've configured the keyboard layout correctly.

That is smart for an initial password that you change once you know your keyboard is configured properly. A temporary password while spinning up a new machine isn't too big of a security deal if you're going to be changing it within a few hours anyways.

Re: Dumb Password Rules

#32

Post by nobodyshere » Mon, Dec 05, 2016, 4:40 PM UTC

jjawssd wrote: post #10

nobodyshere wrote: post #9

Earlier quoted context omitted.

Could be shorter.

Passw0rd

Now that's what I call security.

Re: Dumb Password Rules

#33

Post by lorenzhs » Mon, Dec 05, 2016, 4:42 PM UTC

My bank limits passwords to at most 5 alphanumerical characters. Yup. Five. There are over ten times more possible customer IDs (10 digits) than passwords.

Re: Dumb Password Rules

#34

Post by vinay427 » Mon, Dec 05, 2016, 4:43 PM UTC

lorenzhs wrote: post #33

My bank limits passwords to at most 5 alphanumerical characters. Yup. Five. There are over ten times more possible customer IDs (10 digits) than passwords.

Out of curiosity, what bank is this?

Re: Dumb Password Rules

#35

Post by ryandrake » Mon, Dec 05, 2016, 4:45 PM UTC

Something I've always disliked about password rules is the "special" treatment of special characters. What makes one character special and not another? Is % special? Why? Can I use ½ in my password and have it count as a special character? How about 特别? What about Ѕ, Κ, and о? Does "special" mean non-ASCII, non-alphanumeric, not-on-the-keyboard or something else? Why is it that sometimes some "special" characters are allowed and others are not, even if they're right next to each other on the keyboard? Why require one? Is "P@ssword" really better than "correct horse battery staple"?

Re: Dumb Password Rules

#36

Post by 0XAFFE » Mon, Dec 05, 2016, 4:47 PM UTC

Popular German bank „Sparkasse“ has this great online banking system that allows you only 5 characters (Small and large, numbers, umlauts and eszet[1]). They call it a PIN (Personal identification /number/), but IMO its terribly insecure.

[1] https://en.wikipedia.org/wiki/%C3%9F

Re: Dumb Password Rules

#37

Post by lorenzhs » Mon, Dec 05, 2016, 4:48 PM UTC

vinay427 wrote: post #34

lorenzhs wrote: post #33

My bank limits passwords to at most 5 alphanumerical characters. Yup. Five. There are over ten times more possible customer IDs (10 digits) than passwords.

Out of curiosity, what bank is this?

The Sparkassen in Germany do this, but they're not alone in doing so. They lock you out after a couple of attempts, so brute-force is out, but it's still dumb.

Re: Dumb Password Rules

#38

Post by neohaven » Mon, Dec 05, 2016, 4:49 PM UTC

raesene6 wrote: post #19

laurencei wrote: post #14

Earlier quoted context omitted.

There is a specific reason for having "cant reuse last X number of passwords" combined with having an "expiring password" rule. The idea is that if someone was silently in your account, and doing a "stealth" attack - then they could change your password, then change it back to your original password, thus "resetting" your expiring password timer, giving them more time in the system - and you would not know that the p…

err in that attack how do they know your original password to change it back? and if they know your password to change it back why bother changing it in the first place, why not just log in as you? AFAIK the reason for password history is where periodic password change is enforced, to prevent a user from just alternating between two passwords. enforced periodic password change is (in the general case) not great for s…

Let's say a service does not require you to change the password. You are then "compromised once, compromised forever", at least until you change the password.

Let's say it requires you to change it every month. You are compromised at max for a month, right? If the attacker changes the password, you will notice, and make a different password, which will lock them out since they don't know the new one. So they won't change it, but they will lose access next month. This is good...

Except if you allow repetitions of old passwords. In this case, the attacker can change your original password to 'aaaaaaaa' for a moment and re-change it back to the original one, which will reset the "one month" timer, leaving them with access. Until you change it, but the platform won't bother you with it since the timer never expires.

Re: Dumb Password Rules

#39

Post by a_c » Mon, Dec 05, 2016, 4:49 PM UTC

Related. One local bank I've used forbid typing out password on keyboard. They provide a virtual keyboard and you have to click your keys one by one.

Re: Dumb Password Rules

#40

Post by [deleted] » Mon, Dec 05, 2016, 4:50 PM UTC

morganvachon wrote: post #29

blowski wrote: post #13

Earlier quoted context omitted.

Usually, there is some legacy system behind the scenes that can't be updated because reasons. Not an excuse, but it isn't always that easy.

I wonder if another reason may be the differences between traditional PCs and mobile devices with virtual keyboards. I've seen special characters that are two taps away on my phone that I'd have to look up an Alt code for on my PC.

[deleted]