Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hate password rules

schneier.com

Post reply on HN
Print view View original

331–340 of 447 posts

Re: I hate password rules

#331

Post by pwillia7 »

ysavir wrote: post #214
gonehome wrote: post #80

Earlier quoted context omitted.

I'm not sure why anyone uses banks like BoA, Wells Fargo, First Niagara, etc. Fidelity is a superior experience in nearly every way - just categorically. I'm not sure if people just don't know that you can use Fidelity this way? The only downsides are no local branches, but that's hardly an issue unless you need a cashiers check. In those rare cases you can spin up an account at shitty bank, get the check, then close…

In what way? I'd be curious to understand what it is you value about them, but your post reads more like marketing than a satisfied customer story.

I fully agree. The difference is the value exchange. At a normal bank they just want to charge you fees because you cost them money. Fidelity lets you keep your money with them in the hopes that as you grow your money, you'll spend it on their investment products, which I imagine everybody does.

Most brokers have some kind of cash account and they're always better than banks and almost always better than credit unions.

I recommend keeping a credit union account open too so you have a local branch if you need something in person.

Re: I hate password rules

#332

Post by kortex »

otagekki wrote: post #320

I used to have those: 8-24 characters among which 1 uppercase/lowercase, 1 special character among a whitelist, and renew that every 2 months. At renewal, must be different from all your previous passwords and the new password must be at least 3 character different from last one. SSH keys can't be used per security policy and the same rule has been applied to the password manager. A pain. And yes the most annoying is…

> and the new password must be at least 3 character different from last one.

Does this sort of rule imply that they are saving passwords whole (either plaintext or encrypted, as opposed to hashed)? I can understand "can't match your last N passwords" cause that's just saving old hash entries. But editdistance(old, new) < 3 implies you know the string value somewhere.

Re: I hate password rules

#333

Post by noah_buddy »

tenebrisalietum wrote: post #268
bsuvc wrote: post #242

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…

Well, was the Excel spreadsheet accessible to everyone? If not, this model could work in some strange way - if someone needs access to your computer, they are provided the password, then it is changed and you and password custodian now have a password not known by everyone else. One side effect of this is that if you know someone else has the password, you're probably very unlikely to do any personal business on that…

There has got to be a better way, namely, not an excel spreadsheet (maybe vault or LastPass) and not the individual employee's account (e.g. have an IT super user account).

Re: I hate password rules

#334

Post by croutonwagon »

mumblemumble wrote: post #307
wruza wrote: post #256

Earlier quoted context omitted.

Maybe “:s^Twd.J;3hzg=Q~ if I don’t spell it, it’s not me”?

Will probably work about as well as that time when I was young and decided to spend about a week signing all receipts with a signature that looks nothing like my usual one, just to see if it would ever be challenged. Many people are, contrary to all pretense, mostly paid to not give any actual fucks.

I once signed STOLEN on a pad at the grocery checkout. They let it ride and ran the charge.

But I was relieved to find my CC provider calling me to verify I was just up to shenanigans.

I was also curious how many thieves they had run across that signed for purchases as stolen in large cap letters.

Re: I hate password rules

#335

Post by otagekki »

kortex wrote: post #332
otagekki wrote: post #320

I used to have those: 8-24 characters among which 1 uppercase/lowercase, 1 special character among a whitelist, and renew that every 2 months. At renewal, must be different from all your previous passwords and the new password must be at least 3 character different from last one. SSH keys can't be used per security policy and the same rule has been applied to the password manager. A pain. And yes the most annoying is…

> and the new password must be at least 3 character different from last one. Does this sort of rule imply that they are saving passwords whole (either plaintext or encrypted, as opposed to hashed)? I can understand "can't match your last N passwords" cause that's just saving old hash entries. But editdistance(old, new) < 3 implies you know the string value somewhere.

Not necessarily, I forgot to mention that when changing your password through their UI you still have to enter your old password. So it's safe to assume that the string comparison is made at form submission. For history rule I don't want to imagine it being implemented otherwise.

Re: I hate password rules

#336

Post by fomine3 »

eckesicle wrote: post #51

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

I got new worse policy in this November: at least 14 chars, must have all UPPER,lower,number,symbol chars, change every 3 months. Of course no MFA.

Re: I hate password rules

#337

Post by kortex »

jjice wrote: post #163

I hate seeing websites that have odd restrictions like "you can use !, ?, #, and @, but not % or ^". I can't think of a reasonable reason.

Bad sanitization, or fear thereof. You should not be inserting raw passwords into databases, nor should you be interpolating raw queries, but people used to, all the time, so these restrictions may have stuck.

But yeah it does not bode well for their security appearance.

Re: I hate password rules

#338

Post by johannes1234321 »

MomoXenosaga wrote: post #183
kylebyproxy wrote: post #112

Earlier quoted context omitted.

I can't say how common this is, but many (most?) online accounts I personally interact with are disposable, represent no sensitive information, and I couldn't care less if they're compromised. They're one-time sign-ups, junk accounts, free trials, free tiers, etc. > one of the most frustrating experiences I understand this frustration as a mismatch between the user's non-expectation of security and the service's obey…

Yes every service considers itself critical. But users don't give a shit if some forum they signed up for 3 years ago gets hacked. For me I just see it as a sign of pretentiousness when you expect me to come up with a 20 character password. Luckily Firefox has a built in password generator now.

> But users don't give a shit if some forum they signed up for 3 years ago gets hacked.

It depends on the forum and the hacker. Most hacks won't have a practical implication, but a targeted attack by somebody unhappy with your comments might abuse your identity or information the account reveals.

Or a forum can reveal information you don't want to have revealed (medical help forums, sexual stuff, ...)

And sometimes you are really to leave "child times" behind you, which might reach surface again later. (Say when you get into a political career ten years later and somebody finds your mail address and searches through dumps of leaked data etc.)

Re: I hate password rules

#339

Post by mastazi »

Today Brave browser launched a new version of their built-in crypto wallet.

There is an option to keep using the same password in the new version, when I select that option, an error message comes up saying my password is not secure[0], even though it is[1].

Basically the Brave devs can't even agree with their past selves about password security.

[0] https://ibb.co/ch9GGm8

[1] https://xkcd.com/936/

Re: I hate password rules

#340

Post by lmm »

m-p-3 wrote: post #308

I hate those requirements, but if at least they were enumerated in a programmatic manner, for example through a RegEx or password field parameters then a password manager could read those and offer a generated password that fits those requirements.

If you're going that far you might as well ask browser makers to make a non-awful UI for client certificates and avoid the whole password problem in the first place.
Post reply on HN