Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dumb Password Rules

github.com

Post reply on HN
Print view View original

71–80 of 86 posts

Re: Dumb Password Rules

#71

Post by tacostakohashi »

tzs wrote: post #70
tacostakohashi wrote: post #24

I use KeePass to store all of my (randomly generated) passwords. One ongoing annoyance is that it's increasingly difficult to generate a random string will be meet a given site's Dumb Password Rules, because so many sites have them, and there's surprisingly little overlap in the rules. I would really like to see a database of sites and their corresponding Dumb Password Rules, so that I can tell KeePass (or any other…

What I think we need is a standard for documenting password requirements and restrictions on the password entry page itself, in a format that is easily parsed and understood by software. Password managers that have browser integration could then use this to generate passwords acceptable to the site. For password managers without browser integration, I bookmarklet could be developed that extracts the password format i…

You think that sites that are unable to come up with sensible password rules will be able to get this right, on a large enough scale to make it useful?

In terms of the metadata, you've more or less covered it, but the only way it has a hope of being useful is if it's provided by some community-minded third party.

Re: Dumb Password Rules

#72

Post by dawnerd »

aggie wrote: post #51
dawnerd wrote: post #41

I created an issue for this, but one really dumb thing is inconsistent password verification. Bestbuy will let you use anything for a password but on login really long passwords will trip it up. Been able to reproduce it a few times with 64 character passwords generated from 1pass.

Why use a 64-character password? This post suggests more than ~21 random characters (128 bits) doesn't get you extra (practical) security: https://security.stackexchange.com/questions/33196/is-there-...

No good reason other than they let me. My thinking is, if you're going to let me put anything in then your system should work with that. If it's going to break at n characters then cap the length.

Re: Dumb Password Rules

#73

Post by tzs »

tacostakohashi wrote: post #71
tzs wrote: post #70

Earlier quoted context omitted.

What I think we need is a standard for documenting password requirements and restrictions on the password entry page itself, in a format that is easily parsed and understood by software. Password managers that have browser integration could then use this to generate passwords acceptable to the site. For password managers without browser integration, I bookmarklet could be developed that extracts the password format i…

You think that sites that are unable to come up with sensible password rules will be able to get this right, on a large enough scale to make it useful? In terms of the metadata, you've more or less covered it, but the only way it has a hope of being useful is if it's provided by some community-minded third party.

The person coding the webpage usually isn't the person who made the stupid password rules, so if putting in this metadata was considered industry best practice I think there is a decent chance it could become widespread.

Re: Dumb Password Rules

#75

Post by Sohcahtoa82 »

ryandrake wrote: post #35

Something I've always disliked about password rules is the "special" treatment of special characters. What makes one character special and not another? Is % special? Why? Can I use ½ in my password and have it count as a special character? How about 特别? What about Ѕ, Κ, and о? Does "special" mean non-ASCII, non-alphanumeric, not-on-the-keyboard or something else? Why is it that sometimes some "special" characters are…

When it comes to not allowing the usage of certain punctuation, I've always assumed it's because the person who wrote the code doesn't know how (or doesn't trust themselves) how to prevent injection so they just forbid the usage of characters that can be used for injection.

Re: Dumb Password Rules

#76

Post by duffn »

0XAFFE wrote: post #36

Popular German bank „Sparkasse“ has this great online banking system that allows you only 5 characters (Small and large, numbers, umlauts and eszet[1]). They call it a PIN (Personal identification /number/), but IMO its terribly insecure. [1] https://en.wikipedia.org/wiki/%C3%9F

This is the second time I've now heard of this since starting the repo. I cannot believe an online financial institution allows this.

Feel free to submit a PR if you like.

Re: Dumb Password Rules

#77

Post by duffn »

adrr wrote: post #20
choward wrote: post #7

My favorites are the ones where you can't use more than a certain number of characters or where you can't use special characters.

Amex website had their max password length of 8 characters. Not sure if they changed it. Even if you do have a system constraint, you could just lop off the extra characters and the user wouldn't probably never notice.

According to the screen shot in the repo, it's not even case sensitive either.

Re: Dumb Password Rules

#78

Post by 0XAFFE »

duffn wrote: post #76
0XAFFE wrote: post #36

Popular German bank „Sparkasse“ has this great online banking system that allows you only 5 characters (Small and large, numbers, umlauts and eszet[1]). They call it a PIN (Personal identification /number/), but IMO its terribly insecure. [1] https://en.wikipedia.org/wiki/%C3%9F

This is the second time I've now heard of this since starting the repo. I cannot believe an online financial institution allows this. Feel free to submit a PR if you like.

@duffn is ok if its in german?

Re: Dumb Password Rules

#79

Post by duffn »

0XAFFE wrote: post #78
duffn wrote: post #76

Earlier quoted context omitted.

This is the second time I've now heard of this since starting the repo. I cannot believe an online financial institution allows this. Feel free to submit a PR if you like.

@duffn is ok if its in german?

Sure. If you could also provide a description in English as well I think that would be helpful. Here's a non-English example: https://github.com/duffn/dumb-password-rules#movistar

Re: Dumb Password Rules

#80

Post by pilif »

Nadya wrote: post #31
pilif wrote: post #6

Some of the restrictions of special characters I can somewhat understand: Depending on the keyboard layout, many of these often disallowed characters require proper right-alt support to be set up in order to be typed. People tend to get these wrong or to be unaware of the currently set keyboard layout which will cause support issues. Same goes for non-ASCII characters where this also depends on the browser configurat…

What? If a person is using a password that contains such a character, they'll know how to type it or at least find it to copy/paste... QWERTY isn't the only keyboard layout. Nor do you need right-alt support to type things like é or ç, you just need to enable the US-International Keyboard layout (on Windows, I'm sure equivalents exist for other operating systems). >Case in point is me setting up new linux boxes and a…

> What? If a person is using a password that contains such a character, they'll know how to type it or at least find it to copy/paste...

I have had to deal with people not being able to type their passwords because a character wasn't on their current keyboard of choice (some people use iPads and don't know how to type a # for example)

> you just need to enable the US-International Keyboard layout (on Windows, I'm sure equivalents exist for other operating systems)

you're giving way too much credit to the knowledge of the average computer user.

Post reply on HN