Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Rules

portal.cs.oag.state.tx.us

Post reply on HN
Print view View original

91–100 of 157 posts

Re: Password Rules

#91

Post by icebraining »

lucb1e wrote: post #73
angry-hacker wrote: post #45

Earlier quoted context omitted.

Ashamed to admit but I used to "hack" my classmates (girls) hotmail accounts like that when I was young. I tried to recover their password and if I didn't know the answer to their security question (I often did) I just asked... I was curious if they write something about me in their emails, never did...

Simply brilliant. You should submit this together with a security issue report to Facebook and Hotmail and whoever else uses security questions. Do you mind if I quote you (with link) on my blog?

It's also how Kernell "hacked" Sarah Palin's email account: http://en.wikipedia.org/wiki/Sarah_Palin_email_hack

Re: Password Rules

#92

Post by DanBC2 »

Anyone who knows anything know that most people also chose stupid passwords. They know that the stupid password will be used across multiple sites. Those sites might well store the password in plain text or with broken hashing. But those people also know that rule-lists like this one are stupid. Users get frustrated and confused and have to rapidly create a compliant password, which leads to weak passwords that get written down in silly places.

We know all this. We've known all this for many many years.

ID theft (grabbing the first number from a search engine) costs "£2.7 billion per year".

Why are we stuck with dumb archaic authentication systems? Why isn't this space being disrupted?

Re: Password Rules

#93

Post by baddox »

nextstep wrote: post #16
haberman wrote: post #4

Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer I gave to a security question. I bought a house last month, and the biggest thorn in my side throughout all of the financial arrangements was security questions (I'm not even joking). Here's a Facebook status update I posted (I had already been complaining abou…

Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish…

I use pwdhash for all my primary web passwords, but I have a secondary password that I use as my response to all security questions. I think this is a decent solution, but some services (I believe Apple is one example) requires multiple security questions and requires the responses to all be distinct.

Re: Password Rules

#94

Post by aidenn0 »

r00fus wrote: post #68
unfletch wrote: post #42

Earlier quoted context omitted.

I've used 1Password generated passwords for years. You're right, it is awesome, but only until you have to relay one of those generated strings to a support person over the phone: "...left curly brace. No, it's like the parenthesis, but squiggly. Are you using a regular keyboard? Hold shift and type the left square bracket. The square one. It's to the right of the P..." Nightmare.

It's a good point towards passphrases instead. 1Password gladly generates "pronounceable" passwords (e.g. "thax-lers-ponc-werv"). I usually think a bit about whether digits or symbols are required (some services and websites - Skype notably) don't like them. A 20-char passphrase with spaces, dashes, or character-based (e.g. "S") word-boundary delimiter is often good enough to provide excellent (80+ bits) entropy.

Even better is to generate real words. I took a "1000 most common english words" list and reduced it manually to 256 that don't rhyme with other common words and now use that to generate pass-phrases. It's my best solution for English since phonetic spelling isn't a feature of English.

Re: Password Rules

#95

Post by jaybill »

hahainternet wrote: post #75
jaybill wrote: post #27

Earlier quoted context omitted.

I'm pretty sure the password guesser I wrote to give me passwords on terminals in Fallout 3 would easily give me these passwords.

I don't know whether this is cool or sad. Fallout 3 passwords were trivially easy to infer from a single guess. They took extra time to reduce the ambiguity and make it easy once you understood the principle. Were you running a mod?

I think it's probably more on the side of "sad", considering the way I did it. No mods. I wrote a little android app that you could put the words and number of correct letters each try into and it would shorten the list each time you did.

After a while I figured out "the trick" and could do them in my head and didn't need the program anymore. It was a fun little programming exercise, though.

Re: Password Rules

#96

Post by jaybill »

I get annoyed when I can't use spaces, because my general password strategy is to click my link bar shortcut to Random Wikipedia Page, pick five or six words and use that as my password. Easy to remember, hard to guess, even harder to brute force. Thanks XKCD!

I use Keepass to store passwords for the various things I use, and even though my hive is stored on a web server (uses SSL and requires a password, of course) for convenience, it has a well chosen, rotated password and a key file that I carry on a USB stick with my keys. I keep a backup of the key file in a safe physical location.

No two passwords are the same and none is less than 16 characters. One nice thing about Keepass is that you can also store URLs and other arbitrary information in the hive. Should anything ever happen to me, my wife will automatically receive instructions on how to locate and access the hive. (automatic email, dead man switch) Keepass also lets you set reminders so you can regularly change passwords.

Re: Password Rules

#97

Post by X-Istence »

dekz wrote: post #88
Terretta wrote: post #85

Earlier quoted context omitted.

Sorry, "PassworD" doesn't validate. You're missing a symbol, and you have a character repeated. Try "P@s5w0rd" instead. Or, better yet, "abc#1234" as suggested in the examples.

We've moved on to a fictitious setup. I was so disgusted with my bank and their password policies and authentication measures. They too restrict to 8 characters, but they happen to also offer a SecurID token. This token can be used in conjunction with the initial authentication. I would happily switch to any bank where I can know my data is secure. How do we trust them?

I have a student loan that is limited to 8 character passwords. Thing is, when you go to set your password the first time it will happily take the password and use it, good luck getting in though because the next time you go to enter your password the web form truncates it for you (using JavaScript upon submitting)!

Then when you go to reset your password they keep telling you that your password doesn't meet the requirements (the form allows you to type as much as you want) but doesn't tell you about the 8 character password rule. Then when you finally get one that works and you are logged in (12345678 is not a secure password, but apparently that is fine) you go to change your password and this time they will tell you that 8 characters are all that is allowed, but the web form is set to only accept 7 characters, so you have to use the Safari Inspector to change the form to accept 8 characters and submit.

And unfortunately I can't leave them because it is a loan and not just a checking account. Thing is, even I don't know my password anymore, so it is as secure as it can be :P

Re: Password Rules

#99

Post by TylerE »

r00fus wrote: post #68
unfletch wrote: post #42

Earlier quoted context omitted.

I've used 1Password generated passwords for years. You're right, it is awesome, but only until you have to relay one of those generated strings to a support person over the phone: "...left curly brace. No, it's like the parenthesis, but squiggly. Are you using a regular keyboard? Hold shift and type the left square bracket. The square one. It's to the right of the P..." Nightmare.

It's a good point towards passphrases instead. 1Password gladly generates "pronounceable" passwords (e.g. "thax-lers-ponc-werv"). I usually think a bit about whether digits or symbols are required (some services and websites - Skype notably) don't like them. A 20-char passphrase with spaces, dashes, or character-based (e.g. "S") word-boundary delimiter is often good enough to provide excellent (80+ bits) entropy.

Or how about everybody that uses these fucking inane rules just do something sensible - like lock an account out if there are more than 5 failed logins in a row. Using a setup like that even "4321" is probably secure enough. Obviously use a secure hash on the backend as well.

Re: Password Rules

#100

Post by namityadav »

ecoffey wrote: post #63
unfletch wrote: post #42

Earlier quoted context omitted.

I've used 1Password generated passwords for years. You're right, it is awesome, but only until you have to relay one of those generated strings to a support person over the phone: "...left curly brace. No, it's like the parenthesis, but squiggly. Are you using a regular keyboard? Hold shift and type the left square bracket. The square one. It's to the right of the P..." Nightmare.

Heh, yeah luckily I haven't had to do that, but I have chosen some obscene answers to them, and then later had to recite, and spell them out to a horrified Indian call center worker.

I see why you had to mention that the call center worker was "Indian". If you hadn't, your entire statement wouldn't have made any sense. Right?
Post reply on HN