Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Limiting passwords to 12 characters is "secure enough"

forums.stardock.com

Post reply on HN
Print view View original

91–100 of 111 posts

Re: Limiting passwords to 12 characters is "secure enough"

#91

Post by stinky613 »

yarianluis wrote: post #13

This is far from the worst offender. Banks are typically the worst. All sorts of gimmicky password requirements. 8-12 characters. Must have one capital letter. Must have one number. No special symbols. So "I can't believe it's not butter!" won't work, yet that would probably be a pretty secure password, and be entirely rememberable. In fact I could come up with a silly pun-filled sentence for each site I visit and ma…

American Express used to require 6-8 alphanumerics. No more, no less. Fortunately they've upped this to... I think something like 20 characters.

Look, I get that there are other safety factors (I pray) in place to prevent someone from hacking my account (most commonly in the form of login-attempt limits), but that's absolutely no reason to stop me from making my password longer and more complex. If I want my door to have a deadbolt _and_ a chain lock I expect a damn good explanation if someone tells me I can't.

Re: Limiting passwords to 12 characters is "secure enough"

#92

Post by stinky613 »

freework wrote: post #27
yarianluis wrote: post #13

This is far from the worst offender. Banks are typically the worst. All sorts of gimmicky password requirements. 8-12 characters. Must have one capital letter. Must have one number. No special symbols. So "I can't believe it's not butter!" won't work, yet that would probably be a pretty secure password, and be entirely rememberable. In fact I could come up with a silly pun-filled sentence for each site I visit and ma…

My favorite is the eAPIS password requirements: https://eapis.cbp.dhs.gov/help.html#a7 Your password: must start with a number and be between eight and twelve characters in length, and must contain at least one of the following special characters: Cannot include your Sender ID, and Cannot repeat any character consecutively more than two times.

That would make an excellent passphrase

It's funny that the descriptions of password requirements would make much stronger passwords than any password a reasonable person would ever use.

Re: Limiting passwords to 12 characters is "secure enough"

#93

Post by blablabla123 »

kijin wrote: post #85
blablabla123 wrote: post #78

Earlier quoted context omitted.

>Therefore, if your password policy as any more restrictive than [\x20-\xFE]{8,64}, I'm going to assume that you store my passwords in a plain-text VARCHAR field without proper escaping. Alternative interpretation: the Website is neither UTF8-safe (or whatever charset you prefer) nor are prepared statements used. Otherwise VARCHAR is fine even without any escaping.

Sorry, that was supposed to be \x7E but I can't edit anymore. Now you only need to deal with printable ASCII characters.

No problem, I was assuming printable anyway... ;)

I just wanted to point out that it's possible to use VARCHAR even with weird characters.

Re: Limiting passwords to 12 characters is "secure enough"

#95

Post by blablabla123 »

cantos wrote: post #83
kijin wrote: post #18

If a 12-char password is "secure enough" today, then a 16-char password is obviously even more secure and future-proof. Not to mention a 30-char password, or a password that contains more special characters than what your dumb webapp allows. Not to mention that a 30-char purely alphabetic passphrase such as xkcd.com/936 is so much easier to remember (i.e. less likely to be written on a post-it note) and type into tod…

Here are two real world issues that could arise http://vbuterin.blogspot.ca/2011/08/password-strength-rebutt... I think some cryptographers and security people have given rebuttals as well but I can't find them at the moment.

> Here are two real world issues that could arise

Definitely true.

On the other hand, non-tech folks often don't even make an attempt to remember password an put them on sticky notes in front of the screen. (At it can still get worse...) I think for these people long alphanumeric passwords are the best.

Re: Limiting passwords to 12 characters is "secure enough"

#96

Post by KMag »

linhat wrote: post #64

I'm not so sure anymore about the password length limitations (or any other weird password requirements for that matter). For the longest time I was wondering why my bank would ONLY allow a 5 digit password, alphanumerical only and it MUST contain at least one letter as well as one number, while they let you choose your own username completely free of any restrictions, including special characters. After thinking abo…

You are incorrect. The policy is that users get locked out after 3 attempts... until attackers get smart enough to bruit force through the usernames, 3 wrong passwords each.

80% of the customers getting locked out of their bank accounts at 5 PM on a Friday only happens once before the bank changes policies to something that allows the attackers to perform a rate-limited attack on the 5-character passwords. The new lockout policy goes into effect before the bank can force everyone to upgrade their passwords.

GAME OVER

Re: Limiting passwords to 12 characters is "secure enough"

#97

Post by Jayschwa »

zxcdw wrote: post #90

..and now the thread has been deleted after some further criticism...

Here is a partial screen capture: http://i.imgur.com/R5gs8HC.png

Unfortunately, it's missing some of the newer (and frankly, ignorant and cavalier) replies from the tech support guy.

Re: Limiting passwords to 12 characters is "secure enough"

#100

Post by KMag »

newman314 wrote: post #84
idupree wrote: post #38

Earlier quoted context omitted.

(my tinfoil hat mode: I don't even have any important secrets but I believe in knowing how to protect them) Use /dev/urandom, not a website. Make sure you have configured your text editor not to automatically save any backup files, cut buffers, or the like, and never write it to disk in unencrypted form. (I use vim >= 7.3 and its blowfish encryption; see encryptedvimrc and random_alnum in my scripts https://github.co…

I think you mean LastPass or 1Password. Startup idea: the email equivalent of 1Password. You give each site a completely unique, distinct yet valid email address. They forward to your real email address and vice versa. This way if one email is compromised you know where the spam is coming from plus it reduces email tracking and correlation.

At least the last time I used it, Google Checkout had an opt-in feature that would create a unique unguessable email address the first time you purchased something from a shop, and this email address would be proxied to your GMail account.
Post reply on HN