3 ms·

I don't hate the idea, but I could never use this while so many sites still have dumb validation rules. It would drive me crazy if I had to remember what sites

by jgrowl 11y ago

I don't hate the idea, but I could never use this while so many sites still have dumb validation rules. It would drive me crazy if I had to remember what sites this didn't work with.

murbard2 11y ago
Their generation isn't great. They should tweak the resulting password to ensure that it passes most common tests. I think I would enforce - 10 characters - at least one punctuation - at least one digit - at least one upper case - at least one lower case By coercing the password to have this form you're losing a trivial amount of entropy, but you'll pass the vast majority of password policies. Also add a nonce to the password generation (1, 2, 3, 4) so that you can change it if needed or required. No need to remember the nonce, just try a few until you can login.
- nfriedly 11y ago
  I don't remember where off the top of my head, but I'm pretty sure I've seen sites that had a "no punctuation in passwords" rule. I think at least one of them was a bank.
  - murbard2 11y ago
    Makes sense, it's so their IT department can read it to you more easily over the phone.
  - Zancarius 11y ago
    Nespresso is one that immediately comes to mind as it's the most recent I've encountered besides my bank. I went to order some pods for my mum as a gift only to discover that their password restrictions were not only draconian but stupid. The moment a site prohibits punctuation (especially single quotes as they did) is the moment I suspect they're storing passwords in plain text. It's not directly related, but I'm reminded of this Hall of Shame I stumbled upon from some HN comment a few weeks ago: http://plaintextoffenders.com/ http://plaintextoffenders.com/
  - capnrefsmmat 11y ago
    PwdHash only puts punctuation in generated passwords if the password you provide has it, so it tries to be smart.
  - lqdc13 11y ago
    Also, some sites have things like capital letter cannot be the first character. Punctuation can't follow a digit. At most 8 characters... The list goes on.
ntucker 11y ago
See my other comment in this subthread about my own version of the deterministic password generator concept. It allows passwords to have site-specific rules for how they're generated and also allows rotating individual site passwords.

by jgrowl 11y ago

I don't hate the idea, but I could never use this while so many sites still have dumb validation rules. It would drive me crazy if I had to remember what sites this didn't work with.

murbard2 11y ago

Their generation isn't great. They should tweak the resulting password to ensure that it passes most common tests. I think I would enforce - 10 characters - at least one punctuation - at least one digit - at least one upper case - at least one lower case By coercing the password to have this form you're losing a trivial amount of entropy, but you'll pass the vast majority of password policies. Also add a nonce to the password generation (1, 2, 3, 4) so that you can change it if needed or required. No need to remember the nonce, just try a few until you can login.

nfriedly 11y ago
I don't remember where off the top of my head, but I'm pretty sure I've seen sites that had a "no punctuation in passwords" rule. I think at least one of them was a bank.
- murbard2 11y ago
  Makes sense, it's so their IT department can read it to you more easily over the phone.
- Zancarius 11y ago
  Nespresso is one that immediately comes to mind as it's the most recent I've encountered besides my bank. I went to order some pods for my mum as a gift only to discover that their password restrictions were not only draconian but stupid. The moment a site prohibits punctuation (especially single quotes as they did) is the moment I suspect they're storing passwords in plain text. It's not directly related, but I'm reminded of this Hall of Shame I stumbled upon from some HN comment a few weeks ago: http://plaintextoffenders.com/ http://plaintextoffenders.com/
- capnrefsmmat 11y ago
  PwdHash only puts punctuation in generated passwords if the password you provide has it, so it tries to be smart.
- lqdc13 11y ago
  Also, some sites have things like capital letter cannot be the first character. Punctuation can't follow a digit. At most 8 characters... The list goes on.

ntucker 11y ago

See my other comment in this subthread about my own version of the deterministic password generator concept. It allows passwords to have site-specific rules for how they're generated and also allows rotating individual site passwords.