3 ms·

I agree that the only real restriction that makes sense is a minimum character count. The others just tend to get in the way. I haven't seen anyone implement it

I agree that the only real restriction that makes sense is a minimum character count. The others just tend to get in the way. I haven't seen anyone implement it in the wild, but it'd also be cool if there was a wordlist of the 25 most common passwords that the site matched against and refused to accept. I think those two policies, minimum length and no super common passwords, would do a lot to minimize the effectiveness of dictionary attacks.

mbreese 11y ago
I personally like the Stanford policy[1]. It basically boils down to: the longer the password, the fewer restrictions. Each password needs to be at least 8 characters, but if you only have 8 characters, you might need uppercase, lowercase, a symbol and a digit. If you have 12 characters, you only need upper/lower/digit. Once you hit 20 characters, you can have whatever you want. I think that this is a good balance between security for short passwords, while still allowing ridiculously long ones (pass-phrases). [1] http://arstechnica.com/security/2014/04/stanfords-password-policy-shuns-one-size-fits-all-security/ http://arstechnica.com/security/2014/04/stanfords-password-p...
- warfangle 11y ago
  Almost like you're validating on entropy and not specific rules..........
- Dylan16807 11y ago
  The concept is nice, but their numbers are horribly, unforgivably wrong. 8 random upper/lower/digit/symbol characters are equal to 9 random mixed-case letters. Not 16. Their cutoffs for different mixes are 8, 12, 16, 20. Realistic cutoffs would look more like 10, 11, 11, 14. Even worse, they encourage counting the individual letters in words. Never do that. Random words are only as good as two random characters.
- technion 11y ago
  $ dd if=/dev/urandom bs=32 count=1 | xxd -p That nearly every site on the Internet will refer to that output as "not strong enough" and instead suggest P@ssword1 as a better alternative definitely speaks to the issue.
rmc 11y ago
> I haven't seen anyone implement it in the wild, but it'd also be cool if there was a wordlist of the 25 most common passwords that the site matched against and refused to accept. I have implemented that on a site. It wouldn't accept the top 10,000 most common passwords. (or was it 1k). Otherwise ~1% of your users will pick "password" as a password.
tragic 11y ago
> I haven't seen anyone implement it in the wild, but it'd also be cool if there was a wordlist of the 25 most common passwords that the site matched against and refused to accept It's now in django[0]. And it's a hoot to read... [0] https://github.com/django/django/blob/master/django/contrib/auth/common-passwords.txt.gz https://github.com/django/django/blob/master/django/contrib/...

mbreese 11y ago

I personally like the Stanford policy[1]. It basically boils down to: the longer the password, the fewer restrictions. Each password needs to be at least 8 characters, but if you only have 8 characters, you might need uppercase, lowercase, a symbol and a digit. If you have 12 characters, you only need upper/lower/digit. Once you hit 20 characters, you can have whatever you want. I think that this is a good balance between security for short passwords, while still allowing ridiculously long ones (pass-phrases). [1] http://arstechnica.com/security/2014/04/stanfords-password-policy-shuns-one-size-fits-all-security/ http://arstechnica.com/security/2014/04/stanfords-password-p...

warfangle 11y ago
Almost like you're validating on entropy and not specific rules..........
Dylan16807 11y ago
The concept is nice, but their numbers are horribly, unforgivably wrong. 8 random upper/lower/digit/symbol characters are equal to 9 random mixed-case letters. Not 16. Their cutoffs for different mixes are 8, 12, 16, 20. Realistic cutoffs would look more like 10, 11, 11, 14. Even worse, they encourage counting the individual letters in words. Never do that. Random words are only as good as two random characters.
technion 11y ago
$ dd if=/dev/urandom bs=32 count=1 | xxd -p That nearly every site on the Internet will refer to that output as "not strong enough" and instead suggest P@ssword1 as a better alternative definitely speaks to the issue.

rmc 11y ago

> I haven't seen anyone implement it in the wild, but it'd also be cool if there was a wordlist of the 25 most common passwords that the site matched against and refused to accept. I have implemented that on a site. It wouldn't accept the top 10,000 most common passwords. (or was it 1k). Otherwise ~1% of your users will pick "password" as a password.

tragic 11y ago

> I haven't seen anyone implement it in the wild, but it'd also be cool if there was a wordlist of the 25 most common passwords that the site matched against and refused to accept It's now in django[0]. And it's a hoot to read... [0] https://github.com/django/django/blob/master/django/contrib/auth/common-passwords.txt.gz https://github.com/django/django/blob/master/django/contrib/...