7 ms·

I think one of the worst things is the sites that think they are being "more secure" by adding extra rules for passwords beyond the typical. If people want to

I think one of the worst things is the sites that think they are being "more secure" by adding extra rules for passwords beyond the typical. If people want to use the same password for everything -- or maybe better, use one password for the really important stuff and another password for everything else -- you really shouldn't try to fight against that be requiring at least one capital letter and at least one number and at least one symbol (or whatever). Another obnoxious thing is sites that, when you change your password, don't let you use one you've used in the last X months. In both these cases, what happens is that you defeat people's attempts to make their passwords adhere to some system they can remember. And then they just says "f*ck it" and do really easy to guess passwords.

raesene9 10y ago
Luckily we've started to see more sane advice on passwords come out from reputable organisations which contradicts some of the security cargo cults that you mention. Specifically there's a good doc. from CESG in the UK https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/458857/Password_guidance_-_simplifying_your_approach.pdf https://www.gov.uk/government/uploads/system/uploads/attachm... which has a far more realistic approach to good password security.
jkaptur 10y ago
In some of these cases, I suspect that the "password recovery" process is doing double duty as the primary login flow for many users.
- kristofferR 10y ago
  Yeah, it's weird that offering users the choice of "login by clicking the link we just emailed you" isn't more common.
  - Pxtl 10y ago
    Exactly. I want an extra button next to the login form for "login by email". Send me an email that contains the geolocation and IP address of the requester and login link (that also logs in the requester browser session so I can auth from my phone even if I'm browsing on pc) as well as a "reject" link that they can use to determine if this is malicious.
    - amatix 10y ago
      Check out https://thisdata.com https://thisdata.com -- helps with a lot of that login intelligence smarts, and they're friendly, smart folks.
  - cm2187 10y ago
    On many of its websites microsoft enforces that. It usually takes 1-3 min for the email to arrive. That's a great way for a website to miss a sale.
r00fus 10y ago
Really I'm surprised there isn't an ISO or ANSI standard for different levels of password requirements (e.g. Caps + digit + 8 chars). While I think passwords are one of the biggest points of failure of modern security, seems like this would alleviate authentication policy fatigue.
- tribune 10y ago
  Wouldn't standardizing password requirements make them much easier to guess?
  - marxidad 10y ago
    Not if you assume that attackers are going to automatically try those that don't meet the requirements anyways.
    - justinlardinois 10y ago
      Why would you assume that? A site's password requirements are public information, so you should expect an attacker to read them.
  - Klathmon 10y ago
    Password requirements shouldn't be considered "secret". they are almost always displayed to the person logging in.
- nitrogen 10y ago
  Diceware-style passwords can be more secure than random characters, but be rejected by shortsighted character requirements. See https://www.xkcd.com/936/ https://www.xkcd.com/936/
- dredmorbius 10y ago
  "A known password is a bad password." We have lists of known passwords. Virtually anything up to 8 characters. Many things above that. There are lists of millions of real-life passwords dumped from services. All of those should be used to screen passwords on entry (directly or by hash) and force a password update on match. It's reached the point that this should be mandated by law. I know far too many nontechnical people still using utterly broken passwords (and who've had multiple accounts hacked, and insist that they're doing nothing wrong....)
Swizec 10y ago
> when you change your password, don't let you use one you've used in the last X months. Yeah, thanks for telling an attacker that they have guessed my password for a bunch of sites. Assholes.
Moru 10y ago
Or what about the sites that allow special characters in the sign-up form but when you try to log in on the mobile it doesn't allow those characters any more...
_RPM 10y ago
What about websites that don't allow special characters in their passwords?
buyx 10y ago
First National Bank (FNB) in South Africa has adopted every one of these absurd rules, and more: Passwords must contain a mixture of upper and lower case letters as well as one letter and one special character Length between 7 and 33 characters Not the same as the previous 12 passwords The same character cannot be used consecutively Avoid sequential letters and numbers (123 or abc). I think this used to be enforced, not sure if it still is. May not be the same as the name, userid or clientid. As I recall this is enforced by very aggressively with innocent passwords being rejected because they happen to have some matching substring. https://www.fnb.co.za/demos/reset-username-and-password-PC.html https://www.fnb.co.za/demos/reset-username-and-password-PC.h... (rules are on the 5th screen in their demo) I've been using the same password for 3 years because changing passwords is so brutal. Complaining is futile because of the bullshit cargo culting around security.
- justinlardinois 10y ago
  > Length between 7 and 33 characters I've never understood why sites limit password length. You're (hopefully) hashing it anyways; the length of what the user enters has no bearing on what you're storing in your database.
  - mhenr18 10y ago
    Exactly. Limits only become reasonable when they're meant to stop you from uploading hundreds of megs worth of data and monopolising resources. A 1kb password or even a 1mb password supplied by a tiny fraction of a percent of users is not going to make an impact on you, but can provide that small group of users with a massively increased piece of mind.
  - logician76 10y ago
    If the password is too short, an attacker can brute force the hash by simply trying all 6 character combinations of allowed password characters, provided that the hashes get leaked or hacked, which happens quite a lot these days. (Or if the website is stupid enough to allow an attacker to brute force try all these combinations without throttling you or stopping you at the xth wrong entry)
tdeck 10y ago
I wish when designing a new site people would take into account how frequently a user is likely to log in. If it's going to be something infrequent, it would be better to use OAuth/OpenID or an email/SMS based login. Forcing a user to come up with a password they know they won't be typing often all but ensures they'll use the same password on multiple sites. For example, my side project varmail.me is a site you'd log into maybe once every couple of months, even as an active user. So I made it work by emailing you a login link. I think people defaulting to a user+password auth scheme is part of the problem.
- justinlardinois 10y ago
  If I recall correctly, Medium uses this login method. There are a lot of smartphone apps that almost never log you out and would benefit from this. I recently had some trouble trying to remember how to log into the Taco Bell app after a session that lasted ~2 years. And I've lost count of how many friends have been unable to remember their Snapchat password and just creating a new account instead when they get a new phone.
x0x0 10y ago
My employer requires me to change my password every 8 weeks, and I can't use any of the last 4 passwords. You can change your password five times in a day though :D
makecheck 10y ago
I’m fairly convinced that there are contractors making money peddling the same stupid ideas to IT staff everywhere, leading to common solutions no matter the merits. It seems every site I use has now sent me that dreaded E-mail, boasting how everything has been “improved” with new “security” measures; meanwhile, every last one of their changes has been not just ineffective but usually provably detrimental to security. You forgot to mention the kicker: after hurling 14 different password requirements at you, they let you reset your password only by answering “security” questions which are usually fixed and not even applicable. Seriously, some of the questions are so ridiculous, I have seen fixed lists where NONE of the questions applies to me. Which is OK because it’s insecure to answer truthfully anyway; I end up creating keychain items just to store the answers to my “security” questions.
Bartweiss 10y ago
Frankly, I trust HN's password security more than my bank's. Two simple text fields, basically no rules, but when the next Heartbleed hits I have real faith that HN will patch quickly, and keep everything well hashed and salted. My bank, with its eight different password rules, security image, and reset questions, will (and has) roll over for every breach that comes along.
tensor 10y ago
The right answer is to encourage users to use password managers and a nice long diceware password as a master password.

raesene9 10y ago

Luckily we've started to see more sane advice on passwords come out from reputable organisations which contradicts some of the security cargo cults that you mention. Specifically there's a good doc. from CESG in the UK https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/458857/Password_guidance_-_simplifying_your_approach.pdf https://www.gov.uk/government/uploads/system/uploads/attachm... which has a far more realistic approach to good password security.

jkaptur 10y ago

In some of these cases, I suspect that the "password recovery" process is doing double duty as the primary login flow for many users.

kristofferR 10y ago
Yeah, it's weird that offering users the choice of "login by clicking the link we just emailed you" isn't more common.
- Pxtl 10y ago
  Exactly. I want an extra button next to the login form for "login by email". Send me an email that contains the geolocation and IP address of the requester and login link (that also logs in the requester browser session so I can auth from my phone even if I'm browsing on pc) as well as a "reject" link that they can use to determine if this is malicious.
  - amatix 10y ago
    Check out https://thisdata.com https://thisdata.com -- helps with a lot of that login intelligence smarts, and they're friendly, smart folks.
- cm2187 10y ago
  On many of its websites microsoft enforces that. It usually takes 1-3 min for the email to arrive. That's a great way for a website to miss a sale.

r00fus 10y ago

Really I'm surprised there isn't an ISO or ANSI standard for different levels of password requirements (e.g. Caps + digit + 8 chars). While I think passwords are one of the biggest points of failure of modern security, seems like this would alleviate authentication policy fatigue.

tribune 10y ago
Wouldn't standardizing password requirements make them much easier to guess?
- marxidad 10y ago
  Not if you assume that attackers are going to automatically try those that don't meet the requirements anyways.
  - justinlardinois 10y ago
    Why would you assume that? A site's password requirements are public information, so you should expect an attacker to read them.
- Klathmon 10y ago
  Password requirements shouldn't be considered "secret". they are almost always displayed to the person logging in.
nitrogen 10y ago
Diceware-style passwords can be more secure than random characters, but be rejected by shortsighted character requirements. See https://www.xkcd.com/936/ https://www.xkcd.com/936/
dredmorbius 10y ago
"A known password is a bad password." We have lists of known passwords. Virtually anything up to 8 characters. Many things above that. There are lists of millions of real-life passwords dumped from services. All of those should be used to screen passwords on entry (directly or by hash) and force a password update on match. It's reached the point that this should be mandated by law. I know far too many nontechnical people still using utterly broken passwords (and who've had multiple accounts hacked, and insist that they're doing nothing wrong....)

Swizec 10y ago

> when you change your password, don't let you use one you've used in the last X months. Yeah, thanks for telling an attacker that they have guessed my password for a bunch of sites. Assholes.

Moru 10y ago

Or what about the sites that allow special characters in the sign-up form but when you try to log in on the mobile it doesn't allow those characters any more...

_RPM 10y ago

What about websites that don't allow special characters in their passwords?

buyx 10y ago

First National Bank (FNB) in South Africa has adopted every one of these absurd rules, and more: Passwords must contain a mixture of upper and lower case letters as well as one letter and one special character Length between 7 and 33 characters Not the same as the previous 12 passwords The same character cannot be used consecutively Avoid sequential letters and numbers (123 or abc). I think this used to be enforced, not sure if it still is. May not be the same as the name, userid or clientid. As I recall this is enforced by very aggressively with innocent passwords being rejected because they happen to have some matching substring. https://www.fnb.co.za/demos/reset-username-and-password-PC.html https://www.fnb.co.za/demos/reset-username-and-password-PC.h... (rules are on the 5th screen in their demo) I've been using the same password for 3 years because changing passwords is so brutal. Complaining is futile because of the bullshit cargo culting around security.

justinlardinois 10y ago
> Length between 7 and 33 characters I've never understood why sites limit password length. You're (hopefully) hashing it anyways; the length of what the user enters has no bearing on what you're storing in your database.
- mhenr18 10y ago
  Exactly. Limits only become reasonable when they're meant to stop you from uploading hundreds of megs worth of data and monopolising resources. A 1kb password or even a 1mb password supplied by a tiny fraction of a percent of users is not going to make an impact on you, but can provide that small group of users with a massively increased piece of mind.
- logician76 10y ago
  If the password is too short, an attacker can brute force the hash by simply trying all 6 character combinations of allowed password characters, provided that the hashes get leaked or hacked, which happens quite a lot these days. (Or if the website is stupid enough to allow an attacker to brute force try all these combinations without throttling you or stopping you at the xth wrong entry)

tdeck 10y ago

I wish when designing a new site people would take into account how frequently a user is likely to log in. If it's going to be something infrequent, it would be better to use OAuth/OpenID or an email/SMS based login. Forcing a user to come up with a password they know they won't be typing often all but ensures they'll use the same password on multiple sites. For example, my side project varmail.me is a site you'd log into maybe once every couple of months, even as an active user. So I made it work by emailing you a login link. I think people defaulting to a user+password auth scheme is part of the problem.

justinlardinois 10y ago
If I recall correctly, Medium uses this login method. There are a lot of smartphone apps that almost never log you out and would benefit from this. I recently had some trouble trying to remember how to log into the Taco Bell app after a session that lasted ~2 years. And I've lost count of how many friends have been unable to remember their Snapchat password and just creating a new account instead when they get a new phone.

x0x0 10y ago

My employer requires me to change my password every 8 weeks, and I can't use any of the last 4 passwords. You can change your password five times in a day though :D

makecheck 10y ago

I’m fairly convinced that there are contractors making money peddling the same stupid ideas to IT staff everywhere, leading to common solutions no matter the merits. It seems every site I use has now sent me that dreaded E-mail, boasting how everything has been “improved” with new “security” measures; meanwhile, every last one of their changes has been not just ineffective but usually provably detrimental to security. You forgot to mention the kicker: after hurling 14 different password requirements at you, they let you reset your password only by answering “security” questions which are usually fixed and not even applicable. Seriously, some of the questions are so ridiculous, I have seen fixed lists where NONE of the questions applies to me. Which is OK because it’s insecure to answer truthfully anyway; I end up creating keychain items just to store the answers to my “security” questions.

Bartweiss 10y ago

Frankly, I trust HN's password security more than my bank's. Two simple text fields, basically no rules, but when the next Heartbleed hits I have real faith that HN will patch quickly, and keep everything well hashed and salted. My bank, with its eight different password rules, security image, and reset questions, will (and has) roll over for every breach that comes along.

tensor 10y ago

The right answer is to encourage users to use password managers and a nice long diceware password as a master password.