4 ms·

Rule 1 is that password rules are bullshit, but all of the other rules lead to needing Rule 1: how are you going to explain to a user that their password cannot

by noja 10y ago

Rule 1 is that password rules are bullshit, but all of the other rules lead to needing Rule 1: how are you going to explain to a user that their password cannot be their username, or that their password needs more entropy or complexity?

throwanem 10y ago
Rule 5 rejects nulls; if your password is your username, you don't have a password. Meanwhile my organization is getting ready to mandate the use of a password manager that uses bullshit rules to produce analytics to surface at the director/VP level. So it goes. I look forward to automating the GI that's used to produce this GO.
scrollaway 10y ago
To be honest I think this is a problem that needs to be solved outside of the web. We need to move towards password managers. Of course, that comes with its own set of issues: Lose access to the password manager = lose access to all your accounts. An attacker gets access to your password manager = they get access to all your accounts. On the other hand, for users who use a single 6 character word as their password all over the web, that's essentially the same thing. You can far more easily educate someone in picking a very strong passphrase they will never forget, than get them to use different passwords on each website. I have successfully converted several non-techies in my family to KeepassX [https://www.keepassx.org/ https://www.keepassx.org/], which I also strongly recommend to anyone here. I had to hold hands at first but after explaining how it works and making sure they understand how important it is, over two years, there's never been any issues.
andreareina 10y ago
Just spitballing, but it's possible that you could take the given password and derive the hashcat invocation that would generate the password. In the strictest case this is equivalent to computing the Kolmogorov complexity of the password, but there's an easier way: have a list of the X most common rules, and test the password against those. Once you have the rule, you can calculate how many possibilities exist in that search space and do a calculation ala GRC Haystack[1]. If it's the case that the list of rules doesn't have one that matches the password, that's probably good enough anyway. [1] https://www.grc.com/haystack.htm https://www.grc.com/haystack.htm
tomjen3 10y ago
Don't allow them to select one, assign them one and reset it as needed.

by noja 10y ago

throwanem 10y ago

Rule 5 rejects nulls; if your password is your username, you don't have a password. Meanwhile my organization is getting ready to mandate the use of a password manager that uses bullshit rules to produce analytics to surface at the director/VP level. So it goes. I look forward to automating the GI that's used to produce this GO.

scrollaway 10y ago

To be honest I think this is a problem that needs to be solved outside of the web. We need to move towards password managers. Of course, that comes with its own set of issues: Lose access to the password manager = lose access to all your accounts. An attacker gets access to your password manager = they get access to all your accounts. On the other hand, for users who use a single 6 character word as their password all over the web, that's essentially the same thing. You can far more easily educate someone in picking a very strong passphrase they will never forget, than get them to use different passwords on each website. I have successfully converted several non-techies in my family to KeepassX [https://www.keepassx.org/ https://www.keepassx.org/], which I also strongly recommend to anyone here. I had to hold hands at first but after explaining how it works and making sure they understand how important it is, over two years, there's never been any issues.

andreareina 10y ago

Just spitballing, but it's possible that you could take the given password and derive the hashcat invocation that would generate the password. In the strictest case this is equivalent to computing the Kolmogorov complexity of the password, but there's an easier way: have a list of the X most common rules, and test the password against those. Once you have the rule, you can calculate how many possibilities exist in that search space and do a calculation ala GRC Haystack[1]. If it's the case that the list of rules doesn't have one that matches the password, that's probably good enough anyway. [1] https://www.grc.com/haystack.htm https://www.grc.com/haystack.htm

tomjen3 10y ago

Don't allow them to select one, assign them one and reset it as needed.