8 ms·
Man who made passwords hard regrets rules that 'drive people crazy'
- spraak 9y agoThis nearly could have been on The Onion :)
- leereeves 9y agoThe worst part of password rules is that every site has its own. One requires a symbol, another doesn't allow symbols. A third requires 12 characters, a fourth only allows 8. And they only tell you the rules when you're creating a password. They could at least remind us of the rules so we could remember how we had to mangle the password to match.
- rflrob 9y agoWhat's the worst is when they tell you the rules when you try to reset the password, and then you know what your password probably was, but a) they won't cancel the password change process, and b) they won't let you reuse the old password.
- notyourwork 9y agoI have also submitted a password reset to determine the password requirements so I could go back to login form and guess my password without resetting it.
- ReidZB 9y agoOr sites that require at least one symbol, but then mysteriously disallow a handful of common symbols (e.g. I used a site the other day where exclamation points were not allowed). Makes password generators like 1Password's useless about half the time, since 1Password rightly will pick from all (most?) common symbols on a standard US keyboard. And of course, why would the site tell the user of its obscure symbol requirements before the user tries to enter their brand new password? No, I guess they think it's better to leave it at "a symbol is required" and then reject symbols users use one-by-one.
- generj 9y agoMaybe password rules should be represented as an HTML5 attribute in the input field. 1Password and LastPass et. al. could read this rule and then adjust the password generator accordingly.
- tass 9y agoWhat reasons are there for these restrictions in the first place?
- generj 9y agoThe length requirements are logical if they have reasonable minimums and very high maximums. It doesn't make sense to limit special characters, etc. Especially as everyone should be using a password manager anyways. I suspect most of these odd requirements are a result of design by committee and pointy haired bosses. Maybe requirements from legal departments? As long as the annoying requirements are in place, we might as well try and get password mangers to work with them. LastPass has a generator which can be manually configured, but making the step automated would be helpful.
- majewsky 9y ago> very high maximums What does "very high" mean here? And why would you need it? Usually, you just have a maximum request size in the web server, and people are never going to hit that with actual passwords.
- ReidZB 9y agoAlgorithms like bcrypt may have a maximum supported length: for bcrypt, over about 50 characters and things get dicey [1]. If you're running something computationally expensive like scrypt tuned properly, you don't want malicious entities to be able to send you a 32K password request, probably - easier to force them to keep it small (like < 50 chars), then block them based on request throughput. [1] https://security.stackexchange.com/a/39851/1373 https://security.stackexchange.com/a/39851/1373
- x1798DE 9y agoI'm not sure this is a bad thing. You should have a different password for each site anyway, so the fact that it disrupts your ability to reuse passwords is an accidental pseudo-feature.
- sowbug 9y agoA different policy is unlikely to inspire a burst of entropic creativity in a chronic password reuser. At best, it changes _rover_ to _r0ver_. But you're right that some change is better than none, even if it won't stop a determined attacker who's fixated on a specific target.
- zeep 9y agoIf you include 1 uppercase, 1 lowercase, 1 number and have at least 8 characters, you should meet the password complexity requirements of most servers.
- jjuhl 9y agoNo. 8 characters is too short - no matter if you add in special symbols and upper/lower case. It's too easy to brute-force crack. You need something longer. And once you make it longer, the extra alphabet size from upper/lower case and symbols matters less.
- zeep 9y agoI was not talking about brute-force protection... I'm talking about meeting the password complexity requirements of the servers (same as the article)
- IshKebab 9y agoYou probably need a symbol to satisfy a lot of them too.
- zeep 9y agoI find the ones that don't accept symbols to be more common than the ones that require one, which is why I don't include symbols by default.
- wisty 9y agoIt's even more fun when different forms (e.g. set password and enter password) have different validation rules.
- sowbug 9y agoInconsistent plaintext processing is cause for special glee as well. My three favorites are strip(), substr(s, 0, 8), and tolower(). Nothing quite like manually brute-forcing your own passphrase to restore confidence in your ability to type.
- deleted 9y ago[deleted]
- JohnJamesRambo 9y agoHave his rules even been proven to be right? There's that famous xkcd comic about passwords and password strength checkers like https://howsecureismypassword.net https://howsecureismypassword.net that seem to imply otherwise. Short passwords with symbols seem easier to crack than longer ones with words put together a human could remember.
- mallaidh 9y agoUnless it's a dictionary attack.
- GhotiFish 9y agothe correct horse battery staple comic assumes it's a dictionary attack. https://xkcd.com/936/ https://xkcd.com/936/
- Dylan16807 9y agoRight about what, specifically? Being random is good. Being short wasn't part of the rules. Rotation is pretty bad. And words don't fix the core problem of making a good password because people love picking non-random words. In general, every two random characters is worth as much as one random word. I personally find it as easy to remember three random characters as a word, so I get better mileage out of random characters.
- forapurpose 9y ago> Rotation is pretty bad Rotation is great if it's implemented correctly. The problem is that it's too much of a burden on users, therefore they implement it poorly, and then it's less useful or a weakness.
- eksemplar 9y agoRotation makes people pick things like Winter2017 or write it down, and it offers little safety because being compromised for 3 months isn't that much better than being compromised for a year.
- hallman76 9y agoCool. Now can we find the person responsible for “smart quotes”?
- tqkxzugoaupvwqr 9y agoAren’t this the correct quotation marks? " means inch or seconds and is only used because most keyboard layouts make it hard to type the correct quotation marks.
- carey 9y agoInches and seconds should really use ″, U+2033 Double Prime, if you’re not going to use the ASCII quotation mark for everything.
- vacri 9y agoThe amusing thing is that we never care about this distinction in handwriting. "Oh, your two tiny vertical-ish lines denoting 'inch' are not ever-so-slightly slanted..."
- thaumasiotes 9y agoIn my handwriting, all quotation marks are pretty heavily slanted. That doesn't mean I would consider them distinct from hypothetical vertical marks. Fancy quotes are a display choice, not a distinct glyph.
- forapurpose 9y ago> " means inch or seconds and is only used because most keyboard layouts make it hard to type the correct quotation marks. I thought it was used because 7-bit ASCII had only 128 code points in which to fit all teletype controls, letters, numbers, and punctuation marks and symbols. They had to use each code point efficiently, and the ASCII double quote can be used as open quotes, close quotes, seconds, inches ... they also needed to support some European alphabets and therefore some punctuation marks, such as the single quote, double as accents when overtyped (using teletype control code points) on a letter.
- ransom1538 9y agoIf I cannot use my passwords -- I always give my favorite password a try: ''; truncate table users;
- acchow 9y agoWould this be a crime if it worked?
- curun1r 9y agoIt probably should, since it would mean that the site isn't hashing passwords with even the most ancient cipher. Bonus ineptness points are given for not using a prepared statement or sanitizing the SQL query. As a software developer, I'm okay with that being criminal negligence.
- Casseres 9y agoI think the previous person meant it being possibly a crime for the user, not the developer.
- curun1r 9y agoHence the attempt at humor through deliberate misinterpretation of an ambiguously-worded statement where the intent was clear.
- acchow 9y agoCute. I am still curious if this would be a criminal offense for the person that did the SQL injection attack.
- ransom1538 9y agoIn the US, the "Computer Fraud and Abuse Act" could apply. The case would revolve around "intent". Explaining to interrogating officers that you hated password forms and wanted revenge would be 1 to 5 years in federal prison (better than state). Explaining to interrogating officers that you accidentally copy pasted wrong - the case would be dropped. This is why you need see a lawyer always before answering questions you will be mislead. "intentionally accesses a computer without authorization or exceeds authorized access" [1] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://www.nacdl.org/cfaa/ https://www.nacdl.org/cfaa/
- mzzter 9y agoRelevant xkcd: https://xkcd.com/936/ https://xkcd.com/936/
- colordrops 9y agoThis guy must be a joker with a name like Bill Burr. edit: for those who down-voted, one of the most famous comedians in the US at the moment is also named Bill Burr.
- sdrothrock 9y agoRecent discussion: https://news.ycombinator.com/item?id=14967731 https://news.ycombinator.com/item?id=14967731
- notreallythough 9y agopassword must contain 8 characters and the temperature of the room you're currently occupying, in degrees kelvin
- Casseres 9y agoKelvin is not expressed in degrees; it's just "Kelvin". Now to really throw people for a loop, tell them to do it in degrees Rankine (even less people know what that is).
- dawnerd 9y agoSome sites are just insane. https://github.com/duffn/dumb-password-rules https://github.com/duffn/dumb-password-rules
- rhizome 9y agoAlso: https://twitter.com/PWTooStrong https://twitter.com/PWTooStrong
- frik 9y agoApple iTunes/Apple ID pwd rules is really annoying. Microsoft online service incl (based still on the decades old 1997's Hotmail login system is archaic) has an upper limit of 8 (or so) chars. (Office365/Outlook.com/etc)
- shavingspiders 9y agoWhat? That's incorrect - I've recently had 1Password change my Outlook.com password, and it's much more than 8 characters.
- edflsafoiewq 9y agoAnyone else annoyed by GitHub itself? One digit and one lower-case letter required.
- SomeStupidPoint 9y agoIs Diceware still recommended? http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html
- nshepperd 9y agoYes. Using diceware (with actual dice) is still the most reliable way for a normal person to create a strong password. Use diceware. Ignore this guy's bad advice.
- mikeycgto 9y agoU2F and Yubikeys if you're serious about it.
- teilo 9y agoIt is relevant that NIST 800-53 Rev. 5 has dropped password complexity and rotation requirements because they make things worse, not better.
- pishpash 9y agoThis guy sounds like a joker with no understanding of information theory.
- xname2 9y agoOur university forces us to change the password every 150 days. It is such a pain in the s, because there are too many apps on too many devices need to update the password. I asked the IT department, can you guys consider to stop this and find an alternative security policy? The answer is no, because this security policy is in the state law.
- Fezzik 9y agoIf you're really hellbent on it, you can probably tell the IT department they are full of shit and ask for the citation to the state code number - I am no state code scholar, but I have never heard of anything like this. In the NW States I am familiar with I could not find a single code section that even remotely touched on passwords at state schools. It would be an odd thing to legislate. Some states are goofy though.
- xname2 9y agoJust checked, by a little bit of googling, I did find it in a gov document.
- Fezzik 9y agoI stand corrected. And intrigued that a state saw fit to make a law about that.
- nkristoffersen 9y agoCare to share? Curious minds want to know :-)
- eksemplar 9y agoI work in the public sector in Denmark. Here three months is required by law. It's caused our most common passwords to be things like Summer17 and half the employees that actually use what they think are hard random passwords end up writing them down. If you look under the keyboard if 100 workstations you'll probably find 10 passwords on post-its. It makes little sense too because if we're compromising for 3 months we're probably going to be just as fucked as if we were compromised for 4. The best policy we have is locking people out after 3 wrong attempts.
- ScottBurson 9y ago> Burr said he prefers phrases from literature. I distinctly recall seeing somebody post a comment a few years ago -- I think it was here on HN, though I'm not sure -- to the effect that they had used a line from an obscure poem in Afrikaans as a password, and it was cracked. -- Oh! HN Search comes through for me: here's a recent HN comment [0] by someone who also recalled it, with a link to the original [1]. [0] https://news.ycombinator.com/item?id=14781311 https://news.ycombinator.com/item?id=14781311 [1] https://www.reddit.com/r/Bitcoin/comments/1ptuf3/brain_wallet_disaster/ https://www.reddit.com/r/Bitcoin/comments/1ptuf3/brain_walle...
- spiznnx 9y agoI had an idea for a website password system: instead of letting the user set a password, you just give them one. Prevents password reuse, which is the only thing that ever really commonly gets anyone's account hijacked in my opinion. Doesn't even have to be strong, could be one word from the top 10k English words. Require reset after 5 failed attempts. Would there be anything wrong with this approach (besides being sort of user-hostile), or have I misunderstood the website account security threat model?
- gelatocar 9y agoA 1 in 2000 chance of correctly guessing someone's password could lead to lots of attempts which at best would cause lots of password resets and at worst cause lots of compromised accounts.
- paulie_a 9y agoI referenced this article today at work involving a discussion about password security, 2FA and actual customer experience. Tonight I was dealing with Wells Fargo for a password reset. They have a max of 14 characters and a generally awful interface. I took screenshots of the process to use as a guide of things to avoid.
- asherkosaraju 9y agoDuh. Obviously. And not like it's secure either. THe worst part is some sites ask you to change your password every month/3months/etc. That kinda sucks.