4 ms·
When I feel like a security goon's arbitrary and capricious password policy is irrational and counterproductive, I make my passwords worse in the hopes that I h
by charDiversity 9y ago
When I feel like a security goon's arbitrary and capricious password policy is irrational and counterproductive, I make my passwords worse in the hopes that I have to someday read it to someone, or perhaps it gets spilt outin the open, and then everyone will see how forcing me to pick a password that adheres to certain characteristics solved nothing.
Just wait. Someday you will see dumps of pwnt password that look like:
Password-1234
Password_1234
Password!1234
Password&1234
Password?1234
Password$1234
And that is rated as a "VERY STRONG" password.
Have fun with your character diversity, and your 90 day password expiration rotation schemes. Go ahead and try to force me into a corner. I'm still picking terrible passwords and I'm picking especially terrible ones because someone out there is trying to pull my strings.
Pull my strings. Make me more predictable within your little security policy world. See how that plays out.
- KajMagnus 9y agoI like this entropy based password strength checker: https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn Here you can see that it realizes that all your passwords are weak: https://lowe.github.io/tryzxcvbn/ https://lowe.github.io/tryzxcvbn/ (it says: cracked in minutes, or seconds, in an offline attack) And it does this without requiring uppercase or symbols or numbers. It even understands that passwords like "qwerty" are trivially cracked – it looks at how far the keyboard keys are from each other. Among lots of other things.
- systemtest 9y agoI shamefully have to admit that I tried to logon to your (throw away) account using the list of passwords you supplied.
- jacquesm 9y agoUsername checks out I guess. You and 50 others.
- dudul 9y agoI completely agree. "Your password must be at least 10 character long, include 2 upper case, 2 lower case, 2 digits, 2 special characters, must be changed every 60 days and cannot be reused for the next 3 years" G0Fuc4Y@urse!f To me this is a sure way that people are gonna pick horrible and stupid passwords.
- raverbashing 9y agoAnd leave them in a post-it glued to their monitor
- Xylakant 9y agoDepending on your threat model, a strong password that is written on a piece of paper on your desk might beat a weaker password that's memorized. That would at least require physical presence of the attacker and if your desk is reasonably secured, that might be ok for a lot of cases.
- majewsky 9y ago> Your password must be at least 10 character long You forgot "and may not be longer than 16 characters".
- subcosmos 9y agoyou just know they are storing it in a plaintext VARCHAR(16) column and not hashing it in any way ....
- lithos 9y agoHRBlock does this.
- scrooched_moose 9y agoUnless they've changed it in the last couple months, TRowe Price still limits passwords to 10 characters. And this is after a recent "We've upgraded our security!" push where I had to reset everything. I've seriously considered closing my accounts over it. Edit: Yep, still as bad Password must be 6-10 characters and contain at least 2 numbers and 2 letters. Password may not contain the following special characters: space , + " % & ' ; = ^ or curly braces.
- Avamander 9y agoJust recently Estonian Information System Authority published a new report (including new guidelines for passwords) basically telling: "Drop password requirements, allow long passwords and restrict the use of short and top-n passwords". Why I'm mentioning this is because now I have an actual official document I can send to Estonian companies in addition to my own words (that weren't previously believed, ugh) why their requirements are inane. I think this kind of behaviour shows that we actually need some kind of monitoring or regulation here to build more secure software for everyone. Also as you mentioned bad-"strong" passwords, I "love" how something like "Qwerty!1234" satisfies most requirements but "8f434346648f6b96df89dda901c5176b10a6d83961dd3c1ac88b59b2dc327aa4" is not okay because it doesn't contain an uppercase letter or a symbol.
- Beltiras 9y agoNIST had a good blog on the subject: https://www.nist.gov/blogs/taking-measure/easy-ways-build-better-pw0rd https://www.nist.gov/blogs/taking-measure/easy-ways-build-be...
- darepublic 9y agoWhy is the solution always regulation with you people
- Avamander 9y agoBecause profit-driven businesses never bother to do anything that doesn't bring profit, even less when it requires effort.
- tinus_hn 9y agoSuch a rebel. Remember that at the end of the road it’s your identity your password protects.
- scrooched_moose 9y ago> your 90 day password expiration rotation schemes Those scenarios are almost always a bad employer policy, in which case it's their data the password is protecting.
- parliament32 9y agoIt's often because of regulation. PCI standards, for example, require this.
- bluedino 9y ago>> 90 day password expiration rotation schemes I have a bank site that I have to log in to every month, but only once a month. So every 3rd time I use the site, I have to choose a new password. Very annoying.
- packet_nerd 9y agoThe only appropriate password requirement is length. A policy that requires 12 or 14 characters alone will have much better security than all these character sets, time limits, and other nonsense while only requiring 6 or 8 characters. And these sites that limit password length to ridiculous short lengths are infuriating. Who could have possibly ever thought that was a good idea???
- KeytarHero 9y agoNot necessarily. "aaaaaaaaaaaa", "password1234", and "pennsylvania" are all 12 characters, but they're all insecure. These might seem like stupid passwords that nobody would use, but if you enforce a minimum password length as your only requirement, then I guarantee some user is going to use something like this. I agree that length is generally much more important than anything else - but it's not the only factor. Long passwords can be insecure too. Unfortunately it's not easy to validate what exactly what makes an insecure password, and as a result we get stupid requirements that prevent some very good passwords (e.g. diceware-generated passwords).
- packet_nerd 9y agoYou're right that dictionary words are weak, regardless of whether they are long or short. Same applies to anything that can be arrived at by a simple heuristic such as dictionary word + 1, capitalized dictionary word, dictionary word with "@" substituted for "a", etc.. However, outside of the above caveats, it's a common misconception that more complex is more secure. Which of these is harder to crack? catzzzzzzzzzzzzz db0mcgn20y64zzn7 Since an attacker is unlikely to arrive at either of these through a dictionary or heuristic, they will take roughly equally as much time to brute force. When you force users to comply with arcane password policies, a high percentage of them are going to build their passwords in very predictable ways that are easy to code into a heuristic, like replacing "o" with "0" or something. These kinds of changes add no security value and are just extra work/bother for the users. With the length requirement, it's unlikely they're going to think of a dictionary word off the top of their head that is long enough (how long did you have to think about it to get pennsylvania?), and thus, on average, you're more likely to get more passwords that are a couple of words, or a phrase, or something that is a lot harder to dictionary attack. Once you break away from the dictionary, complexity doesn't matter, only length.