5 ms·

I need password fields to: 1)not silently fail when I try a 64 character (or 32 character) password 2)not fail and say my password is "too short" when it is 3

I need password fields to: 1)not silently fail when I try a 64 character (or 32 character) password 2)not fail and say my password is "too short" when it is 32 characters and you have an unrevealed maximum password length of fewer characters than that. 3)just all-around quit failing when my password is totally fine, it's a quasi-random string of letters, numbers, and symbols and I'll never type it... oh yeah 4)don't disable pasting in the password field 4b)IF you do, freaking let me see what I've typed. I promise to not enter the password in a place someone can shoulder surf. Trust me that's WAY down on the threat list for my life. Then, and only then, if you really want, keep me from registering with a breached password. But you had better tell me that is what is going on.

Dylan16807 8y ago
64? How much entropy is in the passwords you're pasting? While holistically I like to see maximum lengths of 200+, personally I'm satisfied with 20 characters holding 119 bits of entropy.
- erik_seaberg 8y ago
  I find a passphrase (e.g., half a dozen words from the diceware list) easier to memorize than random gibberish and symbols, so it's disappointing that they're so rarely allowed.
  - Dylan16807 8y ago
    I understand that entirely, but I'm asking someone that specifically said they don't type their 64 characters.
    - dwighttk 8y ago
      hey, I'm fine with 20 if you tell me ahead of time that is the maximum. My generator just goes up to 64, so that's where I start. Though I usually find through trial and error that 16 is the maximum in a lot of places...
- deleted 8y ago
  [deleted]
cm2187 8y ago
And not complain it doesn’t have enough entropy because it lacks special characters when it is a hex of a 128bit key! What I find the most annoying is that developers enjoy creativity for password validation. Some requires special characters, but only from 2 or 3 allowed special characters (what good does it even do in term of entropy???). Some limit the number of times a character can appear in a password, and I understand that it is meant to prevent people using “aaabbbccc” as a password but it also makes long passwords impossible. Many have an artificially low length limit (why would they even do that)?
- technion 8y ago
  I've implemented multiple such systems and I can say it's never been a case of the developer enjoying it. These dumb requirements always come from an exec that knows better. At one point a marketing manager informed me I "don't understand password security" while handing me a non-negotiable list of dumb mechanisms like you described.
  - tialaramex 8y ago
    Yup. When I get tasked to do this I will usually end up building a system where you get a choice at the software configuration level: Do you want actual password security? We can do that. Otherwise, here's whatever nonsense is currently favoured by people who know nothing but set policy. Sometimes obeying policy _is_ negotiable but only for some users, so I could set the former configuration where I was able to negotiate and the latter for everybody else. For example "passwords are case insensitive" or "no spaces" is likely to be in the latter because someone in customer support finds it easier. "Use any halfway decent salted, pessimised hash" may be in the former, whereas "Use this specific named hash that you'll have to implement by hand because it's not offered in the language and libraries used by the system" is more likely to be in the latter I will say it's not necessarily "an exec that knows better". You're often playing a game of telephone with a third party such as a penetration test service, some government bureau or a "Being a CTO for Dummies" type text book. When it's a game of telephone in a large organisation it's unlikely you'll be able to fix it, it only takes one person with political cover between you and the person who originally said something like "I don't know, 16 characters?" to ensure that's a hard requirement you're now being tested against. My previous employer had systems that made it impossible for QA to get a "normal" customer experience, supposedly for "Network Security". A fraction of all pages loads at random are redirected to / on the correct site. All page loads. Image request, just logged in, made a post to a forum, anything might be turned into a request for the home page. Clearly it was a trivial config bug, and I even met people who knew which individual had made the configuration error, their name, where they worked, etc. But that person had political cover from VP level and so the bug was simply never fixed in the years I worked there. I've actually promised my entire ex-team lunch out if it's fixed while my retainer is still in place. I expect towards the end of the retainer I'll just go back to that city and take them out to commiserate, because the chances of it ever being fixed are so slim.
0db532a0 8y ago
There’s something that I don’t really understand regarding password managers which maybe you could explain. How is using a password manager to manage multiple passwords more secure than using a single password everywhere? In the case of a password manager, if your computer is breached, then all passwords are breached. If your passwords are hosted encrypted on a website, then if that website is breached, the master password you send it will be visible to the attacker, and thus all passwords are breached. In the case of using the same password everywhere, if one website is breached, then the password to all sites is breached. Am I missing something?
- CJefferson 8y ago
  Think of it this way -- your password managers password never gets passed to untrustworthy websites, so there is a very small chance it would ever get breached. You now only have to trust one website/program, rather than every website (and we have evidence that many major websites can't be trusted with our passwords).
- itmeyou 8y ago
  When using a single password for all sites, any malicious or breached website exposes access to all your accounts. When using a password manager, only a breach of your computer or the password manager itself (or your email) will totally pwn you. Breaches online are very, very common, and I would expect any password used on every single website you use to get leaked quickly.
- zeeZ 8y ago
  If your computer is "breached" then it doesn't matter where your passwords come from. They could just run a keylogger and get them that way. It really depends on your threat model. No system is perfect and we're mostly balancing security and convenience most of the time. The same password everywhere is super convenient, but only one site needs to fail and it's all over. A cloud password manager with unique passwords protect from that. A local password manager eliminates the threat of them being compromised, but is less convenient if you have multiple devices. Storing your passwords offline on paper in a safe protects your from someone getting read access to your PC or outright stealing it, but is annoying and gets more inconvenient based on your passwords entropy.
dawnerd 8y ago
I like to call those sites out and have submitted some to https://github.com/duffn/dumb-password-rules https://github.com/duffn/dumb-password-rules
- clan 8y ago
  Put Microsoft at the top. Office 365 has a maximum password length!!! No more than 16 characters, thank you very much. If they cannot get it right, how does that leave the rest of us?
jrootabega 8y ago
and allow spaces
- pbhjpbhj 8y ago
  But then the support workers might cut-and-paste it wrongly!

Dylan16807 8y ago

64? How much entropy is in the passwords you're pasting? While holistically I like to see maximum lengths of 200+, personally I'm satisfied with 20 characters holding 119 bits of entropy.

erik_seaberg 8y ago
I find a passphrase (e.g., half a dozen words from the diceware list) easier to memorize than random gibberish and symbols, so it's disappointing that they're so rarely allowed.
- Dylan16807 8y ago
  I understand that entirely, but I'm asking someone that specifically said they don't type their 64 characters.
  - dwighttk 8y ago
    hey, I'm fine with 20 if you tell me ahead of time that is the maximum. My generator just goes up to 64, so that's where I start. Though I usually find through trial and error that 16 is the maximum in a lot of places...
deleted 8y ago
[deleted]

cm2187 8y ago

And not complain it doesn’t have enough entropy because it lacks special characters when it is a hex of a 128bit key! What I find the most annoying is that developers enjoy creativity for password validation. Some requires special characters, but only from 2 or 3 allowed special characters (what good does it even do in term of entropy???). Some limit the number of times a character can appear in a password, and I understand that it is meant to prevent people using “aaabbbccc” as a password but it also makes long passwords impossible. Many have an artificially low length limit (why would they even do that)?

technion 8y ago
I've implemented multiple such systems and I can say it's never been a case of the developer enjoying it. These dumb requirements always come from an exec that knows better. At one point a marketing manager informed me I "don't understand password security" while handing me a non-negotiable list of dumb mechanisms like you described.
- tialaramex 8y ago
  Yup. When I get tasked to do this I will usually end up building a system where you get a choice at the software configuration level: Do you want actual password security? We can do that. Otherwise, here's whatever nonsense is currently favoured by people who know nothing but set policy. Sometimes obeying policy _is_ negotiable but only for some users, so I could set the former configuration where I was able to negotiate and the latter for everybody else. For example "passwords are case insensitive" or "no spaces" is likely to be in the latter because someone in customer support finds it easier. "Use any halfway decent salted, pessimised hash" may be in the former, whereas "Use this specific named hash that you'll have to implement by hand because it's not offered in the language and libraries used by the system" is more likely to be in the latter I will say it's not necessarily "an exec that knows better". You're often playing a game of telephone with a third party such as a penetration test service, some government bureau or a "Being a CTO for Dummies" type text book. When it's a game of telephone in a large organisation it's unlikely you'll be able to fix it, it only takes one person with political cover between you and the person who originally said something like "I don't know, 16 characters?" to ensure that's a hard requirement you're now being tested against. My previous employer had systems that made it impossible for QA to get a "normal" customer experience, supposedly for "Network Security". A fraction of all pages loads at random are redirected to / on the correct site. All page loads. Image request, just logged in, made a post to a forum, anything might be turned into a request for the home page. Clearly it was a trivial config bug, and I even met people who knew which individual had made the configuration error, their name, where they worked, etc. But that person had political cover from VP level and so the bug was simply never fixed in the years I worked there. I've actually promised my entire ex-team lunch out if it's fixed while my retainer is still in place. I expect towards the end of the retainer I'll just go back to that city and take them out to commiserate, because the chances of it ever being fixed are so slim.

0db532a0 8y ago

There’s something that I don’t really understand regarding password managers which maybe you could explain. How is using a password manager to manage multiple passwords more secure than using a single password everywhere? In the case of a password manager, if your computer is breached, then all passwords are breached. If your passwords are hosted encrypted on a website, then if that website is breached, the master password you send it will be visible to the attacker, and thus all passwords are breached. In the case of using the same password everywhere, if one website is breached, then the password to all sites is breached. Am I missing something?

CJefferson 8y ago
Think of it this way -- your password managers password never gets passed to untrustworthy websites, so there is a very small chance it would ever get breached. You now only have to trust one website/program, rather than every website (and we have evidence that many major websites can't be trusted with our passwords).
itmeyou 8y ago
When using a single password for all sites, any malicious or breached website exposes access to all your accounts. When using a password manager, only a breach of your computer or the password manager itself (or your email) will totally pwn you. Breaches online are very, very common, and I would expect any password used on every single website you use to get leaked quickly.
zeeZ 8y ago
If your computer is "breached" then it doesn't matter where your passwords come from. They could just run a keylogger and get them that way. It really depends on your threat model. No system is perfect and we're mostly balancing security and convenience most of the time. The same password everywhere is super convenient, but only one site needs to fail and it's all over. A cloud password manager with unique passwords protect from that. A local password manager eliminates the threat of them being compromised, but is less convenient if you have multiple devices. Storing your passwords offline on paper in a safe protects your from someone getting read access to your PC or outright stealing it, but is annoying and gets more inconvenient based on your passwords entropy.

dawnerd 8y ago

I like to call those sites out and have submitted some to https://github.com/duffn/dumb-password-rules https://github.com/duffn/dumb-password-rules

clan 8y ago
Put Microsoft at the top. Office 365 has a maximum password length!!! No more than 16 characters, thank you very much. If they cannot get it right, how does that leave the rest of us?

jrootabega 8y ago

and allow spaces

pbhjpbhj 8y ago
But then the support workers might cut-and-paste it wrongly!