6 ms·

For a nice counterexample, check out login.gov, the unified authentication service that seems to be replacing individual approaches at many US government sites.

For a nice counterexample, check out login.gov, the unified authentication service that seems to be replacing individual approaches at many US government sites. Their password requirements: “It must be at least 12 characters long and not be a commonly used password. That’s it!” [1] Oh, and login.gov allows pasting from a password manager. [1]: https://login.gov/help/creating-an-account/how-to-create-an-account/ https://login.gov/help/creating-an-account/how-to-create-an-...

droopyEyelids 7y ago
For more good .gov stuff, check out the dotgov Mac terminal theme https://github.com/lysyi3m/macos-terminal-themes/blob/master/schemes/DotGov.terminal https://github.com/lysyi3m/macos-terminal-themes/blob/master...
kube-system 7y ago
They're following the US government's own (very good) standard: NIST 800-63. It specifically bans most of these dumb practices listed in the OP. No 'security questions', no password hints, no special character or other composition rules, no short character limits, no routine expiration dates. The main idea is: let the user make the password they want, require two factor, and run their password against a list of known compromised passwords to make sure they don't pick something stupid.
pbreit 7y ago
I don't like that at all. 12 chars is much too long. And what does "not be a commonly used password" mean?
- ddeck 7y ago
  It means it's shouldn't be on this list[1] for example, because it makes brute force guessing from a dictionary of common passwords easy. - Of all the password databases breached in 2016, "123456" made up 4% of them [1]. [1] https://en.wikipedia.org/wiki/List_of_the_most_common_passwords https://en.wikipedia.org/wiki/List_of_the_most_common_passwo...
  - pbreit 7y ago
    123456 is not even a word. “Common passwords” is meaningless. I can’t even think of a “common” 12+ char password.
  - boring_twenties 7y ago
    What a fascinating rabbit hole. Most of these obviously come from users not giving even a single fuck, but what about #9, "trustno1"? For some reason I suspect those guys are thinking they're really clever and no1 will ever guess that. I'm also kind of surprised not to find some variation of "sesame" on here.
- snowe2010 7y ago
  Can't tell if you're being sarcastic or not...
  - pbreit 7y ago
    Serious. 12 char min for a password is silly. “Common passwords” is silly and meaningless. Together they make no sense.
tialaramex 7y ago
Ooh, also FIDO keys. Nice. This is 100% the best option listed (possibly not for actual US government employees, your employer issued token might arguably be better) because FIDO is strongly incompetence resistant, and when combined with the use of login.gov over each site having a separate login that's a huge security win. - FIDO keys don't have identity. Each FIDO key is different of course, mine can't be used in place of yours. But an activist can use the same key for their Facebook "Smash Exxon" page where they are never shown without mask and also for their login.gov ID where they sort out government affairs using their true full name and address, yet even if the government and Facebook and Exxon all work together they can't tell those are the same person from the credentials. - FIDO keys don't move secrets. There is usually a "secret" random value baked inside your key to make it unique, but everything sent back and forth is public, so if it leaks that's no big deal. login.gov could literally paint all the FIDO credentials it has on the side of the Capitol building for everybody to see and it would make no difference to security.

droopyEyelids 7y ago

For more good .gov stuff, check out the dotgov Mac terminal theme https://github.com/lysyi3m/macos-terminal-themes/blob/master/schemes/DotGov.terminal https://github.com/lysyi3m/macos-terminal-themes/blob/master...

kube-system 7y ago

They're following the US government's own (very good) standard: NIST 800-63. It specifically bans most of these dumb practices listed in the OP. No 'security questions', no password hints, no special character or other composition rules, no short character limits, no routine expiration dates. The main idea is: let the user make the password they want, require two factor, and run their password against a list of known compromised passwords to make sure they don't pick something stupid.

pbreit 7y ago

I don't like that at all. 12 chars is much too long. And what does "not be a commonly used password" mean?

ddeck 7y ago
It means it's shouldn't be on this list[1] for example, because it makes brute force guessing from a dictionary of common passwords easy. - Of all the password databases breached in 2016, "123456" made up 4% of them [1]. [1] https://en.wikipedia.org/wiki/List_of_the_most_common_passwords https://en.wikipedia.org/wiki/List_of_the_most_common_passwo...
- pbreit 7y ago
  123456 is not even a word. “Common passwords” is meaningless. I can’t even think of a “common” 12+ char password.
- boring_twenties 7y ago
  What a fascinating rabbit hole. Most of these obviously come from users not giving even a single fuck, but what about #9, "trustno1"? For some reason I suspect those guys are thinking they're really clever and no1 will ever guess that. I'm also kind of surprised not to find some variation of "sesame" on here.
snowe2010 7y ago
Can't tell if you're being sarcastic or not...
- pbreit 7y ago
  Serious. 12 char min for a password is silly. “Common passwords” is silly and meaningless. Together they make no sense.

tialaramex 7y ago

Ooh, also FIDO keys. Nice. This is 100% the best option listed (possibly not for actual US government employees, your employer issued token might arguably be better) because FIDO is strongly incompetence resistant, and when combined with the use of login.gov over each site having a separate login that's a huge security win. - FIDO keys don't have identity. Each FIDO key is different of course, mine can't be used in place of yours. But an activist can use the same key for their Facebook "Smash Exxon" page where they are never shown without mask and also for their login.gov ID where they sort out government affairs using their true full name and address, yet even if the government and Facebook and Exxon all work together they can't tell those are the same person from the credentials. - FIDO keys don't move secrets. There is usually a "secret" random value baked inside your key to make it unique, but everything sent back and forth is public, so if it leaks that's no big deal. login.gov could literally paint all the FIDO credentials it has on the side of the Capitol building for everybody to see and it would make no difference to security.