3 ms·

Direct link to Github: https://github.com/apple/password-manager-resources https://github.com/apple/password-manager-resources Seems like a good idea, instead

by dewey 6y ago

Direct link to Github: https://github.com/apple/password-manager-resources https://github.com/apple/password-manager-resources Seems like a good idea, instead of every password manager trying to re-implement the same kind of edge cases. One day I hope we can just "muss change" password because sites follow a common theme like https://wicg.github.io/change-password-url/index.html https://wicg.github.io/change-password-url/index.html - but maybe we have a better strategy than passwords until then.

deleted 6y ago
[deleted]
tialaramex 6y ago
If Apple wants to throw their weight around on this, that would be best directed at pushing sites to stop having stupid rules IMNSHO. Of the documented rules only minimum password length is even an excusable rule. Should your site accept 40kB passwords? No, but that's not a "maximum password length" rule at that point it's just common sense about unauthenticated payload sizes. Whereas this list includes limits of just eight characters and in one case simply 4 digits. The other restrictions - required or prohibited characters - and the shared credential quirk (systems that let you, indeed often require you to use the same credentials but on different FQDNs) are both making users less safe. While there's an argument that just documenting them is neutral I'd argue that for an outfit with Apple's clout it isn't enough and they need to be loudly calling for reform. That's tempered by the knowledge that Apple has never been very good at doing more than one thing. "Password stores" are definitely not the new iPhone, and so they can't pivot their whole company to this problem, and maybe in the absence of that level of focus this is all they can offer, but that's kind of a shame on its own.
- LaGrange 6y ago
  > Of the documented rules only minimum password length is even an excusable rule. Fun fact: bcrypt, still quite popular, has an inherent password length limit. Everything beyond a certain point (56 bytes) is just ignored. It's possible to work around, but that's messy and you're no longer do "the" bcrypt, bye bye interoperability. And if you don't enforce it, someone might do something silly-but-apparently-harmless, like reuse a long passphrase with some randomness at the end. Edge case, but not impossible. Of course in 2020 you probably should be using things like Argon or something (actually haven't researched the current best in a couple of years, so no longer sure)., but AFAIR Rails, for example, still comes with just bcrypt by default.
- Someone1234 6y ago
  This article[0] talks about why at least one company still has maximums. I too can relate to that, at my old job we had a 30 character hard limit because of interop with Oracle systems behind the scenes (we authenticated users twice, once in the web app which could have unlimited passwords stored as PBKDF2, and then again with an Oracle system that was hard restricted). A lot of businesses have backwards compatibility or proprietary systems in the way. [0] https://arstechnica.com/information-technology/2012/09/secret-microsoft-policy-limited-hotmail-passwords-to-16-characters/ https://arstechnica.com/information-technology/2012/09/secre...
- eli 6y ago
  Unfortunately I think they'd rather you just authorize everything against your Apple ID.
  - tialaramex 6y ago
    That's far from the worst outcome. There are anti-trust concerns in play of course, and we certainly don't want a world where anybody without an AppleID is a second class citizen, but from the security side such systems are a win-win for users and site owners.
vulcan01 6y ago
I feel like the GitHub link should be the submission link, not 9to5Mac which doesn't really give extra useful info...

by dewey 6y ago

deleted 6y ago

[deleted]

tialaramex 6y ago

If Apple wants to throw their weight around on this, that would be best directed at pushing sites to stop having stupid rules IMNSHO. Of the documented rules only minimum password length is even an excusable rule. Should your site accept 40kB passwords? No, but that's not a "maximum password length" rule at that point it's just common sense about unauthenticated payload sizes. Whereas this list includes limits of just eight characters and in one case simply 4 digits. The other restrictions - required or prohibited characters - and the shared credential quirk (systems that let you, indeed often require you to use the same credentials but on different FQDNs) are both making users less safe. While there's an argument that just documenting them is neutral I'd argue that for an outfit with Apple's clout it isn't enough and they need to be loudly calling for reform. That's tempered by the knowledge that Apple has never been very good at doing more than one thing. "Password stores" are definitely not the new iPhone, and so they can't pivot their whole company to this problem, and maybe in the absence of that level of focus this is all they can offer, but that's kind of a shame on its own.

LaGrange 6y ago
> Of the documented rules only minimum password length is even an excusable rule. Fun fact: bcrypt, still quite popular, has an inherent password length limit. Everything beyond a certain point (56 bytes) is just ignored. It's possible to work around, but that's messy and you're no longer do "the" bcrypt, bye bye interoperability. And if you don't enforce it, someone might do something silly-but-apparently-harmless, like reuse a long passphrase with some randomness at the end. Edge case, but not impossible. Of course in 2020 you probably should be using things like Argon or something (actually haven't researched the current best in a couple of years, so no longer sure)., but AFAIR Rails, for example, still comes with just bcrypt by default.
Someone1234 6y ago
This article[0] talks about why at least one company still has maximums. I too can relate to that, at my old job we had a 30 character hard limit because of interop with Oracle systems behind the scenes (we authenticated users twice, once in the web app which could have unlimited passwords stored as PBKDF2, and then again with an Oracle system that was hard restricted). A lot of businesses have backwards compatibility or proprietary systems in the way. [0] https://arstechnica.com/information-technology/2012/09/secret-microsoft-policy-limited-hotmail-passwords-to-16-characters/ https://arstechnica.com/information-technology/2012/09/secre...
eli 6y ago
Unfortunately I think they'd rather you just authorize everything against your Apple ID.
- tialaramex 6y ago
  That's far from the worst outcome. There are anti-trust concerns in play of course, and we certainly don't want a world where anybody without an AppleID is a second class citizen, but from the security side such systems are a win-win for users and site owners.

vulcan01 6y ago

I feel like the GitHub link should be the submission link, not 9to5Mac which doesn't really give extra useful info...