4 ms·
In these cases, it makes sense to point people to NIST Special Publication 800-63B (Digital Identity Guidelines) https://pages.nist.gov/800-63-3/sp800-63b.html
by jwr 5y ago
In these cases, it makes sense to point people to NIST Special Publication 800-63B (Digital Identity Guidelines) https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html — their guidelines are pretty good and eliminate much of the braindead nonsense that is considered "accepted practice in the industry".
- vunuxodo 5y agoTaken to the extreme is the US Government's TreasuryDirect website, where individuals can buy savings bonds. Instead of allowing you to type your password, they render a "virtual keyboard" that you have to use your mouse to click the keys one by one. Oh, and that password? Not case sensitive.
- jolux 5y ago> Oh, and that password? Not case sensitive. What, you expect them to make a case-sensitive version of NTFS just to store your password??
- emodendroket 5y agoNTFS is case-sensitive.
- Agent766 5y agoThey made a case-insensitive version of NTFS just to store your password
- jolux 5y agoI think it’s internally case sensitive and provides case insensitive APIs to users, right?
- Barracoon 5y agoRight, win32 is insensitive
- bradknowles 5y agoIt is case-preserving, but not case-sensitive. So, it will show you what was entered and make you think it’s case-sensitive, but then when you go to do the comparison, it actually ignores case. The stupid thing is that MacOS was also case-preserving but not case-sensitive for a long time.
- nathell 5y agoAPFS still defaults to case-preserving: [nathell@macmini /tmp]$ echo first > A [nathell@macmini /tmp]$ echo second > a [nathell@macmini /tmp]$ cat A second
- emodendroket 5y agoThat's how Windows will behave but not actually how the underlying filesystem does.
- Slump 5y agoHard to believe it requires a mouse. The government (everyone really but especially the government) generally would need to follow basic ADA guidelines...
- ratcline 5y agoI heard that systems like this were designed when there was a point in time(this may just be erroneous and such a time never actually existed) where keyloggers were more common than RATs, so government websites would often have this requirement due to the higher probability of access from public computers(library, etc), since that was also a point in time when fewer people had their own at home.
- gnud 5y agoNice read! Specifically, under 10.1: > Offer the option to display text during entry, as masked text entry is error-prone. And under 10.2.1: > Support copy and paste functionality in fields for entering memorized secrets, including passphrases. (... snip ...) > Allow at least 64 characters in length to support the use of passphrases. Encourage users to make memorized secrets as lengthy as they want, using any characters they like (including spaces), thus aiding memorization. Do not impose other composition rules (e.g. mixtures of different character types) on memorized secrets. Do not require that memorized secrets be changed arbitrarily (e.g., periodically) unless there is a user request or evidence of authenticator compromise. (See Section 5.1.1 for additional information).
- juped 5y agoYes, the authors of that document did an great public service in letting us point to an "official government standard".