5 ms·

There does need to be some rules or else people would set their password to be blank or a few characters. I would be happy with consistent password rules. 1.

There does need to be some rules or else people would set their password to be blank or a few characters. I would be happy with consistent password rules. 1. No password that was included in a breach a la the “haveibeenpwned” hash check system[0]. 2. No password reuse. 3. A Minimum length. Something like 14-20 characters. And no maximum (or at least something set to at least 127 characters as the max allowed). 4. Reset no more than once a year. And that’s it. All valid UTF-8 characters accepted. No requirements for special characters or not, just long well randomized passwords, or more aptly, passphrases. Teaching everyone about password managers and diceware[1] passwords would go a long way too. [0]:https://haveibeenpwned.com/API/v3 https://haveibeenpwned.com/API/v3 [1]:https://en.wikipedia.org/wiki/Diceware?wprov=sfti1 https://en.wikipedia.org/wiki/Diceware?wprov=sfti1

waltbosz 5y ago
Max password lengths make no sense to me. > just long well randomized passwords, or more aptly, passphrases. Interesting idea. I could imagine a new password prompt with an algorithm to reject passwords that were not random enough. How infuriating would that be? What would the hint message look like: "your password must contain a statistically random arrangement of characters"
- kemotep 5y ago
  Using a password manager password generation tool or a diceware word list would be sufficiently random in my eyes but I get what you mean.
toto444 5y ago
> 4. Reset no more than once a year. That would make a lot of people's life terrible. I reset my passwords very frequently (almost every time I log out of a website)
- rstupek 5y ago
  I think they're implying the site doesn't force you to reset your password more than once a year.
- kemotep 5y ago
  I mean do not require passwords to be reset every 30,60,90 days etc. Ideally you would only force a password reset if they fell for a phishing attack or there was a breach of the hashed password database/auth system.
- Arrath 5y ago
  That seems..excessive. What is your motivation for that?
  - toto444 5y ago
    I don't write down most of my passwords so every time I log in I do a password reset. It is mainly out of laziness not for a security purpose.
    - Arrath 5y ago
      Wow, to each their own! For me this would be a nightmare and just lead to confusion as I would eventually find the distinction between the previous password and the latest one to be murky.
      - toto444 5y ago
        I just type passphrase in duckduckgo. It returns 4 random words.
- pixl97 5y ago
  I'm pretty sure the user means "required reset", rather than ones ability to reset at will.
iudqnolq 5y ago
Just use zxcvbn
- kemotep 5y ago
  Never heard of this before. Thanks for sharing.
andylynch 5y ago
This is very close to part of current NIST* / NCSC guidelines. I assume you mean no frequent /forced/ reset? * https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret
memco 5y ago
> 1. No password that was included in a breach a la the “haveibeenpwned” hash check system[0]. Now imagine that in some years every password below 20 characters has been in some breach on haveibeenpwned and now every user of every system needs a new password that is 21+ characters. Some period of time will occur wherein everyone will upgrade rinse and repeat. > No requirements for special characters or not, just long well randomized passwords, or more aptly, passphrases. I get your point, but these are incompatible thoughts: well-randomized requires certain levels of variation or it isn't well-randomized.
- kemotep 5y ago
  Well randomized as in not your daughter’s name and her birthday as a password. But I get what you mean. Diceware passwords can provide “sufficiently random” passphrases that, if the end user chooses, does not have to have any numbers or special characters. For the first part, yes at some point in the future, any password n-1 will be in the database. Getting users to get used to generating 20+ character strong passwords is a challenge today. Once we can solve that, through education, we can then move beyond passwords and single factor authentication.
mihaaly 5y ago
My favorite is when only a subset of special characters are allowed - and you must use special characters! Oh my god!

waltbosz 5y ago

Max password lengths make no sense to me. > just long well randomized passwords, or more aptly, passphrases. Interesting idea. I could imagine a new password prompt with an algorithm to reject passwords that were not random enough. How infuriating would that be? What would the hint message look like: "your password must contain a statistically random arrangement of characters"

kemotep 5y ago
Using a password manager password generation tool or a diceware word list would be sufficiently random in my eyes but I get what you mean.

toto444 5y ago

> 4. Reset no more than once a year. That would make a lot of people's life terrible. I reset my passwords very frequently (almost every time I log out of a website)

rstupek 5y ago
I think they're implying the site doesn't force you to reset your password more than once a year.
kemotep 5y ago
I mean do not require passwords to be reset every 30,60,90 days etc. Ideally you would only force a password reset if they fell for a phishing attack or there was a breach of the hashed password database/auth system.
Arrath 5y ago
That seems..excessive. What is your motivation for that?
- toto444 5y ago
  I don't write down most of my passwords so every time I log in I do a password reset. It is mainly out of laziness not for a security purpose.
  - Arrath 5y ago
    Wow, to each their own! For me this would be a nightmare and just lead to confusion as I would eventually find the distinction between the previous password and the latest one to be murky.
    - toto444 5y ago
      I just type passphrase in duckduckgo. It returns 4 random words.
pixl97 5y ago
I'm pretty sure the user means "required reset", rather than ones ability to reset at will.

iudqnolq 5y ago

Just use zxcvbn

kemotep 5y ago
Never heard of this before. Thanks for sharing.

andylynch 5y ago

This is very close to part of current NIST* / NCSC guidelines. I assume you mean no frequent /forced/ reset? * https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret

memco 5y ago

> 1. No password that was included in a breach a la the “haveibeenpwned” hash check system[0]. Now imagine that in some years every password below 20 characters has been in some breach on haveibeenpwned and now every user of every system needs a new password that is 21+ characters. Some period of time will occur wherein everyone will upgrade rinse and repeat. > No requirements for special characters or not, just long well randomized passwords, or more aptly, passphrases. I get your point, but these are incompatible thoughts: well-randomized requires certain levels of variation or it isn't well-randomized.

kemotep 5y ago
Well randomized as in not your daughter’s name and her birthday as a password. But I get what you mean. Diceware passwords can provide “sufficiently random” passphrases that, if the end user chooses, does not have to have any numbers or special characters. For the first part, yes at some point in the future, any password n-1 will be in the database. Getting users to get used to generating 20+ character strong passwords is a challenge today. Once we can solve that, through education, we can then move beyond passwords and single factor authentication.

mihaaly 5y ago

My favorite is when only a subset of special characters are allowed - and you must use special characters! Oh my god!