4 ms·
The "character class" requirement really doesn't add much security. And the "password rotation" policy can actually result in worse passwords than otherwise. Th
by the_snooze 5y ago
The "character class" requirement really doesn't add much security. And the "password rotation" policy can actually result in worse passwords than otherwise. Those measures were effectively just folk medicine from the days when the threat was thought to be someone manually trying to brute-force your password at your terminal.
- falcolas 5y ago> can actually result in worse passwords than otherwise Does actually. I still require some of the password "rotation" schemes folks would use when we were forced to change them monthly (not a typo, sadly): 1qaz2wsx -> 2wsx3edc -> 3edc4rfv... Pass1word -> Pass2word -> Pass3word...
- kps 5y ago“February, 2022” Upper case, lower case, digit, special character, does not match any previous password, changeable monthly without having to write it down…
- bachmeier 5y ago> The "character class" requirement really doesn't add much security. If you're generating your passwords randomly (using a password manager) it actually reduces security because it reduces the set of acceptable passwords.
- jonnycomputer 5y agoThat might be the only way to guarantee secure passwords across a platform/company. Of course, then you have to make sure people don't write it on sticky-notes under their desks...
- brendoelfrendo 5y agoRequiring special characters also reduces the set of allowable passwords by eliminating all passwords that don’t contain at least one special character. The best practice for maximizing the set of acceptable passwords would be to allow, but not require, special characters (and to allow as many of them as possible, not the narrow subset of special characters applications often allow).
- deleted 5y ago[deleted]
- jazzyjackson 5y agoLike how the Nazis thought they were so clever for preventing the enigma machine from repeating letters in the output. You’ve just reduced your entropy, sucka !
- gspencley 5y agoYou're probably right that, in practice, the character class doesn't automatically add security if the password is sufficiently strong and random. The theory is that by introducing special characters you're decreasing the likelihood of having characters that are commonly found together, thus decreasing the effectiveness of dictionary attacks. Of course modern dictionary algorithms will still look for characters that are commonly used as substitutes for letters ($ = s, # = h, ! = 1 etc.) so really you just want your password to be random, long and unique.
- the_snooze 5y agoThe NIST guidelines address that in a much more straightforward way: maintain a list of known bad passwords (e.g., HIBP) and prohibit users from using any of those. Character class requirements are pointless.
- iso1631 5y agoVast majority of passwords will have just 1 symbol, either at the start or end, or replace A with @, S with $, etc P@55w0rd! Is an awful password, yet meets many security policies P@ssword2, P@ssword3, P@ssword4 etc Also meet them, and rotate just fine. Meanwhile dadbffc67f798e8e0b7441fb995aeabe Is perfectly fine, but often is not allowed
- falcolas 5y ago> Is perfectly fine, but often is not allowed Nor is "correct horse battery staple". For wanting symbols, so many password systems really hate spaces.
- raverbashing 5y agoNot to mention it makes it harder to use the password in automated systems, as lots of places try to parse (or can't encode properly) $, /, -, and others.