6 ms·

Password policies of most top websites fail to follow best practices

kayxspre 4y ago
Adobe is one of the most frustrating website when dealing with password. Its requirement leaves me scratch my head to come up with any usable password that I can remember, to the point that I may be required to reset it every time I logged in (which, though not frequent, cause me to forget it).
zamadatix 4y ago
Composition policies seem to be one of the hardest things to stamp out, as is evident here where ~45% of top sites still use them. I got to talking about these types of policies with a friend who was asking about revamping the requirements at their company. I talked through it all, showed the math, showed how few extra minimum characters it takes to blow out all of the common complexity rules, talked about the simplicity, showed the latest research and recommendations from respected bodies, and in the end they still implemented them. Why? It'd be hard to explain the change to management and there was fear the users would be upset upon seeing the couple extra character requirement since they are already used to the complexity rules. Somewhat the "security theater" note in the conclusion but probably also a little bit of not wanting to argue with the Deloitte types of the world also mentioned in the conclusion. On the bright side they did at least add blocklists. It would have been interesting to see information on MFA in the dataset though. The paper notes MFA may be a reason sites have shifted their attention away from password security but seems to have skipped MFA during the data gathering process making it hard to say much about it. Beyond security strength MFA is also a powerful tool to attack another password policy problem - expirations. It allows you to answer the question of "how long should it be acceptable for an advisory to have access to a compromised account" with "it isn't" instead of "6 months" or whatever the annoying policy is. And sure, improperly implemented/insecure MFA could be a whole paper itself, but it's hard to make claims of how many sites have weak/strong password policy without at least a cursory look at that path.
- xyzzy123 4y ago
  NIST have updated their password advice but it's still not flowed through to other places like PCI, Australian ISM or tons of other standards. If you're setting an org-wide policy it should (at least in theory) comply with the intersection of all the other crappy standards you're stuck with.... which means password complexity and pointless expiration requirements for at least a few more years :-/ The paperwork/compliance lag issue mainly affects internal systems and directory, but can flow on to public sites as well.
theplumber 4y ago
Why people can't get it that passwords are plain stupid? I for once use the same password Azcbnm1]{} for all these websites requiring strong passwords. I don't care if my password has been leaked. Eventually all passwords are leaked.
- ranguna 4y ago
  Any recommendations as an alternative to passwords?
  - resoluteteeth 4y ago
    Fido/u2f can be used without passwords
  - toomuchtodo 4y ago
    https://news.ycombinator.com/item?id=31643917 https://news.ycombinator.com/item?id=31643917 https://fidoalliance.org/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard-to-accelerate-availability-of-passwordless-sign-ins/ https://fidoalliance.org/apple-google-and-microsoft-commit-t...
  - m-p-3 4y ago
    I'd be okay with public keys, but Fido/U2F/WebAuthn is more secure and simple to handle from the user perspective.
    - ranguna 4y ago
      I love the idea of hardware keys, but the issue with those is that everyone would have to get one, and that's only realistic on the long term. Also, a hardware key is much easier to get stolen then a password. On one side, passwords are breached of one or two websites, on the other side hardware keys get stolen and all your keys are out there. Another point against hardware keys is the current market: I'm trying to find a key with open source firmware with the ability to upgrade said firmware, but no luck so far. Good keys are all sold out or are being sold through crowd funding with months of waiting time. I'd love to use my EU eIDAS citizen card which requires a password to unblock (not a simple "touch to unlock" ) , which has signing capabilities, but I can't seem to find any usable software that allows me to expose my card as a fido device. So, for now I'll stick with my password manager.
mcraiha 4y ago
If you have to convince someone that they should drop those bad requirements, try to show them parts of Per Thorsheim's NDC Security 2022 talk. https://www.youtube.com/watch?v=pKP-nv2Oqdg https://www.youtube.com/watch?v=pKP-nv2Oqdg
NonNefarious 4y ago
Password policies? Ha! Let's start with the idiotic insistence that people use E-mail addresses as user IDs. Ever notice that security-critical sites never do this? I have yet to see a bank or brokerage enforce this dumb-shit policy. https://goldmanosi.blogspot.com/2012/06/forcing-people-to-use-e-mail-address-as.html https://goldmanosi.blogspot.com/2012/06/forcing-people-to-us...
- joaonmatos 4y ago
  Enlighten me: If I’m registering with my favourite store’s frequent costumer program and emails are “idiotic”, do I need to take the time to pick a username for a system with absolutely no social features, or do I just memorize the 12 digit long user ID (as opposed to my email, which I need to know regardless)?
  - NonNefarious 4y ago
    What “12-digit” thing are you on about? User IDs should be any string that a user cares to use, as long as it’s not taken. If he WANTS to use an E-Mail address, fine. But don’t force him to.
    - joaonmatos 4y ago
      So it is the first option - having to pick a random username for a website with no social features.
      - NonNefarious 4y ago
        What do "social features" have to do with any of it?
- arccy 4y ago
  instead they enforce even dumber policies, like choose a username that has to include a number, and we're going to mask out parts of it every time we display it

Adobe is one of the most frustrating website when dealing with password. Its requirement leaves me scratch my head to come up with any usable password that I can remember, to the point that I may be required to reset it every time I logged in (which, though not frequent, cause me to forget it).

zamadatix 4y ago

Composition policies seem to be one of the hardest things to stamp out, as is evident here where ~45% of top sites still use them. I got to talking about these types of policies with a friend who was asking about revamping the requirements at their company. I talked through it all, showed the math, showed how few extra minimum characters it takes to blow out all of the common complexity rules, talked about the simplicity, showed the latest research and recommendations from respected bodies, and in the end they still implemented them. Why? It'd be hard to explain the change to management and there was fear the users would be upset upon seeing the couple extra character requirement since they are already used to the complexity rules. Somewhat the "security theater" note in the conclusion but probably also a little bit of not wanting to argue with the Deloitte types of the world also mentioned in the conclusion. On the bright side they did at least add blocklists. It would have been interesting to see information on MFA in the dataset though. The paper notes MFA may be a reason sites have shifted their attention away from password security but seems to have skipped MFA during the data gathering process making it hard to say much about it. Beyond security strength MFA is also a powerful tool to attack another password policy problem - expirations. It allows you to answer the question of "how long should it be acceptable for an advisory to have access to a compromised account" with "it isn't" instead of "6 months" or whatever the annoying policy is. And sure, improperly implemented/insecure MFA could be a whole paper itself, but it's hard to make claims of how many sites have weak/strong password policy without at least a cursory look at that path.

xyzzy123 4y ago
NIST have updated their password advice but it's still not flowed through to other places like PCI, Australian ISM or tons of other standards. If you're setting an org-wide policy it should (at least in theory) comply with the intersection of all the other crappy standards you're stuck with.... which means password complexity and pointless expiration requirements for at least a few more years :-/ The paperwork/compliance lag issue mainly affects internal systems and directory, but can flow on to public sites as well.

theplumber 4y ago

Why people can't get it that passwords are plain stupid? I for once use the same password Azcbnm1]{} for all these websites requiring strong passwords. I don't care if my password has been leaked. Eventually all passwords are leaked.

ranguna 4y ago
Any recommendations as an alternative to passwords?
- resoluteteeth 4y ago
  Fido/u2f can be used without passwords
- toomuchtodo 4y ago
  https://news.ycombinator.com/item?id=31643917 https://news.ycombinator.com/item?id=31643917 https://fidoalliance.org/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard-to-accelerate-availability-of-passwordless-sign-ins/ https://fidoalliance.org/apple-google-and-microsoft-commit-t...
- m-p-3 4y ago
  I'd be okay with public keys, but Fido/U2F/WebAuthn is more secure and simple to handle from the user perspective.
  - ranguna 4y ago
    I love the idea of hardware keys, but the issue with those is that everyone would have to get one, and that's only realistic on the long term. Also, a hardware key is much easier to get stolen then a password. On one side, passwords are breached of one or two websites, on the other side hardware keys get stolen and all your keys are out there. Another point against hardware keys is the current market: I'm trying to find a key with open source firmware with the ability to upgrade said firmware, but no luck so far. Good keys are all sold out or are being sold through crowd funding with months of waiting time. I'd love to use my EU eIDAS citizen card which requires a password to unblock (not a simple "touch to unlock" ) , which has signing capabilities, but I can't seem to find any usable software that allows me to expose my card as a fido device. So, for now I'll stick with my password manager.

mcraiha 4y ago

If you have to convince someone that they should drop those bad requirements, try to show them parts of Per Thorsheim's NDC Security 2022 talk. https://www.youtube.com/watch?v=pKP-nv2Oqdg https://www.youtube.com/watch?v=pKP-nv2Oqdg

NonNefarious 4y ago

Password policies? Ha! Let's start with the idiotic insistence that people use E-mail addresses as user IDs. Ever notice that security-critical sites never do this? I have yet to see a bank or brokerage enforce this dumb-shit policy. https://goldmanosi.blogspot.com/2012/06/forcing-people-to-use-e-mail-address-as.html https://goldmanosi.blogspot.com/2012/06/forcing-people-to-us...

joaonmatos 4y ago
Enlighten me: If I’m registering with my favourite store’s frequent costumer program and emails are “idiotic”, do I need to take the time to pick a username for a system with absolutely no social features, or do I just memorize the 12 digit long user ID (as opposed to my email, which I need to know regardless)?
- NonNefarious 4y ago
  What “12-digit” thing are you on about? User IDs should be any string that a user cares to use, as long as it’s not taken. If he WANTS to use an E-Mail address, fine. But don’t force him to.
  - joaonmatos 4y ago
    So it is the first option - having to pick a random username for a website with no social features.
    - NonNefarious 4y ago
      What do "social features" have to do with any of it?
arccy 4y ago
instead they enforce even dumber policies, like choose a username that has to include a number, and we're going to mask out parts of it every time we display it