7 ms·
Elastic Cloud password complexity has an “OR” condition
- plugin-baby 4y agoNot sure about the specifics, but the concept looks reasonable.
- hoten 4y agoWhat does without complexity even mean?
- deleted 4y ago[deleted]
- racingmars 4y agoYou don't have to meet the requirements of "a mix of letters, numbers, and special characters." e.g. a 15-character password without complexity could be all lowercase letters.
- anarsdk 4y agoBeat me to it :D
- anarsdk 4y agoIt’s terrible wording, but I assume a passphrase, e.g. > john has many feats but this particular one is spectacular
- bagels 4y agoThe terms are not well defined enough in the dialog to know whether this is reasonable or not.
- dec0dedab0de 4y agoI hope this catches on. I hate making 30+ character passwords only to be told I need to add capitals and whatnot to be secure.
- jjeaff 4y agoAnd then some sites throw salt in the wound by requiring "at least one special character that is not # or % or whatever" so if you turn on special chars for your password generator, you have to manually filter through it to pull out said characters.
- rekoil 4y agoOr how about "Sorry, your password may be at most 12 characters long". Grinds my bloody gears. What irritates me more is knowing that the people who implement those solutions are probably here. Shame on you, go back and fix it right now!
- bacheaul 4y agoMore likely, people who are here are forced to implement security policies adopted by cybersecurity teams that have long since left the company, and the current cyber teams have no incentive or desire to changed said policies.
- fbdab103 4y agoMy favorite faux security thing I have run observed in the wild: Login with your password. Site then responds that we emailed you a security code, but the security code expires in five minutes. Immediately below that, it notes that the email may take up to four minutes to send. From experience, I think the note about slow emails is accurate. Who spent more than 30 seconds on that implementation thinking it was acceptable? Note that this is for a stupid intra-company fitness tracking thing (ie, I do not care at all about this data). Confirmation codes from my bank have a 30 minute window, but that is evidently too lax for step counting.
- pbhjpbhj 4y agoAliExpress! They give you something like 30s to enter the "2FA" code to log in, only it takes ~20s for the SMS to get to me. Took me 3 tries.
- cbhl 4y agoI hope this catches on, to allow more xkcd-style "correct battery horse staple" passwords
- Terretta 4y agojust make one word caps and divide them with a digit or two and a symbol or two instead of spaces
- rayanht 4y agoi like this, it’s very user-friendly; allows for both “battery correct horse staple”-style passwords and the randomly generated mess you’d get from a password manager
- ARandomerDude 4y agoStopped caring when I started using Bitwarden to autogenerate and store long, complex passwords. That was the real game changer.
- Semaphor 4y agoEvery once in a while, I have to actually type in a password manually. That’s why I’d prefer to simply use 32 alphanumeric lowercase characters. Sadly, abundant bad policies make that impossible (including: your password is too long…)
- runamok 4y agoThe worst is when they accept your long password only to truncate it silently so the password doesn't work when you use it to login.
- gibolt 4y agoI've had a site let me sign up with a 128 char password, but the input on the sign-in page was capped at 30. Edited the form element to log in, pinged them about the issue, and got it fixed
- shortcake27 4y agoThis is why I default to 16 alphanumerical chars. This is more than strong enough for random internet accounts but has less risk of truncation and easier to type if the need arises. Only if the account is super important will I bump up the entropy.
- Semaphor 4y agoIt’s far more often that I need mixed casing, or special characters. Length limits happen maybe 1 out of 10 times, not enough for me to change my defaults.
- fomine3 4y agotype=password + maxlength = disaster
- wodenokoto 4y agoSo ... 123456789012345 or passwordpassword
- modeless 4y agoOr, you could just do what NIST recommends and not impose arbitrary password requirements beyond being 8+ characters and and not appearing in a list of known passwords. https://pages.nist.gov/800-63-3/sp800-63b.html#:~:text=no%20other%20complexity%20requirements%20for%20memorized%20secrets%20should%20be%20imposed https://pages.nist.gov/800-63-3/sp800-63b.html#:~:text=no%20....
- kinggencha 4y agoI know I COULD, but my PO is telling me that they saw this on a really popular website and that we should really be doing it that way because the big guys obviously know what's right.
- Shank 4y agoI really like the compromise of using zxcvbn to calculate entropy and offer suggestions on how to make stronger passwords as a good compromise. It won't be tripped by password managers generating passwords, and it'll be usable enough for real humans that they won't mind dealing with it.
- samastur 4y agoWe use zxcvbn and allowing only good passwords (score >2) is already too hard for many people to figure out a usable password.
- atoav 4y agoDid you consider adding password suggestions? I do this. Generate 10 passwords and make them clickable.
- hdjjhhvvhga 4y agoThis is the only thing that makes sense. Asking the user to create a password that is complex enough is just a waste of their time.
- vinay_ys 4y agoKey risk with passwords is reuse across differently vulnerable websites/apps. Password complexity enforcement does nothing to address this risk. For many users it may actually push them to reuse passwords.
- atoav 4y agoUnless your rules force them not to. E.g. "you are only allowed to use unicode whitespace characters and ancient greek letters". Guarantueed to not be used anywhere else. On a more serious note: enforce minimum length, enforce that it is not in the list of most common passwords, enforce that the password is not their username/email and inform about the risk of password reuse. If an account is hacked because they used "password" as their password they won't care about your argument why it was hacked (and if you did things right you won't know what password they used). So better avoid that class of problem in front.
- kazinator 4y agoI finally got fed up with the special characters, digits and case bullshit and made myself this. https://addons.mozilla.org/en-US/firefox/addon/jp-hash/ https://addons.mozilla.org/en-US/firefox/addon/jp-hash/ https://www.kylheku.com/cgit/jp-hash/about/ https://www.kylheku.com/cgit/jp-hash/about/
- deanc 4y agoThis takes me to a dropbox page where I have to sign in.
- corentin88 4y agoOP is sharing a screenshot of a login form.
- bithaze 4y agoOn mobile, at least, Dropbox inserts their own interstitial page to download the app instead of immediately displaying the file, which may be what the parent comment is referring to. At a quick glance it might look like a login wall since you're obviously expecting to see an image instead.
- eCa 4y agoThere’s an X in the top right. (If you hadn’t posted I would’ve backed out of it too.)
- weird-eye-issue 4y agoOn desktop just press the X and on mobile click Not Now
- nesk_ 4y agoFYI, Github does the same thing too. I really like this way to ensure password robustness, users with password generators are not blocked by some absurd rules.
- snorremd 4y agoThe only requirement for passwords these days should be that the entropy is high enough and that the password is not in password leak databases. Anything other than that is simply asking users to reuse passwords across sites or annoying people who use password managers that generate too complex passwords. Passphrases are perfectly reasonable choices for passwords, but often run foul of the number and special character rules. Worst part is some sites even have very short max length rules for passwords. One can only suspect they either go around thinking people still memorize passwords, or worse, they store passwords in a varchar(12) DB column. The best bet would be to eliminate passwords alltogether using some combination of webauthn key authentication and some other user friendly factor (e.g. TOTP). But as long as passwords are here to stay, make them user friendly.
- pbhjpbhj 4y agoI was on a major UK broadband suppliers website yesterday, password required to be <= 16 characters ... /jackie-chan-meme ... doh, that's 17 characters
- danbruc 4y agoThe only requirement for passwords these days should be that the entropy is high enough [...] Which is at least somewhat non-trivial. What is the entropy of »abcd«? Four of four different characters, therefore 8 bit? Four hex digits, therefore 16 bit? Four lowercase letters, therefore 18.8 bit? Or even four letters, therefore 22.8 bit? Ad hoc I would say that 8 bit seems to be the best choice as one does not have to guess the underlying alphabet, but that probably means that you mostly get values quite a bit lower than password length times the logarithm of the alphabet size would suggest.
- Tostino 4y agoThe right thing to do is to assume the attacker knows the character set used for a brute force attack so they can limit the search space accordingly, and use that in your entropy calculation. You'd also want to do things like look for patterns, because tools like John the ripper absolutely do more than random guessing.
- atoav 4y agoMy services have three password rules: 1. the password has to be a certain length (8 or more) 2. the password is not allowed to be in the list of the most common passwords 3. username, email or similar is not allowed to be in the password
- FBISurveillance 4y agoI have a one-letter "a@domain.com" email address and I often have issues with services saying "your password contains your email address". Basically means that my passwords cannot contain letter "a". Find it amusing since I have to replace all "a"'s in my 1password-generated 30-char password with something else.
- atoav 4y agoShould put a minimum length on that rule
- postalrat 4y agoWebauthn can replace passwords if people finally accept that passwords can't be made into a good solution.
- lupire 4y agolength("passwordpassword") > 15chars