3 ms·

Suggestion: add a rating system, because some of these are more dumb than others. Also add an indicator or separate rating for requirements that make the passwo

Suggestion: add a rating system, because some of these are more dumb than others. Also add an indicator or separate rating for requirements that make the passwords too easy to guess like “no more than 8 characters”. e.g. > Coil > Does not allow simple characters and sequences such as '4587' or 'efgh' in password & necessarily requires numeric values. or Apple’s requirement that you cannot have more than 3 consecutive characters, seem reasonable to me. Certainly these rules ban perfectly fine passwords, but they’re a lot better than something like “must be between 8 and 16 characters and contain one uppercase, lowercase, number, and special character, but not these special characters, and it also cannot have an edit distance of 3 from your user ID”

jwestbury 4y ago
> Also add an indicator or separate rating for requirements that make the passwords too easy to guess This, naively[0], is all requirements except minimum length. Every requirement reduces the problem space for would-be attackers and increases the cognitive burden for users. [0] I recognise that with many modern techniques, password-cracking utilises common patterns rather than a brute-force approach.
MetaMalone 4y ago
+ 1. Let me filter by most to least insane.
duffn 4y ago
Good idea! I've added an issue for discussion here: https://github.com/duffn/dumb-password-rules/issues/445 https://github.com/duffn/dumb-password-rules/issues/445