7 ms·
I'm glad someone is thinking about UX and ergonomics when it comes to passwords. Most people I interact with have by now realized that generating passwords is a
by mr_mitm 2y ago
I'm glad someone is thinking about UX and ergonomics when it comes to passwords. Most people I interact with have by now realized that generating passwords is a good idea. But if you are already generating the password, please do not include special characters. I regularly use different keyboard layouts (sometimes it is not even clear which layout is active, like in the vSphere web console), and the fact that passwords are often not shown on the screen when typing them makes for terrible UX and causes frustration.
The usual advice about character classes is only for casual users who don't know what makes a secure password. Entropy is the deciding factor: Ten random lower case letters is much more secure than "Summer2024!", which satisfies most password rules and has more characters.
Personally I stick to lower case letters for things like my Netflix password or Wifi key, because typing with a TV remote can be a huge pain. To keep a similar entropy, just increase the length by one or two characters.
- nothercastle 2y agoHow much more entropy do you really get for 1 additional capital letter. Probably only a few bits worth 8-12.
- candiddevmike 2y agoA 10 character password with all lowercase is 47 bits, if you do half upper/half lower it goes to 57 (using Shannon entropy).
- tzs 2y agoWouldn't that be 54.98 bits? 57 bits would be if you allowed mixed case with no constraint on how many are upper and how many are lower. With the constraint that it has to be half upper/half lower you only get 252 times as many passwords instead of 1024 times as many.
- zeta0134 2y agoYou multiply the entropy of the previous word by the added entropy of the new symbol. This grows exponentially! Extra character classes can help if you're stuck needing to make a really short password for some reason, but if you're randomly generating each symbol anyway, just tossing a few more on the end is *far* more effective. You massively increase the brute force search space with each additional symbol.
- plopilop 2y agoSwitching one uppercase letter in an otherwise lowercase password adds exactly 1 bit of entropy (per switched letter). On the other hand, any extra lowercase letter will increase the entropy by 4.7 bits (assuming a password on [a-z]). Given that most passwords have at best 2 uppercase letters, I would argue it is safer to force longer passwords than passwords with at least one uppercase letter.
- bryanlarsen 2y agoI imagine the main reason for the single capital letters is to make the password acceptable on those annoying websites with annoying requirements, not necessarily to add entropy. If you already know it's in apple password format, then you know 1/17 of the letters are capital, but not which one so the number of combinations you have to try is multiplied by 17, for just over 4 additional bits of entropy.
- lhamil64 2y agoHow often do people actually end up typing these random passwords though? Personally, I almost always can copy/paste or autofill. For devices like TVs, it seems like many of them let you pair via a QR code or other mechanism. And sure, there are times where you need to manually type a password, and for those specific cases you can use a different scheme (like avoiding special characters or using something like Diceware https://diceware.dmuth.org/ https://diceware.dmuth.org/) but I wouldn't go so far as to never include special characters. IMO if you expect to always be able to autofill, use as many character classes as possible.
- ezfe 2y agoEnough that it's worth thinking about. It's not frequent but it happens.
- mr_mitm 2y agoWell, I do it a lot. I do consulting in IT security and go through the onboarding process of a different company 15 times a year. My customers and co-workers are often security conscious and sometimes give me passwords like RC-A"c\EJe,0l@q. I prefer the US layout but live in Germany, so there is often a mismatch between my physical keyboard and the system I'm typing on, which causes me great frustration. Typing in the LUKS password of a VMware machine via vSphere web console does not allow copy/paste, neither does logging in to a physical device provided by the customer. I realize I'm far from a typical use case, which is why I'm so glad when people consider password ergonomics. It makes life easier for me and does not make it harder for anyone else.
- coldpie 2y agoIn the context of web authentication, does entropy even matter (beyond an extremely low threshold)? Are there any attacks that actually occur that are defeated by increasing entropy? AFAIK basically all the auth attacks we see today are from password re-use, and out-of-band authentication, neither of which password entropy has an effect on. "Summer2024!" is perfectly fine, if you use it for exactly one service. Frankly, "1235" is probably fine. No one is out there brute-forcing passwords.
- mr_mitm 2y ago> "Summer2024!" is perfectly fine, if you use it for exactly one service. Frankly, "1235" is probably fine. No one is out there brute-forcing passwords. Respectfully, I disagree. "Summer2024!" is probably the second password I'd try after the username itself if I have to guess a password. Use it in a password spraying attack on a company with 500 users and you will get a few hits, I promise.
- coldpie 2y agoIt's a fair point, but I think my argument still stands. Guessability is a different property from entropy, yeah? "Summer1975!" has the same entropy, but you probably wouldn't have put that into your password sprayer.
- joshka 2y agoSummer1975! would be equally likely to be checked by a password sprayer. It has the same number of hits on HIBP, and falls into a category where heuristic password guess algorithms would generally group them as being the same thing.
- nemo8551 2y agoMy old work used to give a default month-year-org name and an exclamation mark. The majority of people who still used it was insane. LinkedIn was a treasure trove for logging into accounts.
- jusssi 2y ago
- vbezhenar 2y agoI, personally, use my own password generator to generate passwords using 10 lowercase ASCII characters excluding ilo. That's 45 bits of entropy or one year of brute forcing trying 1 million attempts per second. I consider that a reasonable strength for all but the most important websites. The password generators that generate me 20 characters of different character classes are crazy.
- aniviacat 2y agoKeepassXC allows you to customize its password generator according to your preferences.
- seanw444 2y agoLove KeepassXC. Even if you don't want to go full offline, I think Bitwarden does the same.
- fencepost 2y agoBitwarden's password generation is actually a little weak - it's great at generating random gibberish passwords, but it seems to be randomized at the character level so you'll get things like "Cq$ypWocG6Byp#" - hard to remember, hard to type. It lets you specify length, upper, lower, digits, (limited) special, minimum # of digits, minimum # of special, and "avoid ambiguous characters" but that's the extent of it. Even the ability to have it group character types would be helpful if you're ever going to be typing on mobile devices. It also offers Passphrase generation using dictionary words plus digits and specials (as word separators). You can change the special character used, but it's not randomly chosen each time. I'd love it if it had an option for pronounceable or syllable-based generation as described in the article.
- vbezhenar 2y agoI'm using Apple Safari passwords storage, it's enough for me, but KeePass is definitely great.
- Aloha 2y ago
- brnt 2y agoI wasn't an Apple user until almost exactly a year ago, and the auto-generated passwords were an inspiration to me to cobble together a script that generates such passwords in multiple languages [1]. I couldn't find any info on these passwords, so I am glad this is posted, because indeed, I find the format brilliant! [1] https://pypi.org/project/applephrase/ https://pypi.org/project/applephrase/
- victor106 2y agoThis is awesome. Thank you
- Terretta 2y ago> The usual advice about character classes is only for casual users who don't know what makes a secure password. Arguably, it was to make early rainbow tables less feasible. > if you are already generating the password, please do not include special characters. This would make your generator useless on most sites. Since it's not the generator making up this rule, it's the web site's password "complexity" requirements. I do agree password strength tests should just measure bits of entropy and allow whatever's typed that's high enough.
- aftbit 2y agoI like to subvert those sites by just adding A1! to the end of every otherwise totally lower-case password. There is a special place in hell for anyone who creates a maximum password length limit, however. That prevents passphrases and gains nothing. If you're working with some weird legacy system that can't handle long password (worst way: just truncating them and matching the first 8 characters), then add Argon2 or heck even SHA where you otherwise add the password length check.
- mingus88 2y agoWhen I am forced to rotate an otherwise good password, I swap the suffix to the front of the password If they have some perverse check to make sure I am not re-using one of my last X passwords I just rotate in another permutation like A2!
- ziddoap 2y agoThis is the exact reason why NIST, for the better part of a decade now, has strictly recommended against arbitrary password rotations. All it accomplishes is frustration for users with no tangible increase in security (because everyone just increments their password, or follows other simple patterns). Some research suggests that arbitrary password rotations results in a real-world decrease in security, because as users get frustrated they make simpler and simpler passwords.
- 2y ago
- davedx 2y agoI stumbled across a website (think it was a CRM or CMS, I’m evaluating a lot at the moment) that wouldn’t accept an Apple generated password the other day because it didn’t comply with their password strength rules. These days that’s the kind of thing that will make me choose a competitor product
- echelon 2y agoOrdinarily I'd agree with small companies not being informed enough on security best practices and agree with your point. Small companies shouldn't invent security on their own. But there's something bigger here that stood out and that kind of makes me angry: Apple, a multi-trillion dollar company, is influencing people to stop using products by small companies and small teams. It's stuff like this, stuff like requirements to "sign in / pay with Apple", and stuff like the green text boxes that make you have to fit everything to Apple and give them their dues. I really wish we'd regulate or break up the big tech companies. Innovation has barriers to entry because of them. Apple shouldn't be making their own password standard. They should work in an industry consortium to agree across the board, and they should put in the extra effort to tell users when websites may not comply with their new rules. It's not the website's fault that they didn't get the new and unannounced memo. Add a new HTML password form property to indicate compliance with the standard before you go generating uncompliant passwords. Do a graceful migration. Stop beating up the little players. I'm starting to think that neither Google nor Apple should be allowed to have their own web browsers. They're only using them as a means to deepen their platform reach and hobble up more control. Pretty soon Apple and Google won't generate passwords at all. They'll deprecate the password field and mark it dangerous. Then it'll be an Apple passkey where companies will have to negotiate payment rates and won't be privileged to know their own customer.
- comex 2y agoIf Apple’s password manager required websites to indicate compliance before generating passwords for them, it would defeat the goal of a password manager to work with existing sites. It’s not like Apple invented the idea of a password manager. Reasonable sites should already allow passwords of the sort Apple generates, because they tick the usual boxes (length, entropy, and the pointless at-least-one-uppercase/digit/punctuation requirement). Now, many websites are not reasonable and enforce even-more-pointless requirements. Apple tries to mitigate this with a hardcoded list of popular websites’ password policies [1], which is used to tailor password generation for those websites. To be fair, this approach doesn’t scale for smaller websites. But there’s not much more Apple could do. In any case, at this point websites have had many years to adapt to Apple’s password manager and its password style (which has not changed recently). Accepting passkeys doesn’t cost money, and they’re based on a web standard. There are valid objections to passkeys but this ain’t it. [1] https://github.com/apple/password-manager-resources/blob/main/quirks/password-rules.json https://github.com/apple/password-manager-resources/blob/mai...
- fencepost 2y agoI still have fond memories of "Xyzzy" which was specifically listed as a "pronounceable password generator." That and YAPS on Palm (Yet Another Password Safe) were a great combination - and migrations through the years may mean that I still have a few of those passwords sitting in an unused corner of my current password storage. The iOS keyboard layout and behavior for many years undoubtedly made password rules like this a necessity - can't be mode switching all the time just to put in a password. Edit: Xyzzy could also be used to generate plausible drug names or RPG character names.
- bsimpson 2y agoLots of wifi points these days come with passwords like "heavycream502" that nobody bothers changing.
- IOT_Apprentice 2y agoMany corporations require you to have special characters as part of the password and won’t let you create one without them. This is in addition to authentication AND forcing an RSA soft token with a PIN. Many of these firms have had ransomware attacks and attempt to shield by having multilayer network DMZs which you have to traverse to reach a production network. Onerous mesh of required frequent password changes add to the mix. All done with a mishmash of security primitives.
- hoten 2y agoJust today I had to reset my Dropbox password b/c it had a "`" character, and I was trying to use a self-service printer at FedEx. Their weird touch keyboard didn't have backticks.
- ivanjermakov 2y agoSome characters felt illegal to use in passwords, like starting your password with space. Not only feels, but will not pass validation during sign up in many places.
- sebastiennight 2y agoYou're entering your Dropbox password on other people's machines? Was there no option to just share the document as a public link or something?
- hoten 2y agoI reset my password again shortly after.
- deleted 2y ago[deleted]
- RockRobotRock 2y agothose things are dogshit. It's really incredible how terrible and difficult Kinkos has made the process of printing. The email service has also never worked for me.