3 ms·

A better way to do this would have been: * hash current passwords with a salt, unique to each password entry, and throw away the plaintext entries. * keep a h

A better way to do this would have been: * hash current passwords with a salt, unique to each password entry, and throw away the plaintext entries. * keep a history of hashes per user, to prevent changing to a past password * ensure fair complexity of the incoming password * once the deadline has been reached, force users who have not yet changed their password to do a password reset via an online form * never, ever again think that doubling a password is a proper way to fix a security issue, ever...

ars 12y ago
> never, ever again think that doubling a password is a proper way to fix a security issue, ever... I don't think that's it, I think it's just to annoy people into changing it.
- jasonj79 12y ago
  I wondered the same, but I'm not sure that doubling my password would annoy me into changing it, especially when the password was previously capped at 8 characters.
lukifer 12y ago
> ensure fair complexity of the incoming password As we all know, a typical password validator formula is a great way to encourage people to choose "Secr3t!", or something else equally bad. I'd really like to see a password field that auto-generated pass phrases using full english words from a sufficiently large wordset (in the vein of "correct horse battery staple"), possibly even enforcing such phrases as the only valid type of password. Every user gets a strong password they can actually remember. (...although possibly a non-starter for mobile contexts.)
- reitanqild 12y ago
  Please don't enforce it. The moment you have a "sufficiently large wordset" in English you'd already added a whole lot of words that are hard to spell not only for non-native speakers. Why not try to generate semi random pronounceable passwords? There's a clear decrease in entropy but brute force cracking against all pronounceable strings less than 20 chars will still be hard. (Of course your definition of pronounceability might differ.)

ars 12y ago

> never, ever again think that doubling a password is a proper way to fix a security issue, ever... I don't think that's it, I think it's just to annoy people into changing it.

jasonj79 12y ago
I wondered the same, but I'm not sure that doubling my password would annoy me into changing it, especially when the password was previously capped at 8 characters.

lukifer 12y ago

> ensure fair complexity of the incoming password As we all know, a typical password validator formula is a great way to encourage people to choose "Secr3t!", or something else equally bad. I'd really like to see a password field that auto-generated pass phrases using full english words from a sufficiently large wordset (in the vein of "correct horse battery staple"), possibly even enforcing such phrases as the only valid type of password. Every user gets a strong password they can actually remember. (...although possibly a non-starter for mobile contexts.)

reitanqild 12y ago
Please don't enforce it. The moment you have a "sufficiently large wordset" in English you'd already added a whole lot of words that are hard to spell not only for non-native speakers. Why not try to generate semi random pronounceable passwords? There's a clear decrease in entropy but brute force cracking against all pronounceable strings less than 20 chars will still be hard. (Of course your definition of pronounceability might differ.)