I hate password rules

https://www.schneier.com/blog/archives/2021/11/why-i-hate-password-rules.html

564 435 5 years ago

clement_b2• 5 years ago

Worse than password rules, are when sites disable the ability to paste in the password in the 'confirm your password' field. Forces users to reduce the 50 chars crazy password they wanted to set using their preferred password manager with a less secure version.

CurrentB• 5 years ago

https://chrome.google.com/webstore/detail/dont-fuck-with-pas...

This has been a greatly appreciated plugin for these scenarios (it's on Firefox as well)

selfhoster11• 5 years ago

I was going to mention that plugin as well. Its name is explicit with good reason.

GoblinSlayer6• 5 years ago

Drag and drop works for me in those cases.

Hamuko2• 5 years ago

I once had to open up my developer console and manually set the field with JavaScript because they didn't want me pasting into the password field. Although the site was also all kinds of broken so it might have actually been an accident that pasting into the field didn't work.

WorldMaker2• 5 years ago

I do this on quite a few sites. Most of the easy ones have an easy to find onpaste event wired in the DOM and it's a simple delete. I feel like there are so few legitimate uses of onpaste and the browser should have an easy override that if I ctrl+v three times in quick succession or something like that it ignores or disables onpaste events.

Alternatively, my password manager does have a decent "autotype" tool when all else fails.

slownews452• 5 years ago

No kidding. Govt websites seem to think this is a positive. Of course, these same folks do the 90 day rotation. Result - everyone writing down passwords on post-it notes next to screens.

JTbane• 5 years ago

The TreasuryDirect website requires login with a case-insensitive on-screen keyboard in the page itself. I have no idea why such an idiotic approach would be taken.

rav• 5 years ago

I use the following bookmarklet to fix issues like this. It's similar to the browser addon discussed in sibling comments, but without installing a browser addon. Simply create a bookmark named e.g. "Don't mess with paste" with the following URL:

javascript:void(document.documentElement.addEventListener('keydown',e=>e.keyCode==9&&e.stopPropagation(),true),document.documentElement.addEventListener('copy',e=>e.stopPropagation(),true),document.documentElement.addEventListener('paste',e=>e.stopPropagation(),true))

tzs2• 5 years ago

Note: keyCode is deprecated (but still works in most browsers). Supposed to use key nowadays.

enobrev2• 5 years ago

I read this comment earlier and just now had to come back and use it so I could paste an account number during a signup process.

You just improved my day.

Thanks!

pavon• 5 years ago

Or the site lets your password manager fill the fields, but for some reason their javascript doesn't recognize it and refuses to let you submit because it hasn't verified your password as matching, meeting strength rules, etc. At least in that case deleting and typing just the last character usually fixes it.

spookthesunset• 5 years ago

Probably some developer who isn’t fully up to speed with what event hooks to use in order to trigger their JavaScript validation rules. And yes it is super annoying.

…though not as annoying as sites that don’t let you copy / paste into their login fields.

atleta• 5 years ago

Besides the browser extensions/addons mentioned above (that sometimes either don't work for me or gets disabled on my machine) I also use/used to use xdotool (on Linux). You can do: `sleep 3 ; xdotool type "yourpassword here"` and then navigate to the field you want to have it typed into.

enobrev2• 5 years ago

Far too many sites seem to do this with bank account numbers, where you can't paste into the account number OR the confirmation field.

Now I need to drag my tab to another window and type it out (twice) and then read and confirm it. If I'm on mobile - forget it.

I'm far more likely to get my account number _and_ confirmation wrong if I type them rather than copy/pasting them in from my bank's site.

U8dcN7vx• 5 years ago

Keepass2Android's keyboard solves this for me.

antsar• 5 years ago

Thankfully, Firefox has an easy way to stop that.

about:config

    dom.event.clipboardevents.enabled = false

clement_b2• 5 years ago

Nice! Will try that one.

phist_mcgee2• 5 years ago

Beware that this may break certain applications that read from your clipboard

https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxClipboar...

banana_giraffe2• 5 years ago

I've had this in my AutoHotkey file for a long time now:

    ; Type in the clipboard
    ^!v::
    MyClip = %clipboard%
    StringReplace, MyClip, MyClip, `r, , All
    SendRaw %MyClip%
    return

So I can hit Ctrl-Alt-V and have it type in whatever's in my clipboard. I use it to scrub the text and deal with stupid sites and forms that don't allow paste. I also have a variant that adds a Sleep so I can do the same thing when something like RDP takes control.

wruza6• 5 years ago

Argh, if only AHK used some mainstream scripting language, at least in addition to its leetspeak. I will never learn it by practicing once in a year.

lanecwagner• 5 years ago

I write a Go package because I have similar feelings. https://GitHub.com/wagslane/go-password-validator

_wldu• 5 years ago

It would have been really nice if there had been an RFC or ISO standard for password composition. NIST 800-63B is probably the best advice available, but few people follow it and industry regulations (PCI) typically violate it.

kube-system• 5 years ago

NISTs regs are really good but I think they’d be more widely adopted if they had a cliffnotes version.

Something like: https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

beardyw• 5 years ago

Well I suppose this is trying to avoid people using obvious passwords but I'm not ever sure it works. At least password rotation ( = xxx1, xxx2 etc) has gone out of favour.

Ideally we need AI to say "No! Not your wife's birthday!".

GoblinSlayer6• 5 years ago

And what 16 characters limit is trying to do?

inetknght• 5 years ago

A hashed (and for correctness, salted) password will always have the same number of characters output from the hash whether the input password has one, ten, sixteen, hundred, or million characters.

Character limits are a symptom that the company wants to store some form of the password that hasn't been correctly and securely hashed.

falcolas• 5 years ago

At least password rotation ( = xxx1, xxx2 etc) has gone out of favour.

Not everywhere. Some contracts our org is engaged with specifies yearly password rotations for our single sign on system. Now guess how many folks rotate their passwords.

Tagbert2• 5 years ago

If your company accepts credit card transactions you have to comply with certification rules that require frequent password resets. That comes with a volume discount on post-its

latchkey6• 5 years ago

Instead of requiring people to have special password rules, we should require people to use a password manager.

Then, if you have special password rules, the manager could generate a strong password that fits into the defined rules.

Of course, getting rid of passwords entirely, is the best option (ie: using a decentralized sso solution).

fsflover6• 5 years ago

we should require people to use a password manager.

What if I am storing my passwords in clear text in a Qubes OS [0] virtual machine with no network?

[0] https://qubes-os.org

latchkey6• 5 years ago

I'm curious how you get your password from there and into a form on a website.

postalrat2• 5 years ago

Why require a password manager when you could require a hardware token instead.

Someone1234• 5 years ago

One costs money and requires a physical item, the other is commonly free, and you can sign in from multiple locations/devices.

Hardware tokens have only managed to prove that hardware tokens won't ever take off due to their inherent limitations and liabilities.

latchkey6• 5 years ago

I'll let you explain that to my 90 year old grandma.

(not that a password manager is really any better in this case)

Tagbert2• 5 years ago

How do I use that on my phone?

tzs2• 5 years ago

Personally, because I do not want a repeat of the great toilet paper escalation of 1984.

I used to buy toilet paper in individual rolls. I'd buy a couple rolls, and when I was on the last roll I'd make a mental not to myself to buy a couple more rolls next time I went grocery shopping.

One day, when I was on my last roll, I ate some bad fast food which left my digestive system in a state that one roll was not sufficient to handle. With much effort I was able to regain sufficient control for a very hasty trip to the convenience store.

From then on, I bought my TP in four packs, and put "get more TP" on my list whenever I had finished two rolls from the current pack.

Alas, another bad fast food experience managed to defeat even that, although I was again able to barely make an emergency trip to the store safely.

So I upped it to buying two 4 packs--but it was too late. I felt nervous even with 8 rolls on hand, so I started making sure I had 12 rolls all the time. Then as soon as I opened a pack I'd get an urge to buy more TP.

Every trip to the store I'd buy some TP.

It took some effort but I managed to realize I had gone off the deep end and bring myself back to more normal TP acquisition habits.

I'm afraid that the if I get a hardware token and a backup token, the first time something happens to the main token I'll end going down that same path I did with TP and end up with a couple dozen tokens.

pdonis• 5 years ago

we should require people to use a password manager.

And how could this possibly be checked except by allowing any random website that wants to use passwords to pwn my computer?

mojuba2• 5 years ago

An HTML input field can give your password generator a hint, right? Never looked at it closely but had the impression e.g. Safari's generator could adapt to certain rules and that they were somehow described in the HTML.

tikkabhuna• 5 years ago

Apple have "Password Rules"[1]. No idea how many password generators respect it though.

I've created a CodeSandbox example of it being used.[2] 1Password does honour it.

[1] https://developer.apple.com/password-rules/ [2] https://codesandbox.io/s/password-rules-demo-029h5

up6w6• 5 years ago

Bitwarden is on the way to support it.

https://github.com/bitwarden/browser/pull/2047

bobbylarrybobby• 5 years ago

Yep, https://developer.mozilla.org/en-US/docs/Web/HTML/Element/in... there's even an option for a regex pattern that the password must match.

mojuba2• 5 years ago

Interesting, that's different from what Safari supports (see sibling comment).

I wonder what the algorithm is to generate a good password that matches a given regex. Also there's a potential problem with patterns that are wrong or contain errors, that may result in simple and insecure passwords. I don't see how Mozilla's approach is better than Safari's.

robotears• 5 years ago

My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).

randomluck040• 5 years ago

Wait, what? That never happened to me. How do you go and find out your password then? Trial and error?

ylere• 5 years ago

I had it happen a few times. Usually I would reset it a few times until realizing that it's obviously not saving the password I'm entering, at which point I would try a setting a shorter one.

phepranto• 5 years ago

They might just truncate the password during login as well. I was able to login to my online banking using only the first five digits of my password not more than 3 years ago.. They fixed it in the meantime but I'm still worried.

Maultasche• 5 years ago

That happened to me many years ago with Microsoft logins. They were truncating passwords to 12 characters and my generated 16-character passwords never worked. I kept resetting them over and over until I did a Google search for Microsoft password requirements and found out that they were being truncated.

That was likely fixed a long time ago, but I'm still wary of increasing my Microsoft passwords past 12 characters.

mooreds2• 5 years ago

Trial and error?

Bingo. Super frustrating.

See also this comment: https://news.ycombinator.com/item?id=24827031

Macha• 5 years ago

I once had a bank that used substr(tolower(input_password), 0, 8) as the actual password.

teawrecks4• 5 years ago

T-Mobile did this to me a few years ago. Don't know if they still do, but I couldn't believe anyone thought that was ok.

jbarberu• 5 years ago

And then their sign-in page doesn't truncate it and it just fails to login... Absolutely love it!

One of my favorites was Nintendo's user account. The web allows decent passwords when created, but then the actual game console only has room for inputting 15 characters or so for the password :@

kevincox2• 5 years ago

I've even seen it backwards (I assume) where creating the account with the longer password worked but then I couldn't sign in with it or any prefix of it.

reaperducer6• 5 years ago

The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me

Or worse, they truncate your password after you've already used it for years and years.

I had a 30-character password with Bank of America. Somewhere along the line, it changed its password requirements to only allow a maximum of 20 or 25 characters (I forget), which automatically invalidated my password.

The password was stored in my password manager, so I knew I wasn't entering it wrong.

BoA support said I should use the "change password" feature to update my password, but I couldn't because it requires me to enter the old password, which it would not accept. For some reason I can't remember, I couldn't use the "forgot password" feature. Maybe it also didn't work right.

I spent an entire day on the phone getting bounced from person to person before finally someone was able to take a new password over the phone.

Since Bank of America can't figure out how to build a web site login, I no longer trust it with my money. I emptied that savings account and paid off the credit card as quickly as I could. I no longer use BoA.

pbhjpbhj• 5 years ago

So, for a bank the maximum is to allow NSA to crack it if they wish, right?

nzach• 5 years ago

Or worse, they truncate your password after you've already used it for years and years.

Worse than that must be the sudden realization that your bank probably saves your password in plain text somewhere.

gonehome4• 5 years ago

I'm not sure why anyone uses banks like BoA, Wells Fargo, First Niagara, etc.

Fidelity is a superior experience in nearly every way - just categorically. I'm not sure if people just don't know that you can use Fidelity this way?

The only downsides are no local branches, but that's hardly an issue unless you need a cashiers check. In those rare cases you can spin up an account at shitty bank, get the check, then close the account. I've had to do that maybe once ever.

throwawayboise3• 5 years ago

Supermicro BMC passwords do that. Recently (i.e. this year) I set up a bunch of servers and was setting the BMC password to a known value.

Apparently there is a limit of 20 characters for the password. The password I set was 21 characters (which was accepted without error).

When I tried to log in with this password, the login was rejected.

However if I log in with just the first 20 characters of the password, it works.

sleavey• 5 years ago

They should at least make their sign-up and login password fields have the same max length attributes...

nulbyte• 5 years ago

However if I log in with just the first 20 characters of the password, it works.

Even worse is when the password change form accepts more characters and processes them correctly, only to have the login form not allow you to enter all characters. If I'm not mistaken, the business remote deposit portal my bank uses does this.

justusw• 5 years ago

Could that mean that the password is stored unhashed?

dataflow3• 5 years ago

Can I ask what length your passwords are (roughly)? I don't understand the motivation for anything long in the context of randomly generated passwords for websites. 8-10 characters should be plenty.

(This isn't to excuse silent truncation.)

loa_in_2• 5 years ago

My passwords are all 20+ characters long

loa_in_2• 5 years ago

My passwords are long because I don't actually use a password manager. I generate my passwords with a help of my algorithm that makes them easier to type in wherever I might need them (resemble real words) like in a terminal.

Larrikin• 5 years ago

Outside of things that need to be extremely secure like my AWS account password I usually prefer readable random words passwords over random text. Even random 2 word passwords usually surpass 20 characters especially after adding in numbers and special characters most sites require.

It's a lot nicer being able to check if I typed in my Peacock login at my parents home at a glance versus a string of random characters.

NoGravitas3• 5 years ago

"correct horse battery staple" is 28 characters. And it really should be two words longer than that these days.

iso16316• 5 years ago

If you're using a random password, c29b90b0e25ece3f2dabcef496d22103 is fine for a password, 2^128 bits. It's a right pain to type in on a console though.

On the other hand, "rundown skyline pluck shawl pastrami radar refueling poach prankster durable" is far easier to type and is about the same entropy

SAI_Peregrinus• 5 years ago

All my passwords are passphrases, randomly generated and stored in my password manager. Usually 10 words, for about 130 bits of entropy. EG PledgeRoutineSuitableBunkhouseExceptionCremeReassureChildishPhrasingNuclear, which is 76 ASCII characters but only 10 symbols.

They're stored in a password manager, but they're typeable if needed. My "security question" answers (mother's maiden name, etc) are generated the same way, unique per use, and also stored in my password manager.

Most sites don't need 128 bits of entropy. But things like banking or subscriptions should have at least 112 bits of entropy. And it's easy to just set the generator to 10 words by default.

gregmac2• 5 years ago

I usually generate passwords in the ~32 character range, using A-Za-z0-9, specifically to catch sites with dumb security policies (maximum number of characters, or considering `aceg1234!` a stronger password than `MgHm7MC8kEuXWKEzD7CvDgxCtWssz964`).

In most cases I just comply with their dumb policy and put a snarky comment for my future self in the Notes field of my password manager and it makes me feel better.

smoe• 5 years ago

I use a password manager and randomly generated ones for most everything, but I use diceware pass phrases I memorized for specific cases so that in an emergency, e.g. when traveling I can get access to some things even without any of my devices.

memco2• 5 years ago

I've also had fun experiences where the "special characters" differ in the description than in the implementation in a few ways.

Once I had a password accepted with non-alpha numeric characters which were considered invalid as input on the login screen and so even though my password was correct it would not let me log in because it was validated with different logic after creation.

Another issue I've seen is that the password was required to have only a certain subset of non-alphanumeric characters, but it did not explain or validate this client side so I had a password for which all the boxes turned green, but was still invalid.

In both cases only trial and error worked to find a valid password.

Causality12• 5 years ago

I spent half a year being charged monthly by Microsoft because Google considers my email address the same whether or not it has a period in it but Microsoft had somehow split my account into two based on that difference.

NathanielK2• 5 years ago

For a while, Discord had few password restrictions so 5 characters were fine. Then they changed their app to only allow 6+ character passwords.

hnlmorg• 5 years ago

EE does this on their website but not on their mobile app. Took me ages of debugging to figure out why my password manager worked on one platform but not the other. I was so annoyed when I realised what it was.

Zircom• 5 years ago

Yeah you'd be surprised where it happens. I used to work on the help desk for a company that operated nuclear power plants, and their password system would only accept 8 character passwords, alphanumeric only. However, the length checking would randomly fail and users would be able to set a longer password and the system would silently truncate it without throwing an error or alerting the user in any way.

davchana• 5 years ago

Exactly. Indian Retirement Fund, PF, National Pension System, has a rule of max 16 chara in password. They don't tell this at password reset or set. They simply accept anything 16+ length; & silently truncate & use the first 16 chars. But user is never told. When I try to login later, it says password wrong. I had to reset it multiple times, because my password manager was generating longer ones.

teawrecks4• 5 years ago

This has happened to me on one site. As far as I'm concerned, this is just a bug.

thamer• 5 years ago

Worse: I once set my E*Trade password to something it accepted but wouldn't recognize when I tried to log in… because it was too long.

After changing it I got locked out of my account and had to call support to resolve the issue. The worst part was that after verifying my identity over the phone they kept sending me reset links and I kept using long passwords generated by 1Password (30 characters IIRC) and it always accepted them when resetting but still would never let me log in.

It took many attempts and new reset links until they suggested trying a shorter password, which was eventually accepted both during reset AND login. Of course the reset page didn't mention a maximum length.

zhynn• 5 years ago

It gets worse: if you use 2fa the security code generated by the symantec thing is just appended to the password, so if your password is still a valid length, but then the 2fa takes it over 30 chars, it fails. It is the worst.

Pxtl• 5 years ago

If they truncate on password set but don't truncate on password validation, that's the worst.

jer0me• 5 years ago

I'm not super knowledgeable about these kinds of things, but aren't hashes usually a fixed length? Why would it matter how long your password is?

EmilioMartinez• 5 years ago

My favorite one was a site that capped the password length in the creation form in a way you couldn't tell it was being truncated, but then let you enter any length when you logged in. And being a finance thing, it blocked your password after three attempts.

kspacewalk2• 5 years ago

Due to the nature of my job and the age of some of my coworkers, I am sometimes casually given passwords on a piece of paper. Out of a sample size of conservatively 20, I have never even once (!) seen a special character other than !. It just doesn't happen. Password rules and a requirement to change your password every X months are pure security mirage and just create frustration in people who often struggle to generate even one secure password in their entire lifetime.

(Yes I evangelize password managers around here. So far I've converted 2-3 people. They are the important people with shit people might want to steal on their computers/accounts, so I'm happy with this.)

handrous3• 5 years ago

Password rules and a requirement to change your password every X months are pure security mirage and just create frustration in people who often struggle to generate even one secure password in their entire lifetime.

Every place I've ever seen or heard about with a "change every X months" system, everyone just uses a (often shared!) formula to come up with variations that satisfy the is-this-too-close-to-your-last-X-passwords checker, based on the date or whatever.

kayodelycaon2• 5 years ago

I got up to P@ssW0rd12 at one job.

BeFlatXIII2• 5 years ago

Frequent password rotation causes increases of passwords on post-its stuck to the monitor.

kevincox2• 5 years ago

In most cases I would take a strong password stuck to the monitor than a dictionary password on an internet exposed system.

But yeah, frequent password rotation is still bad.

scrooched_moose• 5 years ago

Sounds like we have similar roles. I've never gotten them on paper, but multiple times a month I get emails along the lines of "My account doesn't work. My password is Banana1. Please fix". Every time I reset every single password they have (at least 4 hours of work for them) and inform them not to share passwords. Still, I've had users do it multiple times.

I finally got all of our admin/root passwords into a password manager with sharing among job functions and our CTO as backup to ensure some level of continuity. After losing passwords to multiple production systems after someone leaving the company it was still a battle.

rudian2• 5 years ago

Congrats on getting them to use a password manager, now everyone can see all of their password by typing in the master password they stuck to the side of the screen.

I'm only half-joking sadly, people just don't understand why password exist in the first place, so they comply maliciously.

frosted-flakes• 5 years ago

Requirements for uppercase letters, numbers, and special characters mean I stick an "A1!" at the end of my otherwise strong and memorable password. I'm sure I'm not the only one.

Ajedi32• 5 years ago

Yeah, at least there's a good work-around for the numbers/symbols requirement. What's more annoying is when sites have a low maximum length so you _have_ to use special characters to get good entropy, or when they have other bizarre requirements like "can't contain more than 3 of the same character".

passer_byer• 5 years ago

You would be correct. Mine is "#1". I use compound english words whose meaning is non-sensical in a conversation but easy to remember.

kemotep5• 5 years ago

There does need to be some rules or else people would set their password to be blank or a few characters.

I would be happy with consistent password rules.

1. No password that was included in a breach a la the “haveibeenpwned” hash check system[0].

2. No password reuse.

3. A Minimum length. Something like 14-20 characters. And no maximum (or at least something set to at least 127 characters as the max allowed).

4. Reset no more than once a year.

And that’s it. All valid UTF-8 characters accepted. No requirements for special characters or not, just long well randomized passwords, or more aptly, passphrases.

Teaching everyone about password managers and diceware[1] passwords would go a long way too.

[0] https://haveibeenpwned.com/API/v3 [1]:https://en.wikipedia.org/wiki/Diceware?wprov=sfti1

waltbosz• 5 years ago

Max password lengths make no sense to me.

just long well randomized passwords, or more aptly, passphrases.

Interesting idea. I could imagine a new password prompt with an algorithm to reject passwords that were not random enough. How infuriating would that be? What would the hint message look like: "your password must contain a statistically random arrangement of characters"

kemotep5• 5 years ago

Using a password manager password generation tool or a diceware word list would be sufficiently random in my eyes but I get what you mean.

iudqnolq2• 5 years ago

Just use zxcvbn

kemotep5• 5 years ago

Never heard of this before. Thanks for sharing.

toto4443• 5 years ago

4. Reset no more than once a year.

That would make a lot of people's life terrible. I reset my passwords very frequently (almost every time I log out of a website)

rstupek• 5 years ago

I think they're implying the site doesn't force you to reset your password more than once a year.

kemotep5• 5 years ago

I mean do not require passwords to be reset every 30,60,90 days etc. Ideally you would only force a password reset if they fell for a phishing attack or there was a breach of the hashed password database/auth system.

Arrath5• 5 years ago

That seems..excessive. What is your motivation for that?

pixl97• 5 years ago

I'm pretty sure the user means "required reset", rather than ones ability to reset at will.

andylynch2• 5 years ago

This is very close to part of current NIST* / NCSC guidelines. I assume you mean no frequent /forced/ reset?

* https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret

memco2• 5 years ago

1. No password that was included in a breach a la the “haveibeenpwned” hash check system[0].

Now imagine that in some years every password below 20 characters has been in some breach on haveibeenpwned and now every user of every system needs a new password that is 21+ characters. Some period of time will occur wherein everyone will upgrade rinse and repeat.

No requirements for special characters or not, just long well randomized passwords, or more aptly, passphrases.

I get your point, but these are incompatible thoughts: well-randomized requires certain levels of variation or it isn't well-randomized.

kemotep5• 5 years ago

Well randomized as in not your daughter’s name and her birthday as a password. But I get what you mean. Diceware passwords can provide “sufficiently random” passphrases that, if the end user chooses, does not have to have any numbers or special characters.

For the first part, yes at some point in the future, any password n-1 will be in the database. Getting users to get used to generating 20+ character strong passwords is a challenge today. Once we can solve that, through education, we can then move beyond passwords and single factor authentication.

mihaaly• 5 years ago

My favorite is when only a subset of special characters are allowed - and you must use special characters! Oh my god!

mooreds2• 5 years ago

Is it password rules he hates or the UX around the password rules?

I just read the post and if the system response had been "You must have 2 numbers in your password", well then, okay, easy enough to do. An annoyance rather than a hatred.

Not that I think password rules are great. They can, if used poorly, unnecessarily constrain the space of passwords. But they are often required by certain compliance situations.

I love my password manager and think everyone should use one, myself.

Another alternative is the FIDO passwordless technologies that are being rolled out more and more. Though I saw a tweet the other day that said "Biometric identification is a username not a password" that made me think about that.

iudqnolq2• 5 years ago

The problem with that is I then have to open my password manager, append "11" to my perfectly secure password, and save it. Just use zxcvbn.

andylynch2• 5 years ago

This is why current standards say password complexity rules are a terrible idea (or officially a SHOULD NOT), and have for a while. I’m baffled as to why these rules endure.

throwawayboise3• 5 years ago

I've simplified the rules I enforce because it was just getting out of hand. I enforce a reasonably long minimum length, and enforce a limit on number of repeated characters in a row (so someone can't set a password of "aaaaaaaaaaaaaaaa")

That's it.

eckesicle• 5 years ago

NIST best practice recommendations state:

* Require more than 8 characters

* Don't require special characters

* Don't force the user to reset their password

* Do check for compromised passwords

* Require MFA

* ...

All very sensible.

https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

crooked-v• 5 years ago

I have multiple financial accounts that still insist on using public-knowledge security questions (which of course I've given fake answers saved in my password manager) instead of just letting me set up proper 2FA. It's infuriating.

jliptzin2• 5 years ago

Citibank is particularly egregious. 8 character MAXIMUM length, lots of special characters not permitted while requiring numbers and letters, forced password changing every few months, I absolutely hate it.

kibwen• 5 years ago

Treating security questions like passwords and saving them in your password manager is correct, but make sure that your fake answers aren't autogenerated nonsense like ":s^Twd.J;3hzg=Q~". Many password reset flows involve communicating a security question over the phone, and it's easy enough for an attacker to guess "oh, it's just a bunch of random characters lol" and for the phone rep to just laugh and shrug their shoulders and let the person in. Make sure it's a sentence that makes sense (I would even avoid non-sequitur passphrases such as those generated by diceware), while also making sure that it has no relationship whatsoever to the question.

matheusmoreira2• 5 years ago

Yeah, my bank does that too. Asks for my birthday for "security" reasons. They also kill their website's usability by forbidding physical keyboards and forcing users to use a virtual keyboard with randomized key layouts in order to type passwords in a feeble attempt to defeat keyloggers. Some banks even make it extra annoying by generating ambiguous keys like "1 or 7" or "2 or 3".

The saddest thing is banks can't be too secure. If they were, then they would be too hard for normal people to use and they would get locked out of their funds.

rapht• 5 years ago

Don't get me started on online bank security. Here in France, most banks have decided that security is best achieved by:

- authenticating using a 'client number' (different from your 'account number', sent to you once by a physical mail you lost long ago) combined with a 4-to-6 digit (numeric-only) passcode that you have to input on a virtual keyboard

- confirming web-initiated transactions via their app on your phone... but when it's app-initiated, well, you don't have to confirm anything other than just retype your passcode

- in the end, introducing some awfully long delays between some actions e.g. creating a new beneficiary and being able to send money to her... because 'it's for your own protection that we degrade your client experience'

This just bugs me.

stjohnswarts4• 5 years ago

Yeah my bank does this. I've been meaning to call around and find a credit union that has 2FA and doesn't require this garbage. I changed my questions to a randomly generated password and put it in my password manager.

bsid2• 5 years ago

Yup. So many people mess this up, it's infuriating. U.S. banks are the worst.

beermonster2• 5 years ago

Even outside of the U.S.

632• 5 years ago

Interestingly, one of the studies they cite finds that blocking common passwords is one of the most frustrating experiences for users. Even though it's more secure, the user has no idea what's wrong with their password or how to correct it.

kylebyproxy• 5 years ago

I can't say how common this is, but many (most?) online accounts I personally interact with are disposable, represent no sensitive information, and I couldn't care less if they're compromised. They're one-time sign-ups, junk accounts, free trials, free tiers, etc.

one of the most frustrating experiences

I understand this frustration as a mismatch between the user's non-expectation of security and the service's obeyance to industry security best practices.

Placing a cognitive burden of memorizing a new password just to try out your product strikes me as cruel.

Maybe only enforce password rules as progressive enhancement once sensitive information comes into play? After all, what's the point of protecting junk?

rocqua• 5 years ago

Link? That sounds like an interesting study.

colinclerk2• 5 years ago

Disclosure: I am the cofounder https://www.clerk.dev

Here's the direct link to NIST 800-63B - it's really a fantastic document with sensible recommendations on every authentication method: https://pages.nist.gov/800-63-3/sp800-63b.html

The tedious part of NIST's password requirements is "Do check for compromised passwords"

HaveIBeenPwned exists, but most open source tools don't leverage it and this requirement goes overlooked.

At Clerk, we follow NIST guidelines by default, including integration with HIBP. In a world with password reuse and "credential stuffing" attacks, this feature is critical to securing your user accounts (unless you go full passwordless, but that has its own tradeoffs).

amanzi2• 5 years ago

The important part is that the NIST password advice is meant to be read as a whole. Often I see people quote snippets out of the advice, but unless you read and understand the whole document, you run the risk of reducing your security posture.

scoot• 5 years ago

Off-topic, but this is the second time in two days that I've seem someone on HN correctly use "disclosure" when disclosing something, rather than "disclaimer". A sea change?!

It's clueless, I know, but you'd be amazed at the percentage of people that think disclosing something is a disclaimer (sigh!)

tomc19854• 5 years ago

* Require MFA

Using some kind of OTP authenticator app or device and __NOT__ SMS!

dahfizz• 5 years ago

SMS is perfectly good as an additional authentication factor. i.e. When you log in on a new device using your user name and password, you also need to type in the text message code you were sent. It is a convenient way to strictly increase the security of an account.

What SMS is terrible for is as a single point of account recovery. This is unfortunately how it is often used. "Multi factor authentication" in practice has become "Use any one of multiple available factors for authentication", which is awful.

uncletammy• 5 years ago

Anything requiring my phone number or a binary that runs on my phone is a deal breaker for me. It has massive privacy implications.

We desperately need to have better MFA options if we're going to require it from users.

jpalomaki• 5 years ago

For average person there’s also the problem of recovering access in case the phone with OTP app is lost.

Every service of course has the option to print backup keys. Maintaining those (in secure offsite location) over years takes some effort.

starwind• 5 years ago

Ironically, most of the government doesn't adhere to these recommendations

MomoXenosaga2• 5 years ago

I believe in personal responsibility. If someone wants to use 1234 they should be allowed to.

America is strange, any rando nutjob should have access to firearms but US corporations are terrified of being sued.

ben0x539• 5 years ago

* Require more than 8 characters

If I'm reading this right, it's more than 7 characters. And more than 5 if you don't let users pick the password, which seems surprising.

Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric.

beermonster2• 5 years ago

You’ve read it correctly.

The idea is to mitigate against brute force by account lockout/disable following N failed attempts rather than enforcing greater password length or complexity requirements.

yread2• 5 years ago

How to practically check for common passwords? Ideal would be to have like the most common 1/1000th of the hibp so that it's not too big for deployment in some clever structure (compressed trie? bloom filter?). I don't trust 3rd party services.

quickthrower22• 5 years ago

Have you heard about https://haveibeenpwned.com/Passwords ?

cactus2093• 5 years ago

Why do basically zero companies seem to follow this?

Banks and airlines are of course some of the most egregious offenders, but even tech companies like Apple and FB have complexity requirements on capital letters and numbers. Surely the login security teams at these companies are aware of the NIST recommendations.

Yet a tiny 3 person startup launching a simple crud app is more likely to google the NIST requirements and follow them than any of the biggest billion and trillion dollar market cap companies in the world. Are these companies acting irrationally here? Or is NIST not taking into account the factors that big companies actually care about, like support costs of dealing with account takeovers, etc.?

jaywalk2• 5 years ago

Big companies have big bureaucracies and third-party auditors that define stuff like this. Getting them to change their requirements is a herculean task.

skeaker• 5 years ago

I'd imagine that for at least some of them it has to do with appearance. "Facebook is so secure! It's got ten whole password requirements!"

er4hn2• 5 years ago

Inertia and other standards are a big force here.

The NIST standards recommending this (SP 800-63B I believe, under "memorized secrets") came out in around 2017, many years after large companies had settled on prior standards. Prior standards were closer to what banks / other biggies were doing and they just kept on doing it. In addition you may have other non US govt policies (UK for example likes to publish policy docs, see: https://www.ncsc.gov.uk/collection/passwords/updating-your-a... for their slightly different modern take) which the company prefers to use because of either their own HQ location or large customer pull.

Better yet many different countries requirements and a couple industry docs are cobbled together into a frankenstein set of requirements. That requirements docs is then treated as though it came from Mount Sinai and should not be altered without getting the approval of 3 senior VPs, a professor of cryptography, and the head of IT.

Galxeagle• 5 years ago

I’ve actually raised with a security executive in my large consulting firm - the biggest blocker is apparently that requirements like frequent forced password changes are written in to many contracts signed with clients as boilerplate ‘we promise to do x/y/z practises to keep your data secure’. Newer contracts have much better language and there have been some improvements that way (our reset period duration tripled recently), but it takes time to trickle through.

Spooky232• 5 years ago

NIST standards are technical guidance. The issue is downstream where different authorities make policy based on whatever NIST said at one time.

If you need to interact with taxpayer data and interact with the IRS, for example, you’re required to comply with fairly prescriptive controls for a variety of things that conflict with current NIST guidance.

The other thing is that changing anything identity is a pain in the ass. If there’s a business process and outsourced support model in place to deal with account issues, it’s actually easier to just deal with the shitshow than to fix stuff. Big dumb organizations make decisions differently!

pbreit• 5 years ago

Eight or more.

dheera• 5 years ago

Require MFA

But allow at least 2 hardware keys and not only SMS.

fomine3• 5 years ago

I got new worse policy in this November: at least 14 chars, must have all UPPER,lower,number,symbol chars, change every 3 months. Of course no MFA.

rkeene2• 5 years ago

It's also interesting because NIST doesn't generally follow these rules, since they don't use passwords (at least for most things).

kazinator2• 5 years ago

If you require as few as 9 characters, without requiring special characters, the security is poor. The reason is that users do not choose random strings of letters, so the entropy per character is low.

If we assume an entropy of 2 bits per characters (which is generous if the user uses dictionary words), then 9 characters gives us 18 bits.

A 9 character password could easily be as poor as a random 18 bit integer.

If we permit the user to use nothing but lower case characters from the set a to z, we should probably require a password phrase length of at least 30 characters.

Not forcing the user to reset their password means you need a really strong one, in case the user is using the same password. You're giving attackers all the time in the world to crack a leaked hash, so it better require something resembling all the time in the world.

These recommendations are basically relying on the MFA recommendation to make up for all the others. Like, oh, it's okay for the user to have 18 bits of entropy for a password, because we can trust that the attacker won't have the user's phone.

genewitch2• 5 years ago

So "fishyidea" has less or equal entropy to "262119"?

codingclaws• 5 years ago

At PNS [0], I believe our only rule is 9-100 characters.

[0] https://www.peachesnstink.com

reaperducer6• 5 years ago

Sometimes banks don't even adhere to their own rules. I have no idea what the rules are for CitizensOne (which does financing for Apple). I enter a password that turns all of the checks green, but it's still not good enough.

https://twitter.com/Reaperducer/status/1459585393175769092

alexdumitru• 5 years ago

I signed up on coinmarkercap and used bitwarden to set a 16 words passphrase as my password. Every time I log in I'm asked to change it because it's unsafe.

dpifke• 5 years ago

Most attacks on passwords these days are credential stuffing, not brute force.

This means that password rules REDUCE the amount of work an attacker has to do, as they can omit previously breached usernames/passwords which don't meet the password rules for the site being attacked. This means they can try more logins before getting rate-limited.

jedberg• 5 years ago

Password rules that make me turn off options on my password generator frustrate me to no end. It just happened on a bank site. I had to turn off special characters so they would accept the password.

crackercrews• 5 years ago

I tried to use Apple's strong password generator for a restaurant purchase. It didn't work because the password was too long.

Zamicol2• 5 years ago

1. Why don't passworded websites provide their own password generators? There's "secure" entropy generation available to JavaScript, e.g. `Crypto.getRandomValues(Uint8Array)`.

2. Shouldn't the only variable for password generation be entropy/information?

Here's a 256 bit password:

1NH8O3C3GH33FNQHM3B7VFKIQ95EMD-QLPOFPPYJ54NCFXMOB3

How could you know?

An easy way is to take the character set and convert the input string to binary. Once you reach a specified information level (say 256 bits), then the password could be considered sufficient.

https://convert.zamicol.com/?in=1NH8O3C3GH33FNQHM3B7VFKIQ95E...

3. Combined, I'd imagine a decent user experience.

4. I can't wait for public key authentication to kill passwords.

wruza6• 5 years ago

I believe this doesn’t account for dictionary-based attacks. “qwerty secret 123456” may even have decent entropy in ascii space, but can be bruteforced in minutes because these words go first in the weighted list. (Not a security expert)

prepend• 5 years ago

Every time I run into this, I remember meetings where a dumbass engineer would convince a clueless PM that something was necessary. It seems too specific to be thought up by a non-engineer.

I have no way of knowing this, but I do think companies with dumb password rules have poor talent.

I need to start a list of companies with dumb password rules, but I rarely create new accounts so by the time I get annoyed, I’m distracted onto something else.

GoblinSlayer6• 5 years ago

I need to start a list of companies with dumb password rules

You were heard: https://github.com/duffn/dumb-password-rules

jjcm2• 5 years ago

Here's how I do passwords - require a certain amount of entropy, and compare vs common passwords on the backend. That's it.

Here's a gif of it in action: http://files.jjcm.org/password.gif

And an example webcomponent that implements this: https://github.com/jjcm/soci-frontend/blob/master/components...

The ENTROPY_REQUIREMENT variable means you need a password that has at least 2^n possible combinations, given the character set and the length used. There's no restrictions other than that. If you want to only use lowercase letters, that's fine, as long as the length is long enough. If you include special characters, the length requirement drops.

I use a simple message to tell the user whether or not a password is acceptable, along with a radial progress bar to demonstrate success: "Not strong enough. Add complexity until the circle fills."

perryizgr82• 5 years ago

Although this is brilliant, I am worried that most non-technical people will mistake the circle for counting the length of the password.

jjcm2• 5 years ago

Which likely is fine. Adding length is a perfectly valid way to add entropy. If they happen to add a special character, it will just complete it faster.

tdrdt• 5 years ago

Since I believe a password is the user's responsibility I use the UI to inform the user what a safe password is because most people have no clue.

For example:

Choose your password: A safe password contains many different characters, for example a sentence.

tim333• 5 years ago

I like the "password is the user's responsibility" bit. My favourite password was on the original youtube which was "x". Those were the days.

michaelcampbell• 5 years ago

Bruce's point is so delightfully reiterated here and his on-site comments along the lines of, "I agree, but here's how I do passwords..."

tpoacher• 5 years ago

I hate MFA. I get the "need", but it's a) generally shittily implemented, and c) frequently manipulated/enforced not for the right reasons (notably to force you to surrender your phone number)

NoGravitas3• 5 years ago

I actually kind of like TOTP, since I can choose the implementation I want to use, and make backups, and so on. I loathe having to use any kind of bespoke MFA app, and I just resent the use of SMS for MFA.

phist_mcgee2• 5 years ago

Add to that, that SMS 2FA is becoming rapidly more insecure these days.

ufo2• 5 years ago

In another blog post, linked from this one, Bruce says that the XKCD scheme of stringing together a series of words is no longer safe:

Modern password crackers combine different words from their dictionaries. This is why the oft-cited XKCD scheme for generating passwords — string together individual words like “correcthorsebatterystaple” — is no longer good advice. The password crackers are on to this trick.

Is that true? Or does it just mean we need more words in the password?

grantmwilson• 5 years ago

Yes, more words is ideal. The ideal authentication scheme is that the attacker knows absolutely the system you use but it is still secure within realistic time constraints. So using randomly generated words from a sufficiently long list (such as this one https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt ) and as long as the hashing algorithm is sufficiently complex, then you are mathematically protected with a minimum number of words.

For example using a 6 word pass phrase from the above 10000 word list would on average require 5e23 attempts to correctly guess it. For credential stuffing this is absolutely impractical. For cracking a leaked password hash we can figure out how secure it is.

We assume that the service properly salts the passwords, so a rainbow table can't be used. If salted bcrypt hashes are used, a benchmarked 4-gpu rig did ~160 hashes/s, so even assuming a nation-state with 1E9 times as much computing power, we get 1.6e11 hashes/s, so this gives us on average 3.1e12 seconds to crack, which is about 100,000 years. Which means that no-one (pre-quantum) can crack that password.

ufo2• 5 years ago

If I understand it correctly, a 4-word password like in XKCD would require about 100,000 rig-years to crack. Do you think that is too low of a safety margin? Or is the problem that most people's word list may be less than 10K words?

teeray2• 5 years ago

I’d really love the W3C to come out with some elements that provide:

1) Communication of complexity requirements

2) Explicit password manager fill targets

3) An endpoint for a password manager to rotate passwords automatically. (and the validity period)

All of these would be backwards compatible with grandmas that write passwords on post-its and mouldering IT policies that snub NIST recommendations. Sure, webauthn is wonderful and all, but it’s a whole lot easier to ask for some simple HTML changes rather than implementing a whole API.

whymarrh• 5 years ago

This is something that folks are working on via the `passwordrules` attribute https://github.com/whatwg/html/issues/3518

With that and a well-known endpoint for changing passwords (not quite the same thing as what you’re describing; https://w3c.github.io/webappsec-change-password-url/) we are moving in that direction.

amelius3• 5 years ago

W3C can come up with all the elements they like but websites won't use them because they don't match with company style and the latest trends in graphic design.

teeray2• 5 years ago

None of these would be visible. They’d be glorified meta tags.

shadowgovt• 5 years ago

I use a password scrambler that generates a unique N-character string for every page. It's close to as much entropy as a one-time pad (technically, there is an underlying algorithm, so it could be reverse-engineered... But it'd require stealing my pass from several sites to start attacking it).

... except the sites that require a capital letter and an excalamation point. Those I sign into with "A<some random N-digits>!".

Good job, site designers. You've done nothing to improve security, but you have annoyed the hell out of me.

makecheck• 5 years ago

Complex password rules haven’t been shown to improve security in any way. They have been proven to torpedo security, e.g. they make people forget so they do blatantly-insecure things like writing passwords down or relying more frequently on things that reduce account security like having to reset the password entirely through simple E-mails or codes, etc.

And speaking of banks, I am livid that so many of my financial accounts essentially require absolutely terrible passwords. A lot of them don’t support E-mail for log-in either.

Meanwhile, your basic “correct horse battery staple” [1] works pretty well.

[1] https://xkcd.com/936/

enriquto3• 5 years ago

I Hate Password Rules

I hate passwords altogether.

In this day and age, nearly all instances of password usage can be replaced by public key cryptography for a vastly improved user experience. And, of course, for a net gain in security.

Zamicol2• 5 years ago

Do you have any examples of this in the wild?

enriquto3• 5 years ago

ssh?

Why can I connect to a remote server without using any password, but still need one to read the mail?

jhgb2• 5 years ago

for a vastly improved user experience.

Assuming for a moment that you live in the US, do you count Fifth Amendment issues into that experience?

enriquto3• 5 years ago

I'm not from the US and I cannot imagine what the fifth amendment has to do with public key cryptography.

jjice• 5 years ago

I hate seeing websites that have odd restrictions like "you can use !, ?, #, and @, but not % or ^". I can't think of a reasonable reason.

kortex3• 5 years ago

Bad sanitization, or fear thereof. You should not be inserting raw passwords into databases, nor should you be interpolating raw queries, but people used to, all the time, so these restrictions may have stuck.

But yeah it does not bode well for their security appearance.

neop1x• 5 years ago

Maybe they are storing it plain-text and it causes them issues like variable substitution in some database backup or management scripts.

PascLeRasc• 5 years ago

A few weeks ago I signed up for a local credit union and received a membership packet in my email including a reminder of what my password is. I called them to tell them about this security flaw and received a single dollar as a bug bounty, but they still haven't changed it.

Igelau• 5 years ago

100 Call them again

200 Get another dollar

300 Goto 100

elischleifer• 5 years ago

Having spent the last weekend trying to explain the arcane rules of 1Password to my mother, I can completely relate to this post. When things are overly complicated people start to work around them ... store master passwords and other codes in local files because it is a giant pain to enter them.

Corporate level password security should not be enforced on individual users who don't have IT support to keep their systems working cleanly.

core-utility• 5 years ago

Can anyone explain to me why even new products have a maximum character limit? I frequently see 16 or 20 maximum characters. If you're hashing the password, why does it matter?

amelius3• 5 years ago

Perhaps to prevent buffer overflow problems. Simplifies development and testing.

wruza6• 5 years ago

Wait, what? Even if they write their auth backends in C or assembly, nothing stops them from “#define MAXPWLEN 100”.

throwaway9843932• 5 years ago

If it's a bank, it's because the 40 year old database they first used to first digitize their 150-year-old accounts had a maximum character limit (which is why you sometimes see 8 character maximum passwords). Old accounts that generate money just by sitting around are also the reason they never need to upgrade anything and can make changes at a snail's pace.

perryizgr82• 5 years ago

Although 16 or 20 characters is too less, I can't think of an efficient and user-friendly way to allow arbitrary lengths. What if a user inputs a password with 604462909807314587353087 characters?

If your client is doing the hashing, it will get stuck or seem to take too much time to submit. If your backend is doing the hashing then you would need to send too much data over the internet, again killing the user experience.

I think 256 or 512 characters should be a sensible limit.

PS: 604462909807314587353087 is a Mersenne prime ;)

thecodrr• 5 years ago

Discloser: I am the co-founder (https://notesnook.com)

We used to ask our users 90% of the standard password requirements (min length 8, 1 special character, 1 digit, 1 capital etc). The result was a lot of people forgetting their password and having a really bad first impression. We were following "best practices" but the user didn't care.

In the end, we took out all the requirements except one: password must be 8 characters long. While we knew this wasn't recommended, especially for a private note taking app, it was a necessary choice because a lot of people either just modified their old passwords or used new ones which they forgot and got locked out. Good security but...if you also get locked out, what's the point? As for people who used password managers, it doesn't matter either way.

A lot of people sign up just to try out the app. Nothing serious. Nothing too critical. If they get locked out after their first usage, it's goodbye from them. I think there are a few things apps can do to improve security without annoying the user too much:

1. Show user a notice inside the app if the password is below a certain strength threshold, recommending them to change it.

2. If the password is reused or compromised, show a permanent warning either on startup or somewhere noticeable inside the app.

3. Promote use of password managers during sign up (and other places)

Ultimately, it should be up to the user to decide if they really want to change their password or risk having their account comprised.

None of these are tested though so I am not sure what the UX would be...

bsid2• 5 years ago

you really need a way for people to get in if they forgot their password...

gxqoz• 5 years ago

I hate a lot of the new paradigms with passwords. This includes things like letting you sign up for an account and placing you in an in-between state until your email is verified (with no indication this is the case until you check your email). Or moving login password entry to a separate screen from entering the username.

qwertox2• 5 years ago

I had a 16 character password which I used in an PC online-banking application.

After an update the password was unable to unlock the database.

So I started creating new databases with different passwords to see what was going on, and it turned out that all passwords longer than 10 characters were failing.

So I truncated my old password to 10 characters and then it worked. No hint, no nothing in the release notes.

infogulch• 5 years ago

I guess that means that it was silently truncating before the update.

alliao• 5 years ago

yikes? that means they knew your password therefore able to truncate it to 10 characters?!

iso16316• 5 years ago

Not neccersarily, if the previous version truncated the passed password to 10 characters, hashed, then stored, but the new version no longer truncated, the hash wouldn't match unless you used 10 characters

if your password was qwerty123456, it might have allowed you in with qwerty1234999

qwertox2• 5 years ago

I assume it was like iso1631 commented, that before the upgrade they truncated it before hashing it. In any case, using a password (=encrypting database) was optional, so my reaction to this experience was to remove the password and move the entire application into a VeraCrypt container.

globular-toast• 5 years ago

The worst one I've experienced recently is HSBC's online banking. It requires you to set up a 6-10 digit PIN number on the phone and tells you that you must memorise it, not write it down. Yeah right. Like I'm going to commit a 6 digit number to memory while on the phone. This is one where I bet at least half of logins are the "forgot my password" type (the other half probably wrote it down).

Andrew_nenakhov• 5 years ago

I also hate when they force you to change passwords from time to time and forbid you to set one of your previous passwords. One particular offender is russian website HeadHunter [1].

I hope such people will go to very special hell after they die.

[1] https://hh.ru

NathanielK2• 5 years ago

Extra fun with organizations that use single sign on. Change your pc login and now your phone has the wrong wifi credentials. Let it attempt to connect too many times and your account is disabled.

gregmac2• 5 years ago

I've asked IT people that set these policies to tell me their previous password -- after all, they changed it to something completely different, as per policy, right??

No one has ever agreed to this.

rudian2• 5 years ago

My internet-first bank’s passwords are limited to 8 characters. I'd take password rules over this idiocy any day. I reported it maybe 5 years ago and of course radio silence. I bet they plaintext it.

Oh and of course I also have literally 4 different digit-based pins to do operations.

brumm• 5 years ago

not a password rule but: i use a password length of > 40 characters because why not? signing up for paypal worked with that no problemo until i had to sign in again and the login input ignored everything north of 20 characters or so. It worked after removing the maxlength attribute :(

vimy2• 5 years ago

For the vast majority of websites password rules are unnecessary. I only care about icloud and gmail, amazon and paypal. I don’t care if my reddit account is “hacked”. Or HN. Or random webshops or whatever. I hate being forced to use strong passwords for accounts I don’t care about.

KronisLV• 5 years ago

What cannot be ignored is the fact that many people will attempt to use the same password for multiple sites if given the chance.

Furthermore, some of those shops may contain identifiable information which could be problematic.

Personally, i take a slightly different approach: i don't care about almost any of my passwords... because they're randomly generated!

KeePass gives you very nice choices in regards to this, when i write down a new account into the password protected DB for a site that I'm about to use, it allows me to both generate a random password for it, as well as specify additional generation rules if needed (e.g. longer or shorter).

That way every password is unique and reasonably secure. In combination with Nextcloud and regular backups to another HDD (and manual ones to SD cards) the password safe is also persisted across my own devices and other mediums, whilst having an even longer password of its own, the only one that i need to memorize (and write down on a piece of paper that i could optionally give to someone I trust, since i once forgot my phone's lock screen pattern years ago).

Here's more info about KeePass: https://keepass.info/

This, when coupled with separate e-mail accounts (e.g. one for professional matters, a few for increasingly more spammy or throwaway purposes) and something like uBlock Origin and a VPN does make my online browsing experience a bit more tolerable and secure.

vimy2• 5 years ago

Well yes, that’s exactly my point. I _want_ to be able to reuse crappy passwords because just typing a password is still simpler than dealing with password managers.

PaulHoule2• 5 years ago

I had a talk with the head of security at my credit union and told him I was within this much distance of ending my relationship with them over the fact that their password rules were so tough.

I pointed out that there were some banks that had let me keep the same (securely generated) password for 15 years.

American Express tried to sell me on a deposit account to go with my card but they told me I'd need to make a new account to log in. I told them that one reason I kept my AmEx was that they didn't make me change my password every time I wanted to log in and if I had to add a second login it wasn't worth it to me.

oehpr3• 5 years ago

To verify, you're using a password manager? Because it's hard to imagine someone getting upset over having to just update an entry, and obviously the bank can't tell you not to use a password to unlock your own vault.

And I can't imagine someone memorizing a password for a bank login only, and never using that in other locations. The internet requires so many accounts to manage... If you did reuse your password then your bank login would be very vulnerable to credential stuffing.

PaulHoule2• 5 years ago

I use securely generated passwords based on a cryptographic hash.

I don't use a "password manager". Someday 10^8 people who use a password manager are going to get their passwords stolen in one night and I'm not going to be one of them.

josephcsible• 5 years ago

I like the rule that Nextcloud uses by default: rather than requiring character class minimums or anything like that, it makes sure that the password you picked isn't one of the top 1,000,000 most commonly used passwords.

dwighttk• 5 years ago

My fav is when it says "your password is too short" when it actually means "we didn't think anyone would try a password longer than 12 characters and your 48 character password messed up our code."

bsuvc• 5 years ago

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer.

I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”.

I was quite impressed that they encouraged the use of long pass phrases instead of short cryptic passwords that are hard to remember (think “correct horse battery staple”). This place really is serious about security, I thought.

I thanked the system admin and causally said “I’ll be sure to change this to an equally secure pass phrase”.

“Oh no,” he said, “we don’t allow people to change their passwords here. You see, we need to be able to log into anyone’s computer if they go on vacation or are out of the office, so we keep an Excel worksheet with everyone’s username and password. So please don’t change your password.”

He turns and walks away, and I just sit there stunned, wondering if this was some kind of practical joke.

Sadly he was completely serious. I kept the password they gave me for the 3 months I was there, as I was asked to do, knowing that at any time someone could log in as me and do something illegal or unethical. It really did give me a bit of anxiety.

er4hn2• 5 years ago

On the plus side, it also gave you plausible deniability it really was you if you wanted to do something illegal or unethical.

vmception• 5 years ago

chaotic hysterical

vsareto• 5 years ago

Like jeez, GP. Should’ve sold those aerospace secrets to China while you had the chance.

jaywalk2• 5 years ago

This level of negligence should be criminal.

throwawaygh6• 5 years ago

The software industry is full of should-be-criminal forms of negligence.

Things are already horrendously bad. Basically every American's identity could stolen at this point. If any nation state or other actor decided to operationalize any of the big leaks -- eg OPM or EquiFax -- the ramifications would be catastrophic. Imagine millions of people losing their retirement accounts and all their savings. Even if you could correct everything -- and that's a big if -- the process might take years and the intervening panic would be deafening. The amount of anger might even elicit a hot response.

To say nothing of more serious vulnerabilities. We really dodged a bullet on the pipeline ransomware.

I'm morbidly curious how bad of a "Cyber 9/11" we'll need before software starts being taken seriously as an engineering field in which practitioners have professional responsibility.

dan-robertson2• 5 years ago

I don’t see why. I think it’s generally silly to think of your work computer/account as a place for anything private. Even if they won’t normally look at it, it’s all fair game if e.g. someone subpoenas them. My employer had a team which did a similar thing to the GP (had a spreadsheet with everyone’s password) in case someone was out and had some crucial file on their computer. And while they have since stopped doing that, it is because they improved processes such that it wasn’t needed and not because it became acceptable for the team to fail to carry out a large portion of their business activities or obligations because someone important was sick.

The problem is that the spreadsheet meant that exploiting one user meant exploiting the whole team but you can have this kind of privilege escalation in plenty of other ways. An easy way is to give people lots of permissions so that they can get their work done, or to just be bad at revoking permissions once they are no longer needed. Plenty of companies deliberately give people wide read permissions as a part of a culture of openness.

tenebrisalietum• 5 years ago

Well, was the Excel spreadsheet accessible to everyone? If not, this model could work in some strange way - if someone needs access to your computer, they are provided the password, then it is changed and you and password custodian now have a password not known by everyone else.

One side effect of this is that if you know someone else has the password, you're probably very unlikely to do any personal business on that machine.

noah_buddy• 5 years ago

There has got to be a better way, namely, not an excel spreadsheet (maybe vault or LastPass) and not the individual employee's account (e.g. have an IT super user account).

lmilcin3• 5 years ago

A few years back, on day 1 of my new job I was given root access to one of the development boxes.

So I ask: "Okay, how do I log in?"

The IT guy: "What do you mean, you just log in using your personal domain account and then sudo su -. You know what sudo is?" (followed by loud sigh)

Me: "You mean like production domain, same that we use for our desktop?"

IT guy: "Of course! What do you mean, what other domain would you like?"

Me: "Can I at least change my password to something else just for the dev environment? Can I log in with SSH key?"

IT guy: "No, no, no. Per our SECURITY policy, SSH keys are disabled and you have to use our domain login and password". (another sigh... of course)

Me: "Are you aware that when somebody has root access to the box they can do whatever they want including intercepting passwords of all users that log in to that box? In this case, every single developer that ever needs access to dev environment?"

IT guy: "That's not true. SSH is encrypted protocol and it is not possible to access passwords".

Me: after many tries to explain this to various people from IT, I gave up and set out to intercept all passwords of all IT employees. After I had passwords of almost everybody, I put them all in an excel and sent to IT for "verification".

There were a lot of angry people that day wanting me fired... fortunately they came to their senses.

Unfortunately, my development box access privileges were revoked.

8ytecoder• 5 years ago

I once decided to show the vulnerability of SMTP protocol by sending an email as a higher-up. (Too young, too naive, don't ask why I did that.) Created a massive firestorm. I did successfully convert them to use SPF and DKIM and showed everyone the need to never trust an email. Some even adopted PGP signatures after that.

duped• 5 years ago

There you go, giving a fuck when it wasn't your turn to give a fuck.
- Bunk

otagekki4• 5 years ago

I think even if you were fired, you'd have dodged not a bullet but a cannonball there.

Sometimes being the nice guy full of good faith doesn't pay. Literally

5e92cb50239222b• 5 years ago

sudo su -

It's high time for this thing to die. sudo supports this natively since forever:

  $ sudo -i

iFreilicht• 5 years ago

Wait, seriously? How would you do that? And why doesn't it work for ssh keys?

I was under the impression password auth worked very similarly to key auth, as in, the actual bytes of the password or private key are never sent over the wire.

stjohnswarts4• 5 years ago

It also gave you plausible deniability which would have stood up in any court.

Traster• 5 years ago

Pro tip: When you're seeing something really unethical that could eventually rebound on you - write it down. Write down contemporaneously what happened and sign and date it. Much more reliable evidence.

Buttons840• 5 years ago

Send it in an email too. "Hi IT guy and Boss, I'm concerned about blah, but understand people need access to everyone else's computer and account. Yada yada." Don't be difficult, but get an email out there with a time stamp on it and forward all that to your personal account if you can.

franga20003• 5 years ago

Bonus points for writing it digitally and using your favourite proper or janky method of timestamping - dates on paper are meaningless, even with a signature (which is also meaningless itself).

Emailing it to someone seems to be the go-to recommendation online, but you might not want to expose the information at the time. Some alternatives, in descending order of jank: a Google Doc, unlisted Pastebin, either of those but only post the hash and keep the file offline, a proper TSP timestamp - the latter is actually near-trivial these days with something like freeTSA.org.

hnburnsy• 5 years ago

Wow I know that password expiration is on its way out [1] but this is crazy.

[1] https://www.sans.org/blog/time-for-password-expiration-to-di...

GekkePrutser3• 5 years ago

My work is also big on pass phrases but I kinda hate them. It's a lot of extra work to type it every time I unlock my PC. And more characters means there's more chance to make a typo meaning I have to do the whole thing again.

And the weird way my brain works I have no issue remembering "G6bH,vIz#amV" so I still do it like that :)

Also, if an attacker has a hash of my password the damage is already done anyway. They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext. So there's no real benefit there. What matters is online guessing and that is severely limited in the amount of attempts.

I can't wait for passwordless though. I use only smart cards/yubikeys at home and love them.

koolba• 5 years ago

Also, if an attacker has a hash of my password the damage is already done anyway. They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext. So there's no real benefit there.

A diceware password of 6 words has an incredible amount of entropy. How would you ever brute force its hash?

What matters is online guessing and that is severely limited in the amount of attempts.

Belt and suspenders.

yawaramin• 5 years ago

What's stopping you from using a random password like 'G6bH,vIz#amV'?

franga20003• 5 years ago

They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext.

Ok, but that's a very Windows-specific issue. I don't know of any other widely-deployed system vulnerable to pass-the-hash.

mjcl• 5 years ago

The first place I worked was like this, with the exception of the long complicated passwords. We told people to call the helpdesk to reset their password and would save their password to an Excel sheet. This was improved slightly by rolling out a self-service password change tool that logged the passwords to a database.

One day someone that had legitimate access to the password list was fired/quit and the VP decided we needed to have everyone (~800 users, 700 remote) call the helpdesk to reset their password. All the helpdesk calls waiting for a password reset clogged the voice T1 (23 lines) for the office, preventing most calls in or out. Oops.

Thankfully when the company came in-scope for sarbanes-oxley the external consultant we hired to help with the audit said there was no way we could continue logging user passwords and stay compliant.

BurningPenguin• 5 years ago

Yeah, it's the similar in the company i work for. Except that we have a mixed bag of passwords. There are some old ones that are like "mouse" and then there are others like "Gt4x;JlK". We have that list for "maintenance reasons". Doing things, that could easily be done by some GPOs and other cool tricks.

raxxorrax2• 5 years ago

I think OS miss the ability for an admin to log into a user context. I am very hardline defender of privacy and in principle I support privacy advocates already preparing my pyre for even suggesting that of course.

But if we are honest an admin can already access relevant data anyway and you do indeed need to use a user context to access certain settings of some applications. This is especially true for less digitally affine users.

There are workarounds (Windows->Run as...), but that is sometimes insufficient.

About an admin using your user account to start the nukes? That is mostly possible anyway in the usual corporate Windows configuration. He could just change your AD password and log in as you. I would recommend that approach anyway and then force the user to set a new password and informing him why you sabotaged his workstation would also be nice. Far more secure than having the holy grail Excel file.

sharperguy• 5 years ago

Makes you wonder if you could use a tool like GPT-3 to generate grammatically correct passphrases from randomly generated sets of words.

E.g. "correct battery horse staple" might become "Correct use of a battery supports the a horse in its staple diet".

Thereby keeping the same bits of randomness while making a memorable phrase.

gspencley• 5 years ago

The funnier thing about that story is that the passphrase they gave you is not necessarily secure in the first place if we're talking about a scenario where a hash is found. While length is a factor when brute forcing randomness, any words or phrases that commonly appear together in written text are likely to come up in various types of dictionaries that can be used in more sophisticated brute forcing algorithms.

"sliding down the" and "tall building" are two parts of that password that contain words very commonly found together.

It's not the worst password but it's better to introduce randomness.

One strategy to create strong passwords that you can remember is to pick 3 or 4 truly random words from the dictionary that have no logical connection to each other, and to "glue" them together with some numbers that you can remember. I've heard that phone numbers are 7 digits because people can remember up to 7 pieces of information. If that's true then most people should be able to remember a password in the form of: <word1><number1><word2><number2><word3><number3><word4>

It does start to break down when you have to remember multiple passwords. So using that format as the master password to a password manager and then letting your password manager generate truly random passwords for everything else is the way to go.

tlavoie• 5 years ago

The nice thing with the lists of multiple randomized words is that there are so many more combinations possible. The numbers, which will be individual digits for most people, add relatively little here.

Using EFF's dice-ware page (https://www.eff.org/dice) as an example, the long word-list has 7776 entries, with a nicely random way to select them. Four of those words is already a sixteen-digit number in the combinations available. Even their short list of 1296 words would provide pretty reasonable odds. The key is to use something like the dice that takes away our own biases when selecting words.

jjk1662• 5 years ago

Really the key is using words that aren't in a dictionary, or at least not the same dictionary. It's pretty trivial for a brute force attack to just take a list of English words and try them in a large number of combinations. But if you have some non-english words, as far as that attacker is concerned its random gibberish. Of course the attacker might use a few languages so just mixing say english and spanish won't do that much better, but if you got some navajo or some quenya you're likely immune to any attack that isn't specifically targeted at you. And it doesn't even have to be a foreign language, even many proper nouns won't show up in a dictionary. For a password like "PoggleExclaimsGeonosianBarahunde" or "Seanbeanfearsburzum-ishikrimpatul" it would take trillions of years to guess a password without very specific pop culture knowledge.

teekert• 5 years ago

I have seen sites where I can happily enter a 25 char long random string but then you can’t log in. A lot of trial end error and it turns out they simply truncate at 16 chars :s

dankwizard• 5 years ago

It's like with Runescape, Jagex put a .lower on your password. Capitals don't matter!

helmsb• 5 years ago

It also doesn't help that the complexity rules are inversely proportional to the importance of the application.

My former mortgage company's password requirements were 8 characters max, no special characters.

The app for scheduling appointments at my barber (no payment info) requires a minimum 12 character password with 2 or more special characters, 2 or more uppercase characters and 2 or more numbers.

gorgoiler• 5 years ago

Having an @ in my password has been a royal pain in the ass over the years. Some keyboards switch @ and “. Oof.

Anyway, enjoy my bank account xx

oehpr3• 5 years ago

So... what's all this about XKCD's password scheme not being ok? I found the argument pretty compelling, in that even if you presumed the attacker knew how you generated your password, there would be too much entropy to work out what it was.

I'm going to do some quick googling about this.

edit: oh goodness, this appears to be a holy war, https://security.stackexchange.com/questions/62832/is-the-of...

I'll just plant my flag and wish the rest of you luck, use a password manager.

aeternum• 5 years ago

In practice people do not use random words. Instead they use a song lyric or sentence from a popular book.

Many users used this strategy to secure their cryptocurrency 'brain' wallets only to have the funds quickly stolen.

zahma• 5 years ago

The worst is when some forms set rules but prevent the user from pasting a string into the duplicate field for verification. If this is meant to prevent user error in case of a typo in the first field, then it also thwarts many of us using password managers. Somehow my browser can auto-generate and enter a password, but I can’t. That’s a work-around, but it’s irksome anyway.

On another note, a more constructive metric for password security on a basic website account would be to set a complexity standard that allows multiple ways to get there. A haiku of approximately 60 plain characters, for example, should be as secure as a 30 character alphanumeric string, at least when it comes to brute forcing. It seems to me like plenty of weak passwords could be created to eke out the minimum requirements for a lot of sites, so this standard lends a false sense of security, especially when any password is recycled.

dan-robertson2• 5 years ago

English has about 1 bit per character of entropy so if you type a normal expression it is going to give you ~60 bits of entropy. Random words will give you something like 2-3 bits per character so ~120-180 bits for a 60 character string. Random alphanumeric strings have about 5.95 bits of entropy so you get 178 bits from 30 of them.

So your comparison is somewhat right but only with an annoying definition of haiku and dictionary of words. However, a less good scheme should still be fine

m-p-3• 5 years ago

I hate those requirements, but if at least they were enumerated in a programmatic manner, for example through a RegEx or password field parameters then a password manager could read those and offer a generated password that fits those requirements.

lmm• 5 years ago

If you're going that far you might as well ask browser makers to make a non-awful UI for client certificates and avoid the whole password problem in the first place.

ttepasse• 5 years ago

Safari did something in that regard in 2018 and proposed a passwordrules attribute with a mini description language:

• https://github.com/whatwg/html/issues/3518

• https://developer.apple.com/documentation/security/password_...

• https://developer.apple.com/password-rules/

kristopolous• 5 years ago

I've just given up and use

   $ openssl rand -base64 xx

Recently I had a password reject based on policy even using this.

The minimum character length was 50! That's a subtle way of essentially forcing you to use a password manager of some sort

I'm pretty sure this approach will eventually screw me over. I don't know how but it feels like it'll happen

otagekki4• 5 years ago

I used to have those: 8-24 characters among which 1 uppercase/lowercase, 1 special character among a whitelist, and renew that every 2 months. At renewal, must be different from all your previous passwords and the new password must be at least 3 character different from last one. SSH keys can't be used per security policy and the same rule has been applied to the password manager.

A pain.

And yes the most annoying is that it's never the same rules, and I resort to using Keepass or worse, my browser password-remembering system (stores passwords to Google/Mozilla servers)

Is bruteforcing passwords still a thing nowadays? Once in a while I tend to forget my Wikipedia account password and after a couple of failed attempts I get shown a captcha.

On another day, I got locked out of my own account because I was trying to log in using another mobile device with another SIM in another country.

s0ulphire• 5 years ago

Not many places will try a brute force attack directly on a login interface, but if your database is leaked the definitely. Nothing to rate limit an attacker then

kortex3• 5 years ago

and the new password must be at least 3 character different from last one.

Does this sort of rule imply that they are saving passwords whole (either plaintext or encrypted, as opposed to hashed)? I can understand "can't match your last N passwords" cause that's just saving old hash entries. But editdistance(old, new) < 3 implies you know the string value somewhere.

otagekki4• 5 years ago

Not necessarily, I forgot to mention that when changing your password through their UI you still have to enter your old password. So it's safe to assume that the string comparison is made at form submission. For history rule I don't want to imagine it being implemented otherwise.

muzani• 5 years ago

NIST 800-63B [1] has some good guidelines on password rules, one of them being low complexity:

"As noted above, composition rules are commonly used in an attempt to increase the difficulty of guessing user-chosen passwords. Research has shown, however, that users respond in very predictable ways to the requirements imposed by composition rules [Policies]. For example, a user that might have chosen “password” as their password would be relatively likely to choose “Password1” if required to include an uppercase letter and a number, or “Password1!” if a symbol is also required.

Users also express frustration when attempts to create complex passwords are rejected by online services. Many services reject passwords with spaces and various special characters. In some cases, the special characters that are not accepted might be an effort to avoid attacks like SQL injection that depend on those characters. But a properly hashed password would not be sent intact to a database in any case, so such precautions are unnecessary. Users should also be able to include space characters to allow the use of phrases. Spaces themselves, however, add little to the complexity of passwords and may introduce usability issues (e.g., the undetected use of two spaces rather than one), so it may be beneficial to remove repeated spaces in typed passwords prior to verification.

Users’ password choices are very predictable, so attackers are likely to guess passwords that have been successful in the past. These include dictionary words and passwords from previous breaches, such as the “Password1!” example above. For this reason, it is recommended that passwords chosen by users be compared against a “black list” of unacceptable passwords. This list should include passwords from previous breach corpuses, dictionary words, and specific words (such as the name of the service itself) that users are likely to choose. Since user choice of passwords will also be governed by a minimum length requirement, this dictionary need only include entries meeting that requirement.

Highly complex memorized secrets introduce a new potential vulnerability: they are less likely to be memorable, and it is more likely that they will be written down or stored electronically in an unsafe manner. While these practices are not necessarily vulnerable, statistically some methods of recording such secrets will be. This is an additional motivation not to require excessively long or complex memorized secrets."

[1] https://pages.nist.gov/800-63-3/sp800-63b.html

mastazi• 5 years ago

Today Brave browser launched a new version of their built-in crypto wallet.

There is an option to keep using the same password in the new version, when I select that option, an error message comes up saying my password is not secure[0], even though it is[1].

Basically the Brave devs can't even agree with their past selves about password security.

[0] https://ibb.co/ch9GGm8

[1] https://xkcd.com/936/

waynecochran• 5 years ago

If I have an alphabet of size x and a password of length n there are x^n possibilities. What results in a larger set -- adding 1 more character to the alphabet or adding one to the length; i.e. which is bigger (x + 1)^n or x^(n+1)?

raldi• 5 years ago

Best rules I ever lived under were “We’re continuously running JTR against all users, and your password can be anything it’s unable to crack.”

orpheansodality• 5 years ago

(guessing JTR == John The Ripper? https://www.openwall.com/john/ )

throwaway9843932• 5 years ago

Password rules often happen because a customer who had a lot of money told somebody who wanted that money that they wanted these specific password rules.

"Oh, you require us to implement these stupid password rules you came up with, in order for us to get your 20 million dollars? We'll have it implemented by end of the week."

And this is also why those rules never seem to change, or only get worse. Nobody remembers when or why those rules were implemented, and nobody is going to risk potential business just to make passwords easier to use or more secure. Product security is always second to short-term gains and job security.

unobatbayar• 5 years ago

Had the exact same problem when I made a password generator. The passwords it created never passed any rules.

Changed the algorithm a few times, to make it at least pass the password rules of common websites such as Facebook, Google, etc.

ohiovr• 5 years ago

Lesson #1 Never trust password managers Lesson #2 Use hardware keys

marcelfw• 5 years ago

I always wonder why some of them have upper limits, does not make sense imo.

Kavelach• 5 years ago

Once I was asked to implement a system that applied password rules with a few heuristics. If the password was under 12 characters, then it required numbers, special characters and so on. Over that, it required only a number in it. If you went over 16 (or 18, I don't remember exactly) characters, there were no rules. The front-end explained how the whole system worked and gave the user tips on how they can make their password more secure, heavily promoting phrases as passwords. My friend who is still involved in the project told me a few months ago that they send out satisfaction forms to users, and some users mentioned that thanks to the service they now know how to prepare passwords that are safer and easier to remember.

heleninboodler• 5 years ago

The comments on this blog post make me cringe. Is there a correlation between Schneier followers and self-professed experts? Consider the clever fellow who has "logically" concluded that consistent password rules would constitute "putting all your eggs in one basket" and hence weaken security. Folks: a limited character set isn't a liability if you can just increase the number of characters correspondingly. If you're allowed a 64 character password, you can reduce the character set to [0-9A-F] and still have 2^256 possibilities.

quitit• 5 years ago

More than once have I used the password rules to reverse engineer a lost password.

I think it’s just better if their system provides a little complexity indicator.

I hate password rules

Related Stories