Password Rules

http://portal.cs.oag.state.tx.us/OAGStaticContent/portal/login/help/ChangePassword.htm

by valuegram • 14 years ago

225 152 14 years ago

portal.cs.oag.state.tx.us

fiatmoney• 14 years ago

Ironically, each of these restrictions reduces the space of possible passwords for a brute-force attack, which is already pretty small given the inane 8-characters-exactly requirement.

astangl• 14 years ago

I have pointed this out to people before too. It doesn't seem to deter their slavish adherence to what they declare to be "best practices", which seems to correspond to something they read in some magazine or blog.

jiggy20112• 14 years ago

Is there any reasoning at all behind the thinking that requires passwords such as this? These sorts of rules are so commonplace that there must be some reasoning for it?

kijin3• 14 years ago

To begin with, preventing SQL injection when passwords are stored in plain text without any escaping. (CHAR(8) field. No special characters allowed.)

jiggy20112• 14 years ago

That's an utterly horrible reason but I take the point.

I imagine many sites implementing these policies (some banks etc) are hashing their passwords properly and sanitizing SQL though!

xbryanx2• 14 years ago

I am sure operability and not security are the primary factors behind these rules.

georgefox2• 14 years ago

There is reasoning; it's just not valid reasoning.

haberman• 14 years ago

Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer I gave to a security question.

I bought a house last month, and the biggest thorn in my side throughout all of the financial arrangements was security questions (I'm not even joking). Here's a Facebook status update I posted (I had already been complaining about security questions a bunch):

"Just got challenged with a security question, which was "Thank you for your loan application." Wtf, that is not a question. And I've never filled out any security questions for this website, so I have no idea what it's expecting me to enter.

"I swear, security questions are out to get me."

ecoffey4• 14 years ago

This may not have helped your specific case, but I recently bought 1Password, and updated all my security questions with randomly generated 16 character string answers, and just put those strings in the "notes" section of a website. So when they do challenge me I can just copy/paste them in. It's been awesome!

unfletch2• 14 years ago

I've used 1Password generated passwords for years. You're right, it is awesome, but only until you have to relay one of those generated strings to a support person over the phone:

"...left curly brace. No, it's like the parenthesis, but squiggly. Are you using a regular keyboard? Hold shift and type the left square bracket. The square one. It's to the right of the P..."

Nightmare.

nextstep• 14 years ago

Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish to answer the questions honestly.

FaceKicker• 14 years ago

Security questions are usually just used to decide whether to send you an email with a password reset link (or more annoyingly, a new password), aren't they? I've never seen a system where being able to answer the security question(s) is equivalent to knowing your password. Anyone who knows my mother's maiden name probably also knows my email address and could more easily spam me directly than using a website to send me password reset links.

lordlicorice• 14 years ago

I typically take the classic step of choosing "What is my password?" as a custom security question.

angry-hacker3• 14 years ago

Ashamed to admit but I used to "hack" my classmates (girls) hotmail accounts like that when I was young. I tried to recover their password and if I didn't know the answer to their security question (I often did) I just asked... I was curious if they write something about me in their emails, never did...

baddox• 14 years ago

I use pwdhash for all my primary web passwords, but I have a secondary password that I use as my response to all security questions. I think this is a decent solution, but some services (I believe Apple is one example) requires multiple security questions and requires the responses to all be distinct.

recycleme• 14 years ago

A long time ago I was unable to answer the security question for my AOL account. The account had been hacked and used for mass spamming. AOL would not close the account, or help me change the password (or stop the spamming) until I answered the question.

"...but the account is being used for malicious purposes." - me

"Sorry, sir but until you tell me what you named your first dog I cannot stop it." - AOL

danielweber• 14 years ago

I don't worry too much about someone trying to know the name of my first pet (I'm pretty sure anyone who knows what my answer would be to this question is dead). I do worry that there are a bunch of other organizations that I have told that information. If someone hacks one of those they can get access to my other accounts.

One of the worst sites I saw demanded that I select my security question from a list. Sweet gosh, I have absolutely no idea which of your brain-addled security choices I selected.

jfasi• 14 years ago

My favorite thing is when the answer to the security question is allowed to be remembered by the browser, meaning anyone who gets my password can saunter up to any computer I've used in the past and bypass the stupid security question.

goatslacker2• 14 years ago

Agreed. Shame to see so many reputable companies not give a rat's ass about security when they seriously prompt for security questions like "Where was your honeymoon?" or "What was your first car?" -- I've even seen "Where did you graduate High School?"

CGamesPlay• 14 years ago

Yes, but security questions are designed to protect against untargeted phishing. There is little than can be done to automatically help protect against targeted spearphishing attacks against a particular person.

desipenguin• 14 years ago

create a "secure note" in LastPass to store "exact" answer to security question(s)

homosaur2• 14 years ago

WOW. I was expecting something dumb but this is next level dumb. You're basically forcing a 7 character password since I already know one of them is one of those three special characters. Then you've just given me like 5 more rules that limit what the password can be.

Any password cracking service would crack this in hours. IT people should understand the basics about security before they are allowed to set policy.

ot• 14 years ago

> You're basically forcing a 7 character password since I already know one of them is one of those three special characters.

Not exactly, because you don't know where the special character is. If the allowed characters are k, the number of 8-character passwords would be k^8. With this rule, even assuming that only one special character is used the number becomes 7^k * (3 * 8) = 7^k * 24, so if k ~= 60 the entropy is reduced by roughly 1 bit.

Still, it is an incredibly stupid rule.

jaybill5• 14 years ago

I'm pretty sure the password guesser I wrote to give me passwords on terminals in Fallout 3 would easily give me these passwords.

furyofantares• 14 years ago

Yeah, it's equivalent to reducing k to 24 for a specific character, not reducing it to 1. For k=65 it reduces the search space by about 64%, or 1.43 bits entropy (ln (65/24)/ ln 2).

Though we know the first and last characters aren't special, so it's actually equivalent to reducing k to 18 for a single character, or 1.85 bits entropy lost by this rule and its interactions with the other rules.

... then the rule that the first and last characters can't be special reduces k from 65 to 62 for them, and the rule that no sets are allowed reduces k by 1 for every character after the first, and so on.

But really, I think the bigger concern is that all of these rules mean the password will end up on a post-it note stuck to the monitor.

homosaur2• 14 years ago

Ah, should have done the math. You're right, it's less impact that it seems at first.

sunwooz• 14 years ago

If you had to create a list(or non-list) of requirements a password must pass what would it be? (Ex. Case sensitivity, length, cannot be the same as username etc etc) The bare minimum with the least frustration for the user? I was very surprised by the news-piece that blizzard was using case-insensitive passwords and that got me thinking...

x12• 14 years ago

I wouldn't, I would apply something like this http://www.passwordmeter.com/ and show the user how secure or insecure their password is. Depending on the service they are using maybe only allow passwords at Strong or better but base that off the complexity of the passwords. %09(0m is stronger than minneapolisminnesota

LinaLauneBaer• 14 years ago

Doesn't the strength of a password also depend on the cardinality of the underlying alphabet? So your example makes only sense when you also say something about the used alphabet or am I missing something here?

notatoad• 14 years ago

Minimum eight characters long. Beyond that, use whatever you want.

darkarmani4• 14 years ago

Only enforce a minimum password length.

seats2• 14 years ago

What if we started saying 'passphrase' instead of 'password' and made the minimum be 4 words and 18+ characters.

It wouldn't be overwhelming to new users if they had examples of what a memorable passphrase is. You'd likely need to disallow specifically using the example passphrase but other than that, I'd be curious to see how well non-technical users respond to an interface asking them for a phrase.

rwallace• 14 years ago

We also need to get rid of the stupid habit of blanking out the password on the screen as it's typed, which imposes a time penalty exponential in the password length, or at least make it optional and disabled by default.

tomjen3• 14 years ago

Create the password and email it to the user.

That is a trade-of because they will write it down and put it next to their monitor.

But then the bad guy has to physically get it and the password isn't going to be used anywhere else so you nuke the two biggest issues with passwords.

healsdata• 14 years ago

Of those ten rules, nearly half of them hurt password strength. The others make it harder for users to remember their passwords which will lead them to frustration and, ultimately, bad passwords.

Austin#1 is a perfectly valid password according to those rules. zxcvbn says it'd take 2.508 seconds to crack that.

njloof• 14 years ago

After coming up with a password that obeys all those rules, I recommend writing it down on a yellow sticky note and putting it on your monitor.

droithomme• 14 years ago

Which I have seen at secure facilities, as we all have, I think.

RandallBrown• 14 years ago

If it's a secure facility, it's probably pretty safe.

r00fus3• 14 years ago

Or the digital (secure) equivalent: a password manager.

Seriously, any decently sized organization should strongly recommend or mandate usage of such - they are also great when a transition needs to be made - known external credentials can be exported or passed during knowledge transfer and passwords reset.

x12• 14 years ago

Yeah. As someone who prefers passwords in the 12-24 character length I get really annoyed when a site comes back and tells me my password isn't good enough because it doesn't follow various rules. Oh you really think someone is going to brute force $MILKAndDailyCheeseRe because it doesn't have a number in it?

darkarmani4• 14 years ago

Even worse is when they limit to 12 characters, but don't enforce it in the UI. I couldn't login once because the bank website truncated my password silently to 12 characters. On a whim, i tried the first 12 characters and i was able to login.

xbryanx2• 14 years ago

I've worked with rules like this, and it's even worse when it's some domain password used across multiple crappy systems. Often a 3rd party system that has integrated with this password doesn't accept the $, or has to be 7 characters or something. So the IT folks tell you to follow the rules, but if you use the accounting system, make sure not to put $ in there. #facepalm

Margh• 14 years ago

Wait, what? This isn't a joke?

pbreit4• 14 years ago

Stupid password rules is probably the leading source of consternation for this internets user.

Has anyone ever analysed if password rules help at all? Aren't most compromises social-based or otherwise accidental? No one breaks in by slamming millions of login attempts at a server, do they?

sukuriant• 14 years ago

My Diablo 3 account was hacked because my password was 'abcd1234'. This is no longer the case.

So yes, sometimes. And no, I'm not certain why on earth I set that as my password...

pbreit4• 14 years ago

Are you sure it was brute-forced? And the website owner had nothing in place to see that it was getting hit with brute-force password attack?

PezCuckow• 14 years ago

This demonstrates what is wrong with what the world expects a password policy to be, very few of these even increase password cracking complexity. They are just dumb rules to annoy your users. Sigh!

jonamato• 14 years ago

The sub-password "similarity" rules (#8) mean that it is incredibly unlikely that the system is storing the password history hashed, and basically impossible that they're storing it salted. What could possibly go wrong?

raldi• 14 years ago

You don't need unhashed password storage to enforce similarity rules. Presumably, the user has to type in their current password when they set a new password. When processing that request, you have all the information you need to do the similarity check.

petitmiam• 14 years ago

What about the 7 passwords prior?

NelsonMinar• 14 years ago

Everyone's making fun of this, and it is dumb. But really this is just an example about how passwords are a stupid form of authentication. Not just this site, all passworded sites. We really need something better.

I favor OpenID or something like it. Single strong form of authentication, delegate login authority from that to non-critical sites like Hacker News. OpenID has enough of a bad reputation now it's probably a non-starter. BrowserID has some promise: https://browserid.org/

steve-howard• 14 years ago

I don't know that passwords are all bad. For an alternative approach to complex rules, see:

http://xkcd.com/936/

The last time I changed a password for a service I set it to a phrase that I can easily remember but which no human or current machine will easily guess. I'd say that the only good rule is "Make it at least 9 characters" (which is at least long enough to disallow "password").

amalcon• 14 years ago

11 is also a sane minimum, to disallow 1234567890.

unimpressive2• 14 years ago

Character minimums hurt your entropy too. Stripping the entire search space up to nine characters isn't really a good idea.

In my opinion it'd be better to just find a list of the top 10K passwords and disallow them.

One out of 50 people use one of the top 20 passwords. [0]

I'd bet that over half of passwords used are in the top ten thousand.

[0] http://xato.net/passwords/how-i-collect-passwords

redacted• 14 years ago

I wrote a small script to generate passwords after reading that comic [1]. Using a good wordlist one can easily produce memorable and secure passwords.

Unfortunately, many sites enforce rules that preclude this password style (e.g., must contain a number).

[1] https://github.com/redacted/XKCD-password-generator/

duaneb2• 14 years ago

So if you share a computer with someone, how do you stop that person from logging into your account to read your email?

r00fus3• 14 years ago

Strong passwords. Password manager. Separate Accounts. Keypass or 1Password (which I prefer on OSX) are quite good.

I use gmail + 2-step auth. You can configure it to be quite paranoid.

darkarmani4• 14 years ago

That's a bad argument. Passwords are a decent trade-off for certain problems.

The problem is when the usability/security trade-off doesn't match the situation.

kijin3• 14 years ago

> Single strong form of authentication, delegate login authority from that to non-critical sites

How does that solve the problem of internet banking passwords? Banks are not "non-critical sites", so whatever form of authentication I use for my Reddit account is unlikely to be suitable for my bank. As a matter of fact, I don't trust LastPass with my banking passwords.

DaNmarner• 14 years ago

I bet this has something to do with some mighty Oracle DBA.

its_so_on• 14 years ago

I swear one day we will see.

"Unfortunately time and again we have come to observe the inability of employees to follow simple rules during password creation. For example, despite our warnings, employees often create a password containing more than one consecutive non-numeral; other employees attempt to createa a password consisting only of numbers, only of letters, or an insecure mix of numbers and letters - e.g. 5:1 - with no special characters.

This is unacceptable.

Henceforth, new passwords must be one of the following five possibilities, as described below:

s$sVC!{IV{wG:|9 (Employees with last name beginning with A-F)

bE#40,$&T@V}266 (Employees with last name beginning with G-L)

U>~7nw*,55{][%H (Employees with last name beginning with M-R)

EL8$v{4#L8482 5 (Employees with last name beginning with S-X)

1^_4s"x&T3pB,%% (All other employees).

You may not use a password you have ever used previously. In two weeks, the new possibilities will be posted to the web site, and you must change your password immediately to one of the new possibilities.

You have brought this on yourselves, and if you begin to show an ability to use secure passwords, you may get to pick your own in the future. Until then, they will be assigned to you.

HR."

dekz3• 14 years ago

> The password must be exactly 8 characters long.

This is probably the root cause of bad passwords. In the case of Average Joe, he is now having to choose something memorable which is 8 characters long. 'PassworD'

Terretta2• 14 years ago

Sorry, "PassworD" doesn't validate. You're missing a symbol, and you have a character repeated. Try "P@s5w0rd" instead. Or, better yet, "abc#1234" as suggested in the examples.

jebblue2• 14 years ago

I agree that 8 isn't enough:

http://www.linuxjournal.com/content/hack-and-password-cracki... http://www.linuxjournal.com/content/hack-and-password-cracki...

cloverich• 14 years ago

moreover, at 8 characters, it doesn't really matter what password they choose; 8 characters is simply too short to matter. Even 9 or 10 is a significant improvement at this level.

unimpressive2• 14 years ago

Of course this is totally ridiculous, and shoots their entropy with a shotgun. But my heart goes out to whoever was logging into the child support page at the texas attorney general website.

That sucks.

valuegram• 14 years ago

I was the one who posted this. It's the same login used to report new hires to the attorney general... Luckily no child support issues here.

angry-hacker3• 14 years ago

I wonder how many possible variation of passwords with these rules there can be... 8 chars, no same letters next to each other etc.. brute force hacking might be fun..

Achshar• 14 years ago

Banking passwords are always fun. Mine has to be changed every 30 days, cannot be same as last 3, must contain at least one number, special character, capital, lowercase. I essentially end up where i have to store password in plain text (!) in a password protected file. ridiculous but there is no way around it. People really have go understand that such things don't help at all, they increase user frustration if anything.

I have never understood the number/uppercase requirement, if someone somehow put a key logger it won't matter or if some one is using brute force, it wont matter either.

taylorbuley• 14 years ago

Except whereas those rules sound like they would enhance your personal security, following these rules work against it ("must be exactly 8 characters"?!)

Firehed2• 14 years ago

First, get 1Password or something similar.

Second, the mixed case alphanumeric definitely aids against brute force attacks, particularly in the case of an online attack (for an offline attack, there are probably hundreds of thousands of attempts per second so the only effective protection is a slow hashing function that limits attack speed)

Tichy• 14 years ago

Well the "not the same as last 3" rule is easy to circumvent: Just add a number at the end, password1, password2, password3...

darkarmani4• 14 years ago

So schemes notice the incrementing value, so I ended up doing !,@,#,... which is equivalent to 1,2,3...

The bonus is that I could still track how many quarters I worked for that place before leaving (lasted into the 6 quarter).

runn1ng• 14 years ago

" Characters in the first, second, and third positions cannot be identical. "

Any reason for that? Using pretty similar passwords with minor differences is how I manage to remember passwords for all those fifty different services I have to know password for...

JWhiteaker• 14 years ago

Having overly restrictive password rules like this, combined with requiring a new password every x months, just leads to more users writing down the passwords on notes stuck to their monitor.

mathattack• 14 years ago

If this weren't a US government website, I'd swear it was a hoax!

goatslacker2• 14 years ago

Whomever thought this was a good idea needs to be kicked in the groin.

jaybill5• 14 years ago

I get annoyed when I can't use spaces, because my general password strategy is to click my link bar shortcut to Random Wikipedia Page, pick five or six words and use that as my password. Easy to remember, hard to guess, even harder to brute force. Thanks XKCD!

I use Keepass to store passwords for the various things I use, and even though my hive is stored on a web server (uses SSL and requires a password, of course) for convenience, it has a well chosen, rotated password and a key file that I carry on a USB stick with my keys. I keep a backup of the key file in a safe physical location.

No two passwords are the same and none is less than 16 characters. One nice thing about Keepass is that you can also store URLs and other arbitrary information in the hive. Should anything ever happen to me, my wife will automatically receive instructions on how to locate and access the hive. (automatic email, dead man switch) Keepass also lets you set reminders so you can regularly change passwords.

epistasis2• 14 years ago

This is a terrible way to choose passwords, and in no way equivalent to the XKCD method. It's not equivalent because additional length in your password is very predictable rather than random.

To brute force your password, all somebody has to do is choose a starting word in Wikipedia and some number of consecutive words. This is log2(size of Wikipedia) + log2(entropy of your "5 or 6" distribution). This is less than 32 bits of entropy, or about a six character password in a 64 character alphabet, i.e. it's trivial to brute force this password if you have the hash.

btipling• 14 years ago

Yeah but it would have to be a targeted attack. In any case everyone should be using something like 1Password anyway.

jaybill5• 14 years ago

I didn't say I picked consecutive words. You'd be right otherwise, though.

16s• 14 years ago

There needs to be an ISO standard for passwords. Things like this are ridiculous.

asciident• 14 years ago

What I want to know is whether there is a subset of passwords that will be valid against almost all password rules. Like if I make a password that has 12 characters, one symbol and one number, will that fit in 99.9% of cases?

jklp• 14 years ago

I always wondered about these arcane rules, where passwords are easy for computers to hack, but hard for humans to remember.

See obligatory xkcd comic:

http://xkcd.com/936/

neotek• 14 years ago

I work for a major bank in Australia and I'd be ecstatic to have requirements as (comparatively) simple as this.

philip1209• 14 years ago

Need . . . public key . . . access

kbronson• 14 years ago

Password Sucks

DeepDuh• 14 years ago

This reminds me of an anecdote from "The Codebook" from Simon Singh (highly recommended book btw.).

One of the reasons, why the British could crack the Enigma code, was that German officers introduced rules on how to use the system. For the Enigma machines they had to choose three out of five cylinders in different positions. The officers thought it would be more secure if they impose a rule "never use the same cylinder in the same position the next day".

CurtMonash• 14 years ago

If a system has sufficiently crazy password rules, I'm sure to forget the password, and default to the password reset system.

pbreit4• 14 years ago

Can someone convince me that password requirements add _any_ value to the matter?

Password Rules

Related Stories