Hacker News Reader

Comment by ChuckMcM | Hacker News Reader

And if we could only get password taking software to not require special characters and numbers if the password was longer than 15 characters, life would be peachy. (that is 19 characters if you're wondering, and no I don't use it as a password)

View on HN

Which is why I use the method of making up a random sentence with a number in it and using the first letters of each word and the punctuation.

I memorize the sentence.

My favorite 7 beavers aren't taking to water!

Password would be: Mf7ba'ttw!

It's highly random just like the poems. It's easier for me to remember. It has the right length and random symbols to make the strong password detectors happy.

You tend to say the sentence as you type the password so for bonus points, you can make it a nice motivational mantra.

You're good enough, you're smart enough, and doggone it, people like you.

Y'ge,y'se,adi,ply.

Why use the abbreviation instead of the full sentence?

The original complain was about password boxes not allowing passwords longer than 15 characters. Another common complain is only a few special characters allowed and space is often not on the allowed list. This gets you most of the memorability while still working with the common password box restrictions.

I've built up partial evidence that as the rules become more restrictive, the triviality of the password INCREASES and the entropy DECREASES.

The idea is that people can't use their personal passwords so they fall back on trivial variations of common ones.

For evidence, I've been assembling so called "cracks" and database "leaks" over the past several years and cataloging the password policies on the sites and then doing statistical analysis on the passwords.

It's in interesting project ... check my user info and email me if you want to know more about this

My biggest pet peeve with password requirements is limiting the scope of special characters to some arbitrary subset, i.e. "you may only use the characters @#$%^& in your password", or not allowing spaces. Without spaces I can't use a phrase without running it all together, and my instinct is to type the spaces, so I end up getting frustrated and using some less secure password instead.

Whenever I see those sorts of limitation I assume there's probably some kind of poorly handled escape situation to exploit and their fix was "well just don't allow that pesky < character"

> Whenever I see those sorts of limitation I assume there's probably some kind of poorly handled escape situation to exploit

Which, in turn, implies that some system handles the password as plaintext rather than via a password-appropriate digest.

Just this week I found that Wordpress cannot handle passwords with ' or " because of bogus "escaping" posted data.

Reply on news.ycombinator.com