Hacker News Reader

Hacker News

Comment by buyx | Hacker News Reader

Parent Full thread

buyx

First National Bank (FNB) in South Africa has adopted every one of these absurd rules, and more:

Passwords must contain a mixture of upper and lower case letters as well as one letter and one special character

Length between 7 and 33 characters

Not the same as the previous 12 passwords

The same character cannot be used consecutively

Avoid sequential letters and numbers (123 or abc). I think this used to be enforced, not sure if it still is.

May not be the same as the name, userid or clientid. As I recall this is enforced by very aggressively with innocent passwords being rejected because they happen to have some matching substring.

https://www.fnb.co.za/demos/reset-username-and-password-PC.h... (rules are on the 5th screen in their demo)

I've been using the same password for 3 years because changing passwords is so brutal. Complaining is futile because of the bullshit cargo culting around security.

View on HN

> Length between 7 and 33 characters

I've never understood why sites limit password length. You're (hopefully) hashing it anyways; the length of what the user enters has no bearing on what you're storing in your database.

Exactly. Limits only become reasonable when they're meant to stop you from uploading hundreds of megs worth of data and monopolising resources. A 1kb password or even a 1mb password supplied by a tiny fraction of a percent of users is not going to make an impact on you, but can provide that small group of users with a massively increased piece of mind.

"I've never understood why sites limit password length. You're (hopefully) hashing it anyways; the length of what the user enters has no bearing on what you're storing in your database."

What if they upload a GB or TB binary as password? I've always wondered but nobody told me if there's some inherent cut-off that would prevent such a DoS attack.

33 characters (and I often see less) is a far cry from a gigabyte. I think it's clear I was talking about unreasonably low limits.

Exactly, such anti-abuse limits would start at, say, 256 characters. The amount of banks and services that limit their passwords to 20 characters or fewer is startling.

I've seen even worse than that - for low-importance passwords I normally record them in a mail-to-self memo then paste them into the signup form. I recently encountered one site that silently truncated the pasted password.

While silent truncation is of course bad because it limits the potential entropy of a password, if implemented consistently it's technically not any worse than a limit that's presented to the user. But just wait until the new hire doesn't know about it and implements a form without it, and then all of the sudden users are entering the same "long" passwords they always have and scratching their heads when it fails.

Because more than 33 characters would take too much space, duh.

If the password is too short, an attacker can brute force the hash by simply trying all 6 character combinations of allowed password characters, provided that the hashes get leaked or hacked, which happens quite a lot these days. (Or if the website is stupid enough to allow an attacker to brute force try all these combinations without throttling you or stopping you at the xth wrong entry)

I was talking about maximum password lengths, not minimums.

> The same character cannot be used consecutively

Doesn't that drastically lower the number of attempts required to exhaustive-search a password from a hash? Especially if people are using passwords as short as 7 characters. Even if not, that's one of the most moronic password rules I have heard.

Well, yes. But consider the opposite case: the company doesn't prohibit these kinds of passwords, and the attacker does an exhaustive search of ONLY passwords that have sequential characters. That attack may be better even though they are only searching through a fraction of the total password space, since users will very often choose passwords that have sequential letters.

Then they send you emails (from some random non-official looking domain) with password protected PDFs and ask you use bits of your account details to open it. The opportunity for phishing is insane.

Reply on news.ycombinator.com