Hacker News Reader

Hacker News

Comment by deedubaya | Hacker News Reader

Full thread

deedubaya

Password restrictions are the worst.

Office365 doesn't support passwords > 16 characters in length. WTF.

View on HN

Paypal passwords are 20 characters max.

Also Paypal doesn't support any form of secure OTP.

Also, Paypal forces security questions on the user.

In other news, my Hearthstone account has better security than my money.

I've been locked out of my Hearthstone account for the last few weeks because I lost my 2fa authenticator and they've refused to remove it due to my driver's license being expired.

BTW, Battle.net Authenticators look nonstandard at first glance, but they are actually 8-digit TOTP. I wrote a Python library and command line utility which can create new Battle.net authenticators as well as generate codes and QR URIs:

https://github.com/jleclanche/python-bna

See the README for usage :)

This should help you to have a backup next time you get locked out!

This just saved my ass. I only play Diablo 3 occasionally, but Blizzard doesn't offer their client on Windows Phone, which would have been great to know prior to switching over from Android. Fortunately I didn't have the same issues getting it taken off of my account as the parent comment , but I was stuck using SMS as a 2FA after that, which is no beuno. I just used your python script, imported the 'secret' into Microsoft Authenticator via the generated QR code, and now it is working just as if I was using one of their auth dongle doohickies. Fantastic, thank you sir/madam!

Glad it helped!

> This should help you to have a backup next time you get locked out!

The official authenticator also displays a backup code which it tells you to keep a copy of somewhere safe...

I actually did use a system like this previously, but somehow the site just stopped accepting the codes from my TOTP app one day. I restored the official blizzard authenticator app from a backup but that wasn't working any longer either.

Sounds like time shift to be honest.

I vaguely recall checking the clock but it's possible. I've since deleted the backups anyway.

Sounds like it's working at intended then? I imagine your reaction to losing everything in your account would amount to much more then a minor annoyance.

That makes sense for WoW or Diablo. Hearthstone doesn't have any trading system, so there would be nothing to steal.

It's all the same account.

You think that's bad. Virgin Media - a major ISP/Broadband supplier has these restrictions on is e-mail passwords (effectively the key to many kingdoms)

Be between 8 and 10 characters long (with no spaces)

Contain only numbers and letters (no characters like @*? etc).

Start with a letter.

Not contain 3 numbers in a row.

You think that's bad? Banc Sabadell, a bank in Spain, requires the users of online banking to have a 4 digit number as their password. Although, they also have 2 factor for doing things involving moving money.

But still...

> Start with a letter.

That is a requirement in a ton of places. Try creating an Oracle database user, and have the password start with a number. To be fair it's documented that it won't work, but Oracle won't stop you from doing it, so you end up with an unusable account.

This shouldn't be an issue. You should always be storing a hash of the password, making the content of the password irrelevant. The hash might start with a number, but then you can just make a versioning scheme for the hash which is identified by the first character being a letter. I don't understand how this is still a common issue.

Every password hashing library I've worked with has output starting with a $. It's use a deliminator to separate the id, strength, salt, and hash (sometimes the last two are not separated).

So for example, a bcrypt output might look like: $2a$12$2zuYZPvIlfC.L84k0oWZR.8yGd62dPkhoyg4aEC6TzGl7aASTw5F.

I think has something to do with older Outlook clients and how they pass credentials.

You can bypass the limit with ADFS.

Up until about 2010, Amex Corporate Card website required passwords at minimum 6, but not more than 8, with minimum one upper/one lower/one number each, and zero anything else (aka no punctuation or non-basic ascii letter).

serious question: what's the issue? 16 characters alphanumeric = 95 bits of entropy, which is enough for most purposes.

With password generation, nothing really. If you want to choose the password yourself, it limits your options (for no good reason for the user).

Yes - for instance it makes the Correct Horse Battery Stapler passphrase strategy[1] difficult to apply, because now you can only pick words up to ~4 letters long.

[1]: https://xkcd.com/936/

Right. Human-memorable passwords have low entropy density, likely less than 2 bits per character. 32 bits of entropy doesn't sound very appealing.

A long passphrase can be easier to remember than a 5h0rt 5tr1ng. On the mental side, it can take more internal *pointers to remember the latter than the former.

A common reason to limit the length of a password — and doubly so to a power of 2 — is that they’re being stored or passed around as plaintext

95bits of entropy for a computer, but for an actual user?

Humans are bad at remembering most things. The more entropy there is, the more difficult it tends to be for us to remember.

The way for increasing password entropy, whilst lowering the human bound, tends to be by utilising things humans find easy to remember, but computers find difficult to randomly/brute-force solve.

That usually requires a longer password.

You can sort-of bypass the human memory problem by using password managers, but they have their own set of problems (mostly usability), and assuming people actually use them is an assumption too far in most cases.

It's a restriction without any reason other than decreasing security. (Unless they plan to store plaintext passwords, which should be prohibited by law.)

I use a password manager with auto-generated password length "turned up to 11" (64 characters). It probably doesn't matter, but I am decreasing the secruity of my password because of their limitation.

Reply on news.ycombinator.com