Hacker News Reader

Comment by charDiversity | Hacker News Reader

When I feel like a security goon's arbitrary and capricious password policy is irrational and counterproductive, I make my passwords worse in the hopes that I have to someday read it to someone, or perhaps it gets spilt outin the open, and then everyone will see how forcing me to pick a password that adheres to certain characteristics solved nothing.

Just wait. Someday you will see dumps of pwnt password that look like:

  Password-1234
  Password_1234
  Password!1234
  Password&1234
  Password?1234
  Password$1234

And that is rated as a "VERY STRONG" password.

Have fun with your character diversity, and your 90 day password expiration rotation schemes. Go ahead and try to force me into a corner. I'm still picking terrible passwords and I'm picking especially terrible ones because someone out there is trying to pull my strings.

Pull my strings. Make me more predictable within your little security policy world. See how that plays out.

View on HN

Just recently Estonian Information System Authority published a new report (including new guidelines for passwords) basically telling: "Drop password requirements, allow long passwords and restrict the use of short and top-n passwords".

Why I'm mentioning this is because now I have an actual official document I can send to Estonian companies in addition to my own words (that weren't previously believed, ugh) why their requirements are inane. I think this kind of behaviour shows that we actually need some kind of monitoring or regulation here to build more secure software for everyone.

Also as you mentioned bad-"strong" passwords, I "love" how something like "Qwerty!1234" satisfies most requirements but "8f434346648f6b96df89dda901c5176b10a6d83961dd3c1ac88b59b2dc327aa4" is not okay because it doesn't contain an uppercase letter or a symbol.

NIST had a good blog on the subject: https://www.nist.gov/blogs/taking-measure/easy-ways-build-be...

Why is the solution always regulation with you people

Because profit-driven businesses never bother to do anything that doesn't bring profit, even less when it requires effort.

I shamefully have to admit that I tried to logon to your (throw away) account using the list of passwords you supplied.

Username checks out I guess.

You and 50 others.

I completely agree. "Your password must be at least 10 character long, include 2 upper case, 2 lower case, 2 digits, 2 special characters, must be changed every 60 days and cannot be reused for the next 3 years"

G0Fuc4Y@urse!f

To me this is a sure way that people are gonna pick horrible and stupid passwords.

Even better if it just says "your password does not fit our requirements" :)

I was signing up for a bank account and had to make a password for my online account in the branch. Turns out my 16-character randomly generated password made the system unhappy. Tried 6 more times with newly generated passwords (character-only, alphanumeric only, alphanumeric and "#" or "$" only) and it just said the password was not acceptable. So in the end I used my probably ~15 bits of entropy super easy to crack password from when I was 10, with a few randomly generated characters on the end (because more than a few would make the system complain again).

The pervasiveness of poor UI and security design baffles me. You would've thought that one of the largest banks in the world would have a little more competency but nope.

> Your password must be at least 10 character long

You forgot "and may not be longer than 16 characters".

Unless they've changed it in the last couple months, TRowe Price still limits passwords to 10 characters. And this is after a recent "We've upgraded our security!" push where I had to reset everything.

I've seriously considered closing my accounts over it.

Edit: Yep, still as bad

Password must be 6-10 characters and contain at least 2 numbers and 2 letters. Password may not contain the following special characters: space , + " % & ' ; = ^ or curly braces.

my bank's password has to be exactly 8 characters and is case insensitive

it's pretty insane considering it's like the most important password I have

I've got one better: my online banking requires 7 digits exactly, numbers only. This is so you can use the same "password" in their phone banking thingy.

you just know they are storing it in a plaintext VARCHAR(16) column and not hashing it in any way ....

HRBlock does this.

And leave them in a post-it glued to their monitor

Depending on your threat model, a strong password that is written on a piece of paper on your desk might beat a weaker password that's memorized. That would at least require physical presence of the attacker and if your desk is reasonably secured, that might be ok for a lot of cases.

exactly -- that and write down those horrible and stupid passwords on sticky-notes and attach them to their monitor bezel or keyboard.

I like this entropy based password strength checker:

https://github.com/dropbox/zxcvbn

Here you can see that it realizes that all your passwords are weak: https://lowe.github.io/tryzxcvbn/ (it says: cracked in minutes, or seconds, in an offline attack)

And it does this without requiring uppercase or symbols or numbers. It even understands that passwords like "qwerty" are trivially cracked – it looks at how far the keyboard keys are from each other. Among lots of other things.

The only appropriate password requirement is length.

A policy that requires 12 or 14 characters alone will have much better security than all these character sets, time limits, and other nonsense while only requiring 6 or 8 characters.

And these sites that limit password length to ridiculous short lengths are infuriating. Who could have possibly ever thought that was a good idea???

Not necessarily. "aaaaaaaaaaaa", "password1234", and "pennsylvania" are all 12 characters, but they're all insecure. These might seem like stupid passwords that nobody would use, but if you enforce a minimum password length as your only requirement, then I guarantee some user is going to use something like this.

I agree that length is generally much more important than anything else - but it's not the only factor. Long passwords can be insecure too. Unfortunately it's not easy to validate what exactly what makes an insecure password, and as a result we get stupid requirements that prevent some very good passwords (e.g. diceware-generated passwords).

You're right that dictionary words are weak, regardless of whether they are long or short. Same applies to anything that can be arrived at by a simple heuristic such as dictionary word + 1, capitalized dictionary word, dictionary word with "@" substituted for "a", etc..

However, outside of the above caveats, it's a common misconception that more complex is more secure. Which of these is harder to crack?

catzzzzzzzzzzzzz

db0mcgn20y64zzn7

Since an attacker is unlikely to arrive at either of these through a dictionary or heuristic, they will take roughly equally as much time to brute force.

When you force users to comply with arcane password policies, a high percentage of them are going to build their passwords in very predictable ways that are easy to code into a heuristic, like replacing "o" with "0" or something. These kinds of changes add no security value and are just extra work/bother for the users. With the length requirement, it's unlikely they're going to think of a dictionary word off the top of their head that is long enough (how long did you have to think about it to get pennsylvania?), and thus, on average, you're more likely to get more passwords that are a couple of words, or a phrase, or something that is a lot harder to dictionary attack. Once you break away from the dictionary, complexity doesn't matter, only length.

Such a rebel. Remember that at the end of the road it’s your identity your password protects.

> your 90 day password expiration rotation schemes

Those scenarios are almost always a bad employer policy, in which case it's their data the password is protecting.

It's often because of regulation. PCI standards, for example, require this.

>> 90 day password expiration rotation schemes

I have a bank site that I have to log in to every month, but only once a month. So every 3rd time I use the site, I have to choose a new password. Very annoying.

Reply on news.ycombinator.com