Password policies of most top websites fail to follow best practices | Hacker News Reader

Password policies of most top websites fail to follow best practices

passwordpolicies.cs.princeton.edu

Composition policies seem to be one of the hardest things to stamp out, as is evident here where ~45% of top sites still use them.

I got to talking about these types of policies with a friend who was asking about revamping the requirements at their company. I talked through it all, showed the math, showed how few extra minimum characters it takes to blow out all of the common complexity rules, talked about the simplicity, showed the latest research and recommendations from respected bodies, and in the end they still implemented them. Why? It'd be hard to explain the change to management and there was fear the users would be upset upon seeing the couple extra character requirement since they are already used to the complexity rules. Somewhat the "security theater" note in the conclusion but probably also a little bit of not wanting to argue with the Deloitte types of the world also mentioned in the conclusion. On the bright side they did at least add blocklists.

It would have been interesting to see information on MFA in the dataset though. The paper notes MFA may be a reason sites have shifted their attention away from password security but seems to have skipped MFA during the data gathering process making it hard to say much about it. Beyond security strength MFA is also a powerful tool to attack another password policy problem - expirations. It allows you to answer the question of "how long should it be acceptable for an advisory to have access to a compromised account" with "it isn't" instead of "6 months" or whatever the annoying policy is. And sure, improperly implemented/insecure MFA could be a whole paper itself, but it's hard to make claims of how many sites have weak/strong password policy without at least a cursory look at that path.

NIST have updated their password advice but it's still not flowed through to other places like PCI, Australian ISM or tons of other standards.

If you're setting an org-wide policy it should (at least in theory) comply with the intersection of all the other crappy standards you're stuck with.... which means password complexity and pointless expiration requirements for at least a few more years :-/

The paperwork/compliance lag issue mainly affects internal systems and directory, but can flow on to public sites as well.

If you have to convince someone that they should drop those bad requirements, try to show them parts of Per Thorsheim's NDC Security 2022 talk. https://www.youtube.com/watch?v=pKP-nv2Oqdg

Password policies? Ha! Let's start with the idiotic insistence that people use E-mail addresses as user IDs. Ever notice that security-critical sites never do this? I have yet to see a bank or brokerage enforce this dumb-shit policy.

https://goldmanosi.blogspot.com/2012/06/forcing-people-to-us...

Enlighten me: If I’m registering with my favourite store’s frequent costumer program and emails are “idiotic”, do I need to take the time to pick a username for a system with absolutely no social features, or do I just memorize the 12 digit long user ID (as opposed to my email, which I need to know regardless)?

What “12-digit” thing are you on about?

User IDs should be any string that a user cares to use, as long as it’s not taken. If he WANTS to use an E-Mail address, fine. But don’t force him to.

So it is the first option - having to pick a random username for a website with no social features.

What do "social features" have to do with any of it?

I'm kinda okay with that as this ensures the average user has a password recovery path. Because we know a user never forget a password :/

And for the security-conscious among us, there are email forwarding/proxy service to hide your actual email address.

instead they enforce even dumber policies, like choose a username that has to include a number, and we're going to mask out parts of it every time we display it

Yeah, Chase bank started doing this. Talk about not getting it.

Adobe is one of the most frustrating website when dealing with password. Its requirement leaves me scratch my head to come up with any usable password that I can remember, to the point that I may be required to reset it every time I logged in (which, though not frequent, cause me to forget it).

Why people can't get it that passwords are plain stupid? I for once use the same password Azcbnm1]{} for all these websites requiring strong passwords. I don't care if my password has been leaked. Eventually all passwords are leaked.

Any recommendations as an alternative to passwords?

https://news.ycombinator.com/item?id=31643917

https://fidoalliance.org/apple-google-and-microsoft-commit-t...

I'd be okay with public keys, but Fido/U2F/WebAuthn is more secure and simple to handle from the user perspective.

I love the idea of hardware keys, but the issue with those is that everyone would have to get one, and that's only realistic on the long term.

Also, a hardware key is much easier to get stolen then a password. On one side, passwords are breached of one or two websites, on the other side hardware keys get stolen and all your keys are out there.

Another point against hardware keys is the current market: I'm trying to find a key with open source firmware with the ability to upgrade said firmware, but no luck so far. Good keys are all sold out or are being sold through crowd funding with months of waiting time.

I'd love to use my EU eIDAS citizen card which requires a password to unblock (not a simple "touch to unlock" ) , which has signing capabilities, but I can't seem to find any usable software that allows me to expose my card as a fido device.

So, for now I'll stick with my password manager.

Fido/u2f can be used without passwords

Webauthn

Reply on news.ycombinator.com