Man who made passwords hard regrets rules that 'drive people crazy'

[sdrothrock]

Recent discussion: https://news.ycombinator.com/item?id=14967731

[leereeves]

The worst part of password rules is that every site has its own.

One requires a symbol, another doesn't allow symbols. A third requires 12 characters, a fourth only allows 8.

And they only tell you the rules when you're creating a password. They could at least remind us of the rules so we could remember how we had to mangle the password to match.

[ReidZB]

Or sites that require at least one symbol, but then mysteriously disallow a handful of common symbols (e.g. I used a site the other day where exclamation points were not allowed). Makes password generators like 1Password's useless about half the time, since 1Password rightly will pick from all (most?) common symbols on a standard US keyboard.

And of course, why would the site tell the user of its obscure symbol requirements before the user tries to enter their brand new password? No, I guess they think it's better to leave it at "a symbol is required" and then reject symbols users use one-by-one.

[rflrob]

What's the worst is when they tell you the rules when you try to reset the password, and then you know what your password probably was, but a) they won't cancel the password change process, and b) they won't let you reuse the old password.

[x1798DE]

I'm not sure this is a bad thing. You should have a different password for each site anyway, so the fact that it disrupts your ability to reuse passwords is an accidental pseudo-feature.

[wisty]

It's even more fun when different forms (e.g. set password and enter password) have different validation rules.

[zeep]

If you include 1 uppercase, 1 lowercase, 1 number and have at least 8 characters, you should meet the password complexity requirements of most servers.

[ransom1538]

If I cannot use my passwords -- I always give my favorite password a try: ''; truncate table users;

[acchow]

Would this be a crime if it worked?

[teilo]

It is relevant that NIST 800-53 Rev. 5 has dropped password complexity and rotation requirements because they make things worse, not better.

[dawnerd]

Some sites are just insane.

https://github.com/duffn/dumb-password-rules

[edflsafoiewq]

Anyone else annoyed by GitHub itself? One digit and one lower-case letter required.

[rhizome]

Also: https://twitter.com/PWTooStrong

[frik]

Apple iTunes/Apple ID pwd rules is really annoying.

Microsoft online service incl (based still on the decades old 1997's Hotmail login system is archaic) has an upper limit of 8 (or so) chars. (Office365/Outlook.com/etc)

[hallman76]

Cool. Now can we find the person responsible for “smart quotes”?

[mattbeckman]

If you're a Mac user, System Preferences > Keyboard > Text > Disable Smart Quotes or choose your quote replacement preference.

[tqkxzugoaupvwqr]

Aren’t this the correct quotation marks? " means inch or seconds and is only used because most keyboard layouts make it hard to type the correct quotation marks.

[MartinCron]

And then ampersands, while we are at it?

[ScottBurson]

> Burr said he prefers phrases from literature.

I distinctly recall seeing somebody post a comment a few years ago -- I think it was here on HN, though I'm not sure -- to the effect that they had used a line from an obscure poem in Afrikaans as a password, and it was cracked. -- Oh! HN Search comes through for me: here's a recent HN comment [0] by someone who also recalled it, with a link to the original [1].

[0] https://news.ycombinator.com/item?id=14781311

[1] https://www.reddit.com/r/Bitcoin/comments/1ptuf3/brain_walle...

[paulie_a]

I referenced this article today at work involving a discussion about password security, 2FA and actual customer experience.

Tonight I was dealing with Wells Fargo for a password reset. They have a max of 14 characters and a generally awful interface. I took screenshots of the process to use as a guide of things to avoid.

[spraak]

This nearly could have been on The Onion :)

[spiznnx]

I had an idea for a website password system: instead of letting the user set a password, you just give them one. Prevents password reuse, which is the only thing that ever really commonly gets anyone's account hijacked in my opinion.

Doesn't even have to be strong, could be one word from the top 10k English words. Require reset after 5 failed attempts.

Would there be anything wrong with this approach (besides being sort of user-hostile), or have I misunderstood the website account security threat model?

[gelatocar]

A 1 in 2000 chance of correctly guessing someone's password could lead to lots of attempts which at best would cause lots of password resets and at worst cause lots of compromised accounts.

[SomeStupidPoint]

Is Diceware still recommended?

http://world.std.com/~reinhold/diceware.html

[nshepperd]

Yes. Using diceware (with actual dice) is still the most reliable way for a normal person to create a strong password. Use diceware. Ignore this guy's bad advice.

[xname2]

Our university forces us to change the password every 150 days. It is such a pain in the s, because there are too many apps on too many devices need to update the password. I asked the IT department, can you guys consider to stop this and find an alternative security policy? The answer is no, because this security policy is in the state law.

[Fezzik]

If you're really hellbent on it, you can probably tell the IT department they are full of shit and ask for the citation to the state code number - I am no state code scholar, but I have never heard of anything like this. In the NW States I am familiar with I could not find a single code section that even remotely touched on passwords at state schools. It would be an odd thing to legislate. Some states are goofy though.

[mikeycgto]

U2F and Yubikeys if you're serious about it.

[mzzter]

Relevant xkcd: https://xkcd.com/936/

[asherkosaraju]

Duh. Obviously. And not like it's secure either. THe worst part is some sites ask you to change your password every month/3months/etc. That kinda sucks.

[notreallythough]

password must contain 8 characters and the temperature of the room you're currently occupying, in degrees kelvin

[Casseres]

Kelvin is not expressed in degrees; it's just "Kelvin". Now to really throw people for a loop, tell them to do it in degrees Rankine (even less people know what that is).

[Mistletoe]

Have his rules even been proven to be right? There's that famous xkcd comic about passwords and password strength checkers like https://howsecureismypassword.net that seem to imply otherwise. Short passwords with symbols seem easier to crack than longer ones with words put together a human could remember.

[forapurpose]

> Have his rules even been proven to be right?

The rules, if used properly, work perfectly. But using them properly is burdensome, which means most people get lazy and the result is insecure passwords.

There are about 95 letters, numbers, and punctuation marks and symbols. If you choose a 12 character random password, it's uncrackable by brute force. The problem is, few people want to choose and remember a 12 character random password, and fewer will do that for each of the dozens of passwords they must use, so they choose insecure, non-random passwords.

[Dylan16807]

Right about what, specifically? Being random is good. Being short wasn't part of the rules. Rotation is pretty bad. And words don't fix the core problem of making a good password because people love picking non-random words.

In general, every two random characters is worth as much as one random word. I personally find it as easy to remember three random characters as a word, so I get better mileage out of random characters.

[mallaidh]

Unless it's a dictionary attack.

[pishpash]

This guy sounds like a joker with no understanding of information theory.

[colordrops]

This guy must be a joker with a name like Bill Burr.

edit: for those who down-voted, one of the most famous comedians in the US at the moment is also named Bill Burr.