Of the many, many, many bad things about passwords, you know what the worst is? Password rules.
This is a companion discussion topic for the original entry at https://blog.codinghorror.com/password-rules-are-bullshit/
This is a companion discussion topic for the original entry at https://blog.codinghorror.com/password-rules-are-bullshit/
4 Likes
Oh, gosh yes.
-
My Secure Passwordâ Sorry, no spaces allowed. (Why not?) -
MySecurePasswordâ Sorry, Passwords must include a number -
MySecurePassword1â Sorry, Passwords must include a special character -
MySecurePassword 1â Sorry, no spaces allowed (Argh!) -
MySecurePassword%1â Sorry, the % character is not allowed -
MySecurePassword_1â Sorry, passwords must be shorter than 16 characters -
Fuckâ Sorry, passwords must longer than 6 characters -
Fuck_itâ Sorry, passwords canât contain bad language -
Password_1â Accepted.
15 Likes
Type something in a language other than the keyboard language. Youâd get a fairly random password in result that potentially includes numbers, punctuation, etc.
Yes, password rules are bullshit, but frankly bad implementations are worse, because they train users to not even TRY to get funky with their passwords.
Iâve encountered more than one website that requires punctuation, but doesnât allow for every punctuation mark in ASCII, let along other languages.
Iâve encountered sites that let you set a 20 character password, but then their login system dies with errors when you try to use it.
These fails and many more have taught me to keep it nice and simple with passwords - donât go over 10 characters, and donât get any fancier than the rules require - that way you wonât get locked out!
No, thatâs not a great thing, but given my utter failure at getting these companies to fix their shit in the past, I canât spend my days learning what each system really allows.
3 Likes
You forgot the one when you use a password manager with pseudo-random password, and the site actively blocks pasting. I hate passwords. On my sites and in my apps the only password rule is minimal length, nothing else. I ensure password fields support Unicode. Passwords with Unicode are the best for obvious reasons. Most sites and apps made by idiots forbid using Unicode in passwords, even if they allow Unicode everywhere else. BTW, âFuck_it!â worked most of the times for me 
Without â!â it would only have 7 characters, you knowâŚ
4 Likes
I think to make this world safer we should
- request passwords to have characters from at least 3 different charsets (e.g. arabic, russian and chinese)
- limit the access to the account to specific hours of the day (login only possible between 6pm and 7pm)
- test for real knowledge the person in question actually has. So when the person registered stating it has a phd in physics it should be able answer within 30 seconds what the relationship between phason and quasicrystals is.
After that, this world should be a lot safer.
2 Likes
And my personal pet peeve (mainly for sites that donât hold anything I want to keep secret) tell people what the sign in rule is on the login screen.
That way I stand a chance of remembering what I used, rather than having to receive an email every time I visit.
2 Likes
Well said.
These rules are annoying and always gave bad experience, they could add attempt limits and other methods to keep the account safe. But adding only special char or small and caps doesnât prevent from account getting compromised.
Oddly enough for a government bureacracy, the US NIST is making progress on this topic.
Of course, their documents are written using wack jargon that only proves they donât get out much. But theyâre suggesting many things you suggest, Jeff.
Theyâre also suggesting an end to the foolish practice of requiring people to change passwords once in a while. That kind of policy has only one purpose: driving sales of Post-It Notes.
2 Likes
Password managers are EVIL. The one time I tried to use one, it got hacked. Donât like being dependent on third party service. Of course managing unique strong password for every site is beyond human capabilities. I found my own solution: writing a password manager for myself. Itâs less than 20 lines of code and never stores anything - it just does mathematical calculations on list of words, then generates unique 30+ chars password. Brute forcing such password is next to impossible.
Of course nobody is going to hack you personally today (unless youâre some big shot). Itâs the servers that got hacked - even the strongest of strongest pass could not save you if some service that stores your credit card info gets compromised. Some day passwords will become obsolete.
1 Like
At what point should users be responsible for their own security?
If I tie my front door with a piece of string and my house gets robbed, the Police donât say, âWell, itâs our fault for not forcing you to get a proper lock.â
It seems like a balancing act, just enough rules to stop them from being stupid, but not enough that youâre forcing them into a password theyâre not comfortable with.
Perhaps we should make the jump from âPassword Rules Are Bullshitâ to âPasswords Are Bullshitâ? Especially as, even with high-entropy passwords, their biggest point of weakness is the password reset flow:
So why not make that the default? If the user doesnât have a session, send them a one-use password so they can log in. Keep the session around until they explicitly log out. Make it easy for them to view and end their current sessions across all their devices (perhaps even prompting them to give each session a name, so they can recognise it later)?
6 Likes
Password rules are bullshit, but some are in a whole other league of bulshitness. My two âfavoritesâ are: 1) no spaces allowed in passwords; 2) ridiculously short maximum password length. I had a major bankâs website reject my perfectly good 16-character password because they require a maximum length of 8. Seriously?
Then there are those sites which force you to change your password and say âyour new password canât be one of your last four passwordsâ. They are just begging you to change your password five times in a row to circle back to the original out of spite.
2 Likes
Itâs not so much password rules that are bullshit, as passwords in general. You can spend all the time in the world enforcing strong passwords, but they are still vulnerable to attacks as sniffing, hijacking or phishing. âGood passwordsâ that are complex enough and arenât reused end up in a password manager anyway. Thereâs no inherent reason this should be a key protected by hardware instead. (which isnât really possible at the moment)
If you think password rules are stupid, American Express has username rules that force you to include a number in your username. Head-slapping nonsense.
5 Likes
I was renewing a UK passport recently, which involves filling in a web form with pretty much all the information needed to steal a whole identity. I needed to fill in a password to save this information (despite the fact that I didnât particularly want to save for later anyway). I had to have an 8-15 character password with various limitations on characters, and also I couldnât paste into the password field. After about a dozen attempts at using randomly generated passwords I gave up and manually created one. A complete fail on the governmentâs behalf!
For that the title claims âRules are bullshitâ you mention and require a lot of them yourself then in Discourse. Why even bother? Let the user enter whatever they want. Entropy or not. Its their fault if they chose a weak password, or set the password to the same as their email.
That is seriously fucked up. I canât imagine how the developers could think that this a good idea or why that might be even required technically.
Yes, sure â thereâs some logic there. But there are many instances where a compromised password will negatively impact your community in a big way; multiple compromised passwords can essentially transform your platform into a spam factory and scare everyone else off.
Not to mention that even if a compromised password is your own fault, youâre associating that compromise with the site. Instead of visiting the âregular old siteâ youâre visiting âthat site where my password was compromised that one time and I had to go around changing all my passwords and I feel embarrassed about all those diet pill ads someone posted under my nameâ.
So sure, you can set a âfend for yourselfâ password requirement and simply require a single character or more â but at that point you also kind of have to accept that at any point your entire site can descend into chaos.
3 Likes
I recall being asked to provide technical advice on a project bid to implement password rules. The one that got me was the request by the client to disallow passwords which were similar to prior passwords. So you couldnât change your password from âpassword1â to âpassword2â when the password aged out. Since we were following at least the bare minimum of good password management (salted hashed passwords), we pushed back on that request â how would we know how similar the password was to older ones?
I use a password manager that runs locally on my machines, with its database under my control, so Iâm not reliant on a 3rd party. If course, if I donât back it up, or otherwise lose it, Iâm still screwed.
I hate the âwe wonât tell you what the password rules are until you break themâ system. Alexander_Wrightâs post really rings true to me, especially the âsome special characters are more special than othersâ. If you are hashing your passwords anyway, what does it matter which special characters are used? Or length? Or any of these limitations blocking good passwords?
3 Likes