Hacker News Reader

Comment by vault_ | Hacker News Reader

Wow, that's pretty bad, but it's got nothing on one 'security' measure I ran into on an online college application site.

To enumerate, the password had to:

- have exactly 8 characters

- contain characters from 3 of the following 4 groups

-- lowercase letters

-- uppercase letters

-- numbers

-- ? . , _ - + = $ ! –

There were also some things that the password could not do:

- be a dictionary word

- contain any series of characters in your username

All of this was enforced.

View on HN

Apart from requiring exactly 8 characters, the other constraints will genuinely increase security.

Except, of course, that half the students will end up carrying their password on a piece of paper in their wallet.

My biggest issue with it, and other constraints like this though is that it just feels rather contrived.

That and it took far too long to some up with a password passing the description...

There is nothing wrong with carrying your password around on a piece of paper in your wallet. This is the Bruce-Schneier-approved method.

http://www.schneier.com/blog/archives/2005/06/write_down_you...

Or, just have a half-decent password management tool which keeps an encrypted file of your passwords on your phone, and remember just one password.

Schneier may say it's ok, but to me it seems stupidly insecure, especially when you consider that we're talking about a student's university network password, and that there'll be identification in that student's wallet that allows the thief to make use of the password immediately.

When I first started school we were required to have 7-8 characters as well and the reasoning was in the faq: certain systems had not been upgraded to handle more than 8 characters which was interesting, I'm assuming it was certain computer terminals that hand't been upgraded as the restriction is now at 20 or 30 characters.

But they had a similar way to increase security as your online application:

Must contain 3 groups:

- uppercase

- lowercase

- numbers inserted in between normal characters

Special characters were optional but welcome.

As long as their hashing method is sufficiently slow that's not too bad a set of requirement. It at least null and voids the easiest sort of attacks.

Which is not to say it is good.

Reply on news.ycombinator.com