Hacker News Reader

Comment by lotyrin | Hacker News Reader

It's visually unclean, and of dubious security use, because nobody should be trying to remember all their passwords, or using a memorable scheme that is adapted based on requirements, just big random string that meets requirements and is managed somehow.

View on HN

> nobody should be trying to remember all their passwords, or using a memorable scheme that is adapted based on requirements

I strongly disagree with this. Using a password store guarantees that it is technically possible for someone to recover a complete list of my passwords without me being aware. And means I am either storing my passwords online someone which makes it far easier for that technical breach to happen, or I am relying on a piece of hardware not failing to maintain access to my account.

Remembering a unique password for each site (that I actually care about, I can write down passwords for sites that I don't) is simply more secure. Sure the passwords will be easier to reverse if you get a hash of them then a real random string, but it would still be extremely difficult/beyond most cracking software (it's easy to increase reversing difficulty by using a long hard-to-reverse suffix shared between all your passwords), and you'd have to steal and reverse a lot of hashes to find useful patterns.

My credential management tool has ~300 credentials in it, of which I use roughly 10% frequently, there is no way for me to remember these, without creating a scheme which someone could eventually reverse given enough of my leaked credentials (so far about 15% of services I use have had breaches using weak hashes, and these tend to end up in public). Such a scheme would also have to support password rotation (for services which are breached, or which expire credentials) If I am going to store them somehow, an encrypted blob seems to handily beat pen and paper.

The only scheme I can think of that would be strong would be one that is tool-assisted and given a set of password requirements (length, allowed characters, etc.), a domain, a master key, and an incremental counter, derived keys and formed passwords on the spot, but I'd still need to remember the criteria for each site, and the counter positions, and keep those secured... so whats a few more bytes?

Which would be fine if all sites used the same rules. But I often find that I can only find the rules when I break them. Such as "password too long > 16 characters" or "cannot include a space character" (why not?)

The rules should be, and in my experience often are, explained where you set/change you password. So on the account creation and change password pages.

The OP is talking about the login dialog.

I wouldn't say they are "often" displayed at the password change/set prompt. It's more of a "sometimes" in my experience, although if you get it wrong most sites will then tell you the requirements.

I think everyone can agree that hidden requirements are the worst. Some sites do this out of a misguided notion that it gives the hackers information so it must be hidden for security.

IMHO, the only requirement that really does anything is length. In my experience it's easier to type a 16 character passphrase than some jumbled up mess that's easy for a computer to guess anyway.

  Good password (fails many security requirements):  "Cokar fed Hunganix!"

  Bad password (will usually be accepted): "+yP3wr1t3R"

I sort of agree with the OP. If you are at a login box and put in an invalid character into the password field, the box should tell you that in the failure message. That may very well jog someone's memory that the site has retarded password policy and they had to modify the password pattern.

Reply on news.ycombinator.com