Hacker News Reader

Comment by rohit89 | Hacker News Reader

I have a question about the password policy.

    All sites should have the following base password policy:

    Passwords must be 8 characters or greater
    Passwords must require letters and numbers
    Blacklisted passwords should be implemented (contact     infrasec for the list)

Is it responsibility of the website to make sure that the passwords are strong for the general user ? Isn't it the user's responsibility to create a good password ? I would think that the site should let the user know about best practices but ultimately it should be up to the user whether to follow it or not.

View on HN

Is it responsibility of the website to make sure that the passwords are strong for the general user ?

Yes. If a password is too weak and it results in a user's account getting compromised, the website gets the blame. Thus, the website mandates the password policy.

And depending on the site, weak passwords and compromised accounts directly impact other users. Imagine if eBay had no password policy and some of their largest sellers had their accounts compromised as a result; what impact would that have on buyers?

Enforcing password strength makes sense for a site which stores sensitive data. That said, some simple math suggests that length, not character complexity, should be required.

http://security.stackexchange.com/questions/6095/xkcd-936-sh...

I wonder if there are any sites that simply forbid passwords that are known to exist in rainbow tables.

I'd assume that's what they're talking about with the 'use blacklist'. It'd be easy enough to occasionally repopulate it with "obvious" or known-compromised passwords that turn up.

Likewise, I assume they're keeping that list semi-secure to avoid black-hats/kiddies getting their hands on a list of really good passwords to throw into their cracking engine ruleset.

Reply on news.ycombinator.com