Hacker News Reader

Comment by andrewchambers | Hacker News Reader

Dictionary attacks are incredibly effective. Humans have a hard time coming up with unique passwords.

It'd be nice if Windows/OSX/iOS/Android came with 1Password out of the box. It's both easier to use and more secure than manual passwords, which is a rare combination.

Safari on OSX & iOS does do random password suggestions, out of the box.

I've found this to work pretty well in most cases, but there are some websites that don't semantically mark up their fields in a way the browser can recognize, and there's no way to manually trigger the password suggestion feature.

Worse, many sites -- notably banking sites -- reject secure passwords (no weird characters, no long passwords)

One of my credit cards requires a password no longer than 16 characters, no spaces, no special characters. They're only a few more restrictions away from just requiring that it be a significant birthday or something similar.

What is worse than rejecting is I know of one major site that would, at least used to, silently truncate long passwords. That was... frustrating.

I used to have an ATM card with an 8-digit PIN. When entering the PIN, I noticed the screen would flash after the fourth digit. Subsequently, I discovered I actually only needed to enter the first four. That continued until the bank got taken over by Bank of America in 2004. Suddenly, I needed to enter the whole PIN!

I think generally all it needs is a password field.

My Thai business banking system is paranoid and disables autocomplete, paste, etc, even with the security of a physical token), but the one that really annoys me is things like Basecamp - I had to futz around and disable JavaScript for a login to be recognised and prompt to save a password - by default it does an XHR which doesn't trigger the "save password" prompt.

They are also quite easy to prevent, though.

They are, but the average granny or non tech person doesn't care enough.

I was thinking server side..

And most services with password strength requirements, for that matter.

It's actually quite easy using something like the battery horse staple thing. Most people just don't care enough about passwords.

Reply on news.ycombinator.com