News for hackers. Stuff that matters.

A comment on Stop forcing arbitrary password rules. Parent comment

Re:Stop forcing arbitrary password rules by Asbostos on Saturday October 24, 2015 @07:52AM (#10443310)
Ironically, it's easier for me to log into my internet banking than twitter because internet banking only has a hardware key and a simple 6 digit pin, but for Twitter, I have to go find my paper password list and type it in. It would be great if there was some kind of common hardware key that could be used on multiple sites.
[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by Natanael_L on Saturday October 24, 2015 @07:56AM (#10443320)
U2F! The new Yubikeys supports it, and there's other hardware you can get too that supports the protocol.
[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by Asbostos on Saturday October 24, 2015 @08:51AM (#10443437)
Hey that looks fantastic. It only seems to be supported by about half a dozen sites though. I wonder if there are some big costs to a site adopting it.
[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by Natanael_L on Saturday October 24, 2015 @09:28AM (#10443526)
The protocol is open, the libraries for implementing it are too. You just have to look into how it works and differ from what you have, and integrate it correctly into your auth system.
[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by welly on Saturday October 24, 2015 @08:59AM (#10443455)
Isn't your paper password list just a post-it note attached to your screen like mine is?
[ Parent | on HN ]