News for hackers. Stuff that matters.

A comment on Stop forcing arbitrary password rules. Parent comment

Re:Stop forcing arbitrary password rules by Retric on Saturday October 24, 2015 @10:42AM (#10443728)
As long as you throttle login attempts short passwords are fine. EX: 6 digit pin on a debit card might seem useless, but if you only get 3 tries per day that's just not an issue.

~10-20 failed attempts per day per IP + some rules to check for multiple IP's per account and 8 lowercase letters - most common passwords is actually reasonable.

[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by Estragon on Saturday October 24, 2015 @04:26PM (#10444733)
> As long as you throttle login attempts short passwords are fine.

Not if the password-hash database leaks.

[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by Houshalter on Saturday October 24, 2015 @08:32PM (#10445431)
If someone has hacked into your bank, you have bigger problems than the hackers knowing your password.
[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by mikeash on Saturday October 24, 2015 @12:35PM (#10444097)
I can buy that argument in general. But silently truncating is indefensible. What if I had a long password which started with my name or something, but which I believed to be secure because it had secret stuff at the end?
[ Parent | on HN ]