News for hackers. Stuff that matters.

A comment on The “Chad” bug. Parent comment

Re:The “Chad” bug by cookiecaper on Thursday December 31, 2015 @12:11AM (#10816289)
I agree that the only real restriction that makes sense is a minimum character count. The others just tend to get in the way. I haven't seen anyone implement it in the wild, but it'd also be cool if there was a wordlist of the 25 most common passwords that the site matched against and refused to accept. I think those two policies, minimum length and no super common passwords, would do a lot to minimize the effectiveness of dictionary attacks.
[ Parent | on HN ]
Re:The “Chad” bug by mbreese on Thursday December 31, 2015 @12:36AM (#10816366)
I personally like the Stanford policy[1]. It basically boils down to: the longer the password, the fewer restrictions. Each password needs to be at least 8 characters, but if you only have 8 characters, you might need uppercase, lowercase, a symbol and a digit. If you have 12 characters, you only need upper/lower/digit. Once you hit 20 characters, you can have whatever you want.

I think that this is a good balance between security for short passwords, while still allowing ridiculously long ones (pass-phrases).

[1] http://arstechnica.com/security/2014/04/stanfords-password-p...

[ Parent | on HN ]
Re:The “Chad” bug by technion on Thursday December 31, 2015 @02:47AM (#10816711) 

    $ dd if=/dev/urandom bs=32 count=1 | xxd -p
That nearly every site on the Internet will refer to that output as "not strong enough" and instead suggest P@ssword1 as a better alternative definitely speaks to the issue.
[ Parent | on HN ]
Re:The “Chad” bug by warfangle on Thursday December 31, 2015 @12:54AM (#10816414)
Almost like you're validating on entropy and not specific rules..........
[ Parent | on HN ]
Re:The “Chad” bug by Dylan16807 on Thursday December 31, 2015 @02:30AM (#10816668)
The concept is nice, but their numbers are horribly, unforgivably wrong.

8 random upper/lower/digit/symbol characters are equal to 9 random mixed-case letters. Not 16.

Their cutoffs for different mixes are 8, 12, 16, 20. Realistic cutoffs would look more like 10, 11, 11, 14.

Even worse, they encourage counting the individual letters in words. Never do that. Random words are only as good as two random characters.

[ Parent | on HN ]
Re:The “Chad” bug by tragic on Thursday December 31, 2015 @03:30PM (#10819526)
> I haven't seen anyone implement it in the wild, but it'd also be cool if there was a wordlist of the 25 most common passwords that the site matched against and refused to accept

It's now in django[0]. And it's a hoot to read...

[0] https://github.com/django/django/blob/master/django/contrib/...

[ Parent | on HN ]
Re:The “Chad” bug by rmc on Thursday December 31, 2015 @10:41AM (#10817995)
> I haven't seen anyone implement it in the wild, but it'd also be cool if there was a wordlist of the 25 most common passwords that the site matched against and refused to accept.

I have implemented that on a site. It wouldn't accept the top 10,000 most common passwords. (or was it 1k).

Otherwise ~1% of your users will pick "password" as a password.

[ Parent | on HN ]