News for hackers. Stuff that matters.

A comment on Everything you ever wanted to know about building a secure password reset (2012). Parent comment

Re:Everything you ever wanted to know about building a secur... by o10449366 on Thursday January 31, 2019 @07:57PM (#19050691)
Even worse are websites/services that impose ridiculous character requirements (you must include 2 symbols, 3 numbers, 5 letters, 2.5 of which must be upper case and positioned at the prime number indices, oh and you have to change your password every 6 months) and then limit your password to 8-12 characters.

The way I remember passwords is by stringing together random English words with random special characters inserted throughout. This means most of them are 30-40 characters. I find these far easier to remember than my PayPal password, which is arbitrarily limited to a random collection of special characters that must be of length less than 12 (or whatever their ridiculously short limit is.)

If you truly care about the security of my account don't impose character limits.

[ Parent | on HN ]
Re:Everything you ever wanted to know about building a secur... by cmurf on Friday February 01, 2019 @01:23AM (#19052061)
I spent 20 minutes trying to come up with a password for chase.com recently because of insane rules like, you can use more than two characters in ascending or descending order, can't use the same character more than twice. Using a random password generator above about 20 characters, and it's guaranteed to break one of there inane rules; let alone if you want to use a pronounceable passphrase that's simply long. It's really aggravating that big companies are some of the worst at this security stuff.
[ Parent | on HN ]
Re:Everything you ever wanted to know about building a secur... by Blackstone4 on Friday February 01, 2019 @04:17AM (#19052738)
I use Bitlocker and I can set limits/conditions on pwd generation which is then saved under a master pwd.
[ Parent | on HN ]
Re:Everything you ever wanted to know about building a secur... by paulryanrogers on Friday February 01, 2019 @09:00AM (#19054090)
Which Bitlocker is that? I'm only familiar with drive encryption by Microsoft. Do you mean Bitwarden?
[ Parent | on HN ]
Re:Everything you ever wanted to know about building a secur... by Blackstone4 on Tuesday February 05, 2019 @03:53AM (#19083828)
Opps you're right....BitWarden
[ Parent | on HN ]
Re:Everything you ever wanted to know about building a secur... by cachvico on Thursday January 31, 2019 @08:30PM (#19050842)
I've tried the random word string concept but I can't remember those ones either.

I feel like I filled up my password memory sometime in the late 90s.

[ Parent | on HN ]
Re:Everything you ever wanted to know about building a secur... by mazatta on Friday February 01, 2019 @02:31PM (#19057601)
It does make sense to impose some sort of upper bound (only so someone doesn't try and DoS you with a crazy long password), but 13 characters isn't going to bring a server to its knees.
[ Parent | on HN ]