Re:Elastic Cloud password complexity has an “OR” condition
by atoav on Tuesday January 10, 2023 @04:48AM
(#34322503)
Everybody who uses a password manager encounters stupid password rules regularily.
It matters, because it is annoying. Password security rules should achieve two goals:
1. Actually improve security
2. Make it easy for users to choose a good password
A password policy of "chose one or more lowercase, one or more uppercase, two or more numeric and at least one special character, but not the one that you have been thinking of" does not achieve that goal, especially if they limit the password length to 15 characters.
Just tell give them a reasonable minimum length, check against the most common passwords and their username and call it a day. If you need more security, increase the minimum length.
Maximum length should be chosen in a way that nobody who is not malicious will notice it (e.g. 128 chars or bigger).
This produces safe passwords, is understandable and people with password managers are served as well.
It matters, because it is annoying. Password security rules should achieve two goals:
1. Actually improve security
2. Make it easy for users to choose a good password
A password policy of "chose one or more lowercase, one or more uppercase, two or more numeric and at least one special character, but not the one that you have been thinking of" does not achieve that goal, especially if they limit the password length to 15 characters.
Just tell give them a reasonable minimum length, check against the most common passwords and their username and call it a day. If you need more security, increase the minimum length.
Maximum length should be chosen in a way that nobody who is not malicious will notice it (e.g. 128 chars or bigger).
This produces safe passwords, is understandable and people with password managers are served as well.