Re:Show HN: A compilation of websites with dumb password rules
by jwestbury on Wednesday February 15, 2023 @09:29AM
(#34804232)
> Also add an indicator or separate rating for requirements that make the passwords too easy to guess
This, naively[0], is all requirements except minimum length. Every requirement reduces the problem space for would-be attackers and increases the cognitive burden for users.
[0] I recognise that with many modern techniques, password-cracking utilises common patterns rather than a brute-force approach.
Re:Show HN: A compilation of websites with dumb password rules
by MetaMalone on Wednesday February 15, 2023 @09:50AM
(#34804549)
+ 1. Let me filter by most to least insane.
Re:Show HN: A compilation of websites with dumb password rules
by duffn on Wednesday February 15, 2023 @10:01AM
(#34804705)
Good idea! I've added an issue for discussion here: https://github.com/duffn/dumb-password-rules/issues/445
> Coil
> Does not allow simple characters and sequences such as '4587' or 'efgh' in password & necessarily requires numeric values.
or Apple’s requirement that you cannot have more than 3 consecutive characters, seem reasonable to me. Certainly these rules ban perfectly fine passwords, but they’re a lot better than something like “must be between 8 and 16 characters and contain one uppercase, lowercase, number, and special character, but not these special characters, and it also cannot have an edit distance of 3 from your user ID”