News for hackers. Stuff that matters.
Re:Show HN: A compilation of websites with dumb password rules by armchairhacker on Wednesday February 15, 2023 @09:24AM (#34804150)
Suggestion: add a rating system, because some of these are more dumb than others. Also add an indicator or separate rating for requirements that make the passwords too easy to guess like “no more than 8 characters”. e.g.

> Coil

> Does not allow simple characters and sequences such as '4587' or 'efgh' in password & necessarily requires numeric values.

or Apple’s requirement that you cannot have more than 3 consecutive characters, seem reasonable to me. Certainly these rules ban perfectly fine passwords, but they’re a lot better than something like “must be between 8 and 16 characters and contain one uppercase, lowercase, number, and special character, but not these special characters, and it also cannot have an edit distance of 3 from your user ID”

Re:Show HN: A compilation of websites with dumb password rules by jwestbury on Wednesday February 15, 2023 @09:29AM (#34804232)
> Also add an indicator or separate rating for requirements that make the passwords too easy to guess

This, naively[0], is all requirements except minimum length. Every requirement reduces the problem space for would-be attackers and increases the cognitive burden for users.

[0] I recognise that with many modern techniques, password-cracking utilises common patterns rather than a brute-force approach.

Re:Show HN: A compilation of websites with dumb password rules by MetaMalone on Wednesday February 15, 2023 @09:50AM (#34804549)
+ 1. Let me filter by most to least insane.
Re:Show HN: A compilation of websites with dumb password rules by duffn on Wednesday February 15, 2023 @10:01AM (#34804705)
Good idea! I've added an issue for discussion here: https://github.com/duffn/dumb-password-rules/issues/445