• roofuskit@kbin.social
    link
    fedilink
    arrow-up
    17
    ·
    1 year ago

    Nothing enrages me more than a password character limit. Thank you for making sure my password is LESS secure with your idiotic requirements based on security recommendations that are at least a decade old.

    • Ambiorickx@lemmy.world
      link
      fedilink
      arrow-up
      5
      ·
      1 year ago

      How about… an undisclosed character limit? We’ll just keep telling you your password is invalid until you figure out the max length.

      • ericjmorey@lemmy.world
        link
        fedilink
        arrow-up
        3
        ·
        edit-2
        1 year ago

        Fun fact, this is a feature of Lemmy:

        • Lemmy has an undisclosed password limit of 60 characters.
        • Lemmy’s signup form will silently truncate passwords longer than 60 characters to 60 characters.
        • Lemmy’s login form will crash when passwords longer than 60 characters are submitted.

        Someone please submit a PR

    • computertoucher5000@programming.dev
      link
      fedilink
      arrow-up
      2
      ·
      1 year ago

      Convince me this isn’t just training someone’s pet algorithm the same way we’ve all been trained to accept training the CAPTCHAs.

      WAKE UP COMPILERS (It is a fun game though)

  • KaeruCT@programming.dev
    link
    fedilink
    arrow-up
    11
    ·
    1 year ago

    My bank requires your password to contain NO vowels. I always forget when I update the password (forced to every 3 months) and the error never mentions it.

    • zarp86@sh.itjust.works
      link
      fedilink
      arrow-up
      7
      ·
      1 year ago

      I’m struggling to think why this would be a thing. The only guess I have is someone was told to enforce “no dictionary words in a password” and saw that as an ‘easier’ way to implement?

      • tikitaki@kbin.social
        link
        fedilink
        arrow-up
        5
        ·
        edit-2
        1 year ago

        One one hand it reduces the total # of characters needed to brute force which is bad. On the other hand, like you said, it makes it so dictionary attacks are weaker - which is good

        Although I think you could just get a regular dictionary, remove the vowels, and it would probably work just fine

        So ultimately? I think stupid decision

    • malloc@programming.dev
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      This is the only way. Except some services don’t even accept those randomly generated ones. Only a slight inconvenience to add whatever special character they want or to trim the length.

    • Acetamide@lemmy.world
      link
      fedilink
      arrow-up
      4
      ·
      1 year ago

      Way too often I’ve had websites complain that the input password is too complex, and I have to dial down the settings.

  • paddirn@lemmy.world
    link
    fedilink
    arrow-up
    7
    ·
    1 year ago

    I get so irrationally mad about passwords now, and then it’s like every 3 months, no matter what password phrase I come up with, with whatever non-sensual special characters and spaces added in, it’s compromised in some hack, so no matter how good your password is, they’ll just get it from the source anyways.

  • ParadoxSeahorse@lemmy.world
    link
    fedilink
    arrow-up
    5
    ·
    1 year ago

    And not in the user’s last X passwords! And doesn’t contain their name, address etc! And changes every X days!

    Literally writing code to do this rn, even tho I pushed back with modern theories… IT security “experts” set policy using just enough knowledge to be dangerous

    One of the banned words hardcoded previously was “monkey”, needless to say I am proud to carry on this tradition

    • ono@lemmy.ca
      link
      fedilink
      arrow-up
      11
      ·
      edit-2
      1 year ago

      Probably some sort of entropy approximation.

      That’s exactly what it is, and that is the correct way to do it.

      All those ridiculous letter/case/symbol/number rules come from guidelines written by Bill Burr for NIST 20 years ago. He has since stated that he regrets them, and NIST has abandoned them. Because they’re actually counterproductive to security.

      • a_statistician@programming.dev
        link
        fedilink
        arrow-up
        5
        ·
        1 year ago

        NIST has abandoned them

        Would that my IT department had gotten the memo. They think NIST is god-tier, even when our own CS department is like… yeah, no. And personally, having worked with NIST researchers in fields that aren’t IT policy, I wonder how good their IT policy docs really are. The whole organization is bureaucracy getting in the way of good science and common sense.