Comment on NIST proposes barring some of the most nonsensical password rules
NotMyOldRedditName@lemmy.world 1 day agoI think it’s pretty idiotic to
Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.
They might mean well, but the reason we require a special character and number is to ensure the amount of possible characters are increased.
If a website doesn’t enforce it, people are just going to do a password like password
password is a totally valid password under this rule. Any 8 letter word is valid. hopsital for example.
These passwords can be cracked in seconds, and have their hashes checked for in leaks in no time.
lvxferre@mander.xyz 1 day ago
The problem with this sort of requirement is that most people will solve it the laziest way. In this case, “ah, I can’t use «hospital»? Mkay, «Hospital1» it is! Yay it’s accepted!”. And then there’s zero additional entropy - because the first char still has 26 states, and the additional char has one state.
Someone could of course “solve” this by inserting even further rules, like “you must have at least one number and one capital letter inside the password”, but then you get users annotating the password in a .txt file because it’s too hard to remember where they capitalised it or did their 1337.
Instead just skip all those silly rules. If offline attacks are such a concern, increase the min pass length. Using both lengths provided by the guidelines:
NotMyOldRedditName@lemmy.world 1 day ago
But they mess that up with their 8 char rule
Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length.
I’d they’d just said shall require 15 but not require special chars then that’s okay, but they didn’t.
Then you end up with the typical shitty manager who sees this, and says they recommend 8 and no special chars, and that’s what it becomes.
lvxferre@mander.xyz 1 day ago
I don’t think that the entity should be blamed for the shitty manager. Specially given that the document has a full section (appendix A.2) talking about pass length.
NotMyOldRedditName@lemmy.world 1 day ago
The entity knows people will follow what they day. There’s already someone in the comment section saying they’re now fighting what these lax rules allow.