My favorite is "can't be more than x% similar to the last 3 passwords". Of course, you shouldn't ever define what "similar" actually means.
And the only way to check that is by storing the previous passwords in a recoverable format.
I'm not sure but I think the previous password is mostly stored in an unrecoverable format and only upon changing your password, when you have to enter your previous one, does it store it in an unrecoverable format for 10x or so generations. Just a guess though for how AD might do it.
That doesn't make it better.
Even if you only store past passwords, that is absolutely disgusting security practice.
This is everything you ever needed to know about passwords.
There's a thing called a "one way hash". It's a formula run against your plain text password that produces the same result every time it's run, but can't be turned back into your password.
Imagine you assign a number for each character, a is 1, b is 2, etc. A (bad) one way hash would be to add up the number of each character and store that. So if your password was "bacj" that would be 2 + 1 + 3 + 10 = 16. So they could store just "16", but that couldn't be turned back into your password.
This is a bad hash to use for a couple reasons. One is that many, many things would equal 16. You want something with less overlap or "collisions". It doesn't have to be zero collisions either. It's not completely impossible that more than one password would get you into your GMail, though figuring out which alternative would work would be practically impossible.
The other is that this one is way too fast for a computer to compute. If someone gets your hashed password and the formula they used, they could try a million guesses per minute until they randomly guessed your password. This is called a "brute force attack". To prevent this, websites use two things. One is that they limit the number of attempts you can make. They can allow you to try ten times per ten minutes and that's more than enough to slow a brute force attack. But this only stops them if they're trying through the website. If they have your hash and the formula used on their machine (like a data leak), the attempt limit on the website does nothing. Instead, they should use a "cryptographic hash", which has all the properties we've mentioned, but also takes a good amount of time to compute, even on a good computer. A solid fraction of a second is enough, as long as you used a good password. It doesn't take many attempts to guess "qwerty" or "shadow" or "misty", even with leetspeak. If they can guess it in a million attempts, it's not a good password. Also there are public lists of known passwords that is one of the first things they'll try.
Another attack is called a "rainbow table". This is where they take the most common cryptographic hashes, and a list of known, compromised passwords, and they'll have run the hashes against those passwords years ago and stored them. Now they don't have to compute the value. They'll just try each value in the table. To prevent this, every secure site will use what's known as a "salt", which is just a random extra password that they'll literally just stick onto the end of your password before they compute. So even if your password is "shadow", they'll have "shadow" + "jfyengighshtogusnwkyifhd" as your password. But the second part is stored in their database in plain text, so the salt is much less secure than your password. You'll still be vulnerable to a brute force attack, but you won't be vulnerable to a rainbow table attack.
Remember, if you use the same password everywhere, one site having bad security (or compromised on the front end) means bad actors will have added that password to the list of known passwords. That's the first thing bad actors will try in a brute force attack forever after. Use a password manager like KeePass or Bitwarden, maybe even 1Password. You have no idea how amazing it is to not need to remember which email you used for which site, and not care what the security requirements are. Every password you have can be 30 character, special character nonsense, and the manager will just handle it for you. I literally can't tell you my Lemmy password. And I promise that it's not in that list of known passwords. I just narrowed the possibilities by a few million passwords, does that help you guess my password?
My understanding is this is done by saving the hashes and checking the current password against them, and (I'm much less concrete on this one) for "similar" it will run common iterations of the password and save those hashes
At a previous job one of the sysadmins checked all AD users for repeated hashes, and compared against hashes of the top 1000 most common passwords. He also identified one of the IT people had the same hash for both their normal account and their domain admin account, and spoke with them individually to change their domain admin account password
My personal life? Password manager with passwords as complicated and as long as each service will allow for.
Job that makes me change my password every 30 days? You get the same base password, followed by the next number in the series.
Requirement: Needs special characters
Not accepted for some reason: using ọ̵̑h̸̞̉ ̴̰͒g̴͛ͅõ̸̦ḓ̵͠ ̸̳͌w̵̡̛h̴̦͘ŷ̵̫
They're too special.
I like my special littlev̵̂̊̅͌͜ó̶͎̫̜̘̲̭̪̯̔̎̊́̽̒̄̄̕i̸̼̠͓̥̬̙͉͋̿́d̷̨̗̼̖̦͇̲͑̀̈́̔̿̌characters :(
Voyager doesn't like them
They display just fine for on Voyager
I'm using Voyager too and the unfathomable text isn't rendering properly either. Voyager version 2.17.0 (Android)
I just had to make a password for a hotel.
8 to 20 characters Uppercase Lowercase Digits OR special characters.
The capitalized OR is important. You can have either numbers in the password, or special characters, BUT NOT BOTH.
Took me 8 tries.
The best part to me is that they include all of these rules to increase the security, but then set a maximum length of the password, which from my understanding is the easiest way to add complexity/security to a password.
The actual funny (or sad) thing about this: even without a length limit all they do is make the password less secure because every constraint just reduces the possible password space.
As someone who generates every password with a password manager those sites are a pain in the ass because you have to somehow get these constraints into the generator.
Maximum length is the biggest red flag to me and was the catalyst for me making the effort to switch to unique passwords per-account years ago. There's just so, so many shitty homerolled security systems out there... and data breaches seem to be a perennial problem these days.
There's just no excuse for limiting the length if you're doing security correctly (other than perhaps a large upper limit just to protect against someone DOSing the backend with a bunch of 100MB strings; 512 characters seems reasonable).
By setting an upper limit, you're basically saying one or more of these things:
arbitrary_list_of_bsMy 'favorite' password rules are incorrect rules. Recently signed up to a service, which looked like it hasn't been updated since the 90s. They sent me my password via letter, but hey, I was allowed to change it digitally.
So, I did. I set it to a reasonably long password (probably something like 22 characters), with no problems.
Then I went to login and it refused my login. I copied my password out of my password manager, for both setting it and logging in, so there was no way that it was wrong. I quadruple checked the login name, but no luck.
Eventually, I manually typed the password from my password manager. Then I saw it, their password field stopped accepting inputs after about 20 characters.
Presumably, I was able to set my long password on the registration page, but the login page did not accept this long of a password. Fucking ace.
I had to order another password letter.
As a website developer, it’s easy to just use the 'maxlength' attribute on fields you don’t want to exceed a certain length (for valid reasons or not). But then exactly this happens: A user pastes something in there, doesn’t notice that their input got truncated, and something, somewhere breaks.
'maxlength' is terrible user experience.
Yeah, thinking about it now, I could've probably tried removing the maxlength attribute to see if the server accepts the longer password.
That doesn't sound like it should work, but probably would..
That wouldn't have been (as much of) a problem if the initial password form also truncated the input. The mismatch is the problem.
Let’s say “you wouldn’t have noticed there was a problem if there was no mismatch”. But then a few years later that max length gets dropped or increased and suddenly your password, which has always worked, isn’t accepted anymore, because now you’re pasting 2 extra characters.
I was also not talking about password fields, exclusively. Pasting stuff like customer identifiers or zipcodes into maxlength’d fields also begs for surprises, especially when you can’t see the whole input when you’re done with it.
Should have right clicked and hit 'inspect element' and changed it from 20 to 32487839423 then entered it. Bet it would have worked because, you know HTML hackers.
Got this site once stating "passwords can't contain parts of username" icw a 64 character pw.
And usenames like "daneelolivaw" block passwords with
da an ne ee el...
dan ane nee eel ...
dane anee neel.... etc in them
If I was a bad guy and saw this, I would look for users with many different charaters in long names and brute force them, because there's a high chance they just removed all characters in their names from the pool to generate a password, making it faster to go through the leftover combinations.
Fine, the hacker can see I ordered vegetable vindaloo last Friday. There's no credit card information stored.
For banks, make your password requirements as hard as you want. For everyone else, I feel like the developers are LARPING as security professionals to make their boring job making web pages for local businesses interesting.
Go ahead. Make a password. Then be left to deal with the mental & emotional damage.
I shared this one with the other IT people at work suggesting we should set it as our new corporate password policy. One of the guys literally finished the game. It took him a week but he did it
Calm down there satan.
I just wish these password requirements could be added as an attribute to the password field so password managers could generate a password that matches those rules.
I wish we could get rid of many of those stupid rules.
Agreed, but if your password manager can just generate a password that matches the rules, you don't really have to care about it. Currently you just get your browser/password manager to generate one, get an error, then just manually append whatever missing required character was needed.
But yeah, in most cases the password requirements have not been set by anyone that actually knows anything about password security.
If your password requirements make me not use a password generated by my password manager, you should rethink your requirements.
One that I loved was that you couldn't set any from a list of "common passwords"... You couldn't include anything from that list in any password you used. So if the list included the word "green" then "3875429$##&!32++_@greenbean2284&$@" would be rejected.
What's on the list? (Shrugs)
Good luck!
"Sorry, this password is too long"
Literally gotten this error before. So annoying. It was like 18 characters.
Password requirements so secure, eventually you go full circle to remember them and do shit like this.
I'm sorry, but passwords must be unique across the entire platform. The one you entered matches johnDoh@xyz.dev. Please try again.
Expires every X months.
I've never been super into the idea of using a password manager rather than just using complex but memorable passwords for everything, but policy like this basically necessitates using one.
Unless it's the one password you actually use to login. I can't use a password manager for my Windows login.
Most people I've met simply use the same password and increment one number somewhere.
The good old NTLM rule of max 8 characters and all converted to uppercase. It was a simple rule and if you forgot your password you could easily bruteforce it with normal consumer hardware.
at what point do password requirements start making password easier to crack?
They already do. If I know a number is required, I don't have to try any passwords that don't have a number.
Don't forget general filters for bad passwords. That means no part of your name, username, anything sequential, your birthday, your pets birthday, or any of the 1000 most common passwords
My favourite: No uppercase. No numbers.
Wrote this in a different thread but the way PlayStation handles this...
Password reset is limited to 30 characters. Login isn't.
That would be fine if the password rules on reset would actually mention this and not just cut off the password at 30 characters without telling you that it is too long. So I generated the password used that on reset, saved it, login wrong...
I couldn't login to my PlayStation account because my 32 characters long password saved in my bitwarden vault wasn't correct.
Even worse, on the first support request I was basically told "looks fine on our side, bye".
Only the hottest memes in Cybersecurity