Timeline for Why would a password requirement prohibit a number in the last character?
Current License: CC BY-SA 3.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 2, 2020 at 14:00 | comment | added | Fax | @Scott The negligible entropy from dispersion of bad passwords (99% of users will add an 'a' after the number) is negated by also banning good passwords. Here's some better advice: Don't restrict the password format, but do block the most common passwords, or better yet, block all compromised passwords. | |
| Oct 19, 2016 at 2:57 | comment | added | Dawood ibn Kareem | @JDL He did say "heard", not "understood". | |
| Oct 17, 2016 at 12:55 | vote | accept | HopelessN00b | ||
| Oct 17, 2016 at 10:30 | comment | added | JDL | @SQB: given that Scott "first heard the argument thirty years ago", 1985 would have made him a fearsomely prodigious techno-baby... | |
| Oct 16, 2016 at 21:24 | comment | added | Scott - Слава Україні |
(Cont’d) … (Of course, if the fifth rule were “Must not contain the Login ID”, as it should be, then Scott1904 would be disallowed.)
|
|
| Oct 16, 2016 at 21:23 | comment | added | Scott - Слава Україні |
@SQB: True, but (string-of-letters) + (one digit) (e.g., money1 or password1) is a disproportionally popular password pattern. Just getting users to avoid that is a small improvement. Yes, (string-of-letters) + (string-of-digits) is a problem, too, especially (string-of-letters) + YYYY, and prohibiting that (e.g., with a rule like “Must contain at least one digit followed by a non-digit”) would be even better. The point is to force users out of their comfort zone without arbitrarily prohibiting (halfway) decent choices. … (Cont’d)
|
|
| Oct 16, 2016 at 19:33 | comment | added | SQB |
@SorenBjornstad That is to prevent people from entering MyDefaultPasswordForSiteName. Should the site ever have its passwords cracked, the attacker now knows the passwords that user will likely have used for ThatSite, TheOtherSite, and ThatSocialNetworkSite.
|
|
| Oct 16, 2016 at 19:31 | comment | added | SQB |
@Scott "at least one digit at a position other than the last character" still allows for Scott1985 (guessing your year of birth here).
|
|
| Oct 16, 2016 at 18:56 | comment | added | Soren Bjornstad | Inflexible checks are pretty common. I once was changing my password on a popular service and tried to use a 5-word Diceware password with 4 random words and the fifth being the name of the site, and it was automatically rejected because it contained the name of the site (without a description of why except, quote, “that password is too easy to guess”). I removed the word (reducing the entropy!) and it happily accepted it. | |
| Oct 16, 2016 at 13:13 | comment | added | Hagen von Eitzen | I bet that almost all of the cracked passwords matching a four-digit pattern in the NetSPI report (e.g. ULLLDDDD) are actually ULLL19DD or ULLL20DD :) | |
| Oct 15, 2016 at 22:43 | comment | added | user43639 | @a25bed To make Scott's point in fewer words: when limiting the combinatorial search space also limits the usefulness of a dictionary or pattern attack, the real search space (i.e. the one an attacker would actually bother to check - no smart attacker guesses randomly) increases in size. Obviously there's a limit to point and purpose, though. No comment on the security of OP's specific situation. | |
| Oct 15, 2016 at 21:08 | comment | added | Scott - Слава Україні | (Cont’d) … The point is, when a password pattern is disproportionally popular (much more popular than it would be if passwords were chosen randomly), then that pattern becomes low-hanging fruit for the attacker. By banning the users from that comfort zone, you force them to disperse and use more of the space of possible passwords, and thus become a harder target. That said, I agree that this rule is somewhat silly. A better rule might be, “Must contain at least one digit at a position other than the last character.” That would allow “corrc3t8” while still prohibiting “crorcet1”. | |
| Oct 15, 2016 at 21:08 | comment | added | Scott - Слава Україні | @a25bedc5-3d09-41b8-82fb-ea6c353d75ae: It was thirty years ago that I first heard the argument, “Any rule that restricts passwords, shrinks the space of valid passwords, and therefore makes brute-force attack easier.” But that’s wrong; the job of the attacker who is guessing passwords is not made easier by knowing that he doesn’t need to check whether my password is “scott”, it is not made easier by knowing that he doesn’t need to check whether anybody is using a dictionary word as a password, etc. … (Cont’d) | |
| Oct 15, 2016 at 14:30 | comment | added | Shautieh | Then people attacking a Juniper Space system will have an easier job because they know which masks are forbidden... | |
| Oct 14, 2016 at 20:13 | history | answered | PwdRsch | CC BY-SA 3.0 |