50

In configuring a new system today (Juniper Space, Linux-based Network Management platform), I came across a bizarre password requirement that I'm curious about. Upon logging into the web UI with the default credentials, I was prompted to change the password, which is good, and I went to do, but my randomly generated password was rejected because the last character was a number. This struck me as all the more strange, given that the password I provided for the command line interface ended in a number, and it was accepted.

change default password screenclip

In my experience, password requirements like this generally have some underlying reasoning behind them, like Q and Z not being present on old telephone keypads, or legacy systems compatibility or just plain poor systems/policies/whatever. I'm having a much more difficult time explaining this particular policy with any of those explanations, though.

Does anyone have any insight into the reasoning behind a password policy that would prohibit a numeric last character?

Improve this question
6
  • 19
    Because the creator of this password format lacked the foresight to see that they created the same rule in reverse. Instead of password1!, they've created 1password!
    – Mark Buffalo
    Commented Oct 14, 2016 at 20:53
  • 5
    6 character minimum with at least 1 numeral and 1 lowercase letter. 6 character? No uppercase requirement(was list truncated)? As others have noted, "last character is a numeral" is a very common pattern, especially when a numeral requirement is imposed or passwords must be changed regularly, but prohibition for that reason is awfully sophisticated given the password length (only 6) and that no uppercase letters are required.
    – BillR
    Commented Oct 15, 2016 at 10:43
  • Linux? That looks like ... Java.
    – Michael Hampton
    Commented Oct 15, 2016 at 23:20
  • 1
    @MichaelHampton Yeah, for the web UI. For some reason, most Linux-based appliances don't use .NET for their web UIs. :)
    – HopelessN00b
    Commented Oct 16, 2016 at 0:11
  • That's a long list of password rules to follow.
    – Aloha
    Commented Oct 16, 2016 at 5:05

3 Answers 3

Reset to default
55

It's likely an effort to discourage passwords that fit common formats or character masks. If a password policy requires use of a number many people will chose to put their number at the end of a word or words. Here are a couple examples from corporate environments:

Attackers like this user habit because it makes their hybrid password cracking or guessing attacks easier. They can focus on combining word lists with numbers added to the end rather than a more time consuming brute force approach.

So some organizations implement a policy like this in an attempt to improve security by getting users to put their numbers is a less predictable place. It sounds like in your situation they're not combining this with any other complexity checking and instead rejecting all passwords that end in a number, regardless of how random they are otherwise. That's not a very good way to implement this type of checking, but they're not alone in taking this approach.

Improve this answer
13
  • 3
    Then people attacking a Juniper Space system will have an easier job because they know which masks are forbidden...
    – Shautieh
    Commented Oct 15, 2016 at 14:30
  • 3
    @a25bedc5-3d09-41b8-82fb-ea6c353d75ae: It was thirty years ago that I first heard the argument, “Any rule that restricts passwords, shrinks the space of valid passwords, and therefore makes brute-force attack easier.” But that’s wrong; the job of the attacker who is guessing passwords is not made easier by knowing that he doesn’t need to check whether my password is “scott”, it is not made easier by knowing that he doesn’t need to check whether anybody is using a dictionary word as a password, etc. … (Cont’d)
    – Scott - Слава Україні
    Commented Oct 15, 2016 at 21:08
  • 19
    (Cont’d) …  The point is, when a password pattern is disproportionally popular (much more popular than it would be if passwords were chosen randomly), then that pattern becomes low-hanging fruit for the attacker.  By banning the users from that comfort zone, you force them to disperse and use more of the space of possible passwords, and thus become a harder target.  That said, I agree that this rule is somewhat silly.  A better rule might be, “Must contain at least one digit at a position other than the last character.”  That would allow “corrc3t8” while still prohibiting “crorcet1”.
    – Scott - Слава Україні
    Commented Oct 15, 2016 at 21:08
  • 4
    @a25bed To make Scott's point in fewer words: when limiting the combinatorial search space also limits the usefulness of a dictionary or pattern attack, the real search space (i.e. the one an attacker would actually bother to check - no smart attacker guesses randomly) increases in size. Obviously there's a limit to point and purpose, though. No comment on the security of OP's specific situation.
    – user43639
    Commented Oct 15, 2016 at 22:43
  • 4
    @Scott "at least one digit at a position other than the last character" still allows for Scott1985 (guessing your year of birth here).
    – SQB
    Commented Oct 16, 2016 at 19:31
28

From experience, the Must not reuse previous 6 passwords rule may cause users to employ a password rotation scheme in which the current password cycles through something-that-fits-the-other-rules1 through something-that-fits-the-other-rules7, to make it easier on themselves when obeying the Must change password every 90 days rule that is common in corporate use.

Password cracking tools could use knowledge of this habit in devising passwords to guess.

The Must not contain number as the last character rule could be an attempt to circumvent such schemes to force users to choose new passwords that are significantly different from their old ones.

Improve this answer
3
  • 17
    Makes sense, but then the user will just be creative: Winter2016a -> NoYetSpring2016a -> Spring2016a -> Summer2016a -> NotYetAutumn2016a -> Autumn2016a -> Winter2017a -> ...
    – grochmal
    Commented Oct 14, 2016 at 22:29
  • 3
    I once worked in a place where people routinely added the month to passwords, as they were forced to change them every month. Eg. swordfish01 (in January), swordfish02 (in February) and so on. Made it easy to remember the password!
    – Nick Gammon
    Commented Oct 14, 2016 at 22:38
  • 4
    @grochmal, but that's a lot less predictable and thus harder to guess, so it's not really a problem.
    – jcaron
    Commented Oct 14, 2016 at 23:03
-4

Because programmers think about programming computers and not about how real people operate. They find themselves where they can wield arbitrary power, so they do, while forgetting what the real problem is. In this case the problem is "make the system safe in spite of people's natural behavior".

"Make the rules for passwords really complicated; make them change them every week" -- pretty much guarantees you can find the password on a Post-It note stuck on the monitor.

Improve this answer
2
  • 10
    None of what you have said justifies not allowing a digit as the last character
    – schroeder ♦
    Commented Oct 16, 2016 at 14:15
  • 3
    ... and depending on your threat model, a password on a Post-It note may be fine.
    – Martin Bonner supports Monica
    Commented Oct 17, 2016 at 7:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .