0

I just tried to add some details to a bug I have reported at bugzilla.mozilla.org (BMO) but wasn't let in because my password had been nullified. Now they want me to create a new password meeting certain requirements, listed here

https://wiki.mozilla.org/BMO/UserGuide/Passwords

must be at least 12 characters in length
must not contain parts of your email address, or your real name
must be complex, which means:
    must be a passphrase of at least four words
    OR
    must contain a mixture of letters and symbols, containing characters from 3 out of the following 4 character classes:
    lowercase letters, uppercase letters, numbers, and other symbols

I decided to not update my password, and, as a consequence, stop using their service/provide BMO with bug reports, because the password they require won't be easy to memorise and I think this is unnecessary complex for a bug reporting service. My current password is 9 characters, contains upper- and lowercase letter, numbers as well as special characters. That is complex enough for my purpose.

So my question is: are there any objective reasons for such a complex password for something like BMO? What is the worst thing that can happen if someone cracks an outside users password there?

Finally some personal remarks about this issue: personally I am not too found of the thought of a password manager in the cloud (which is was BMO recommends). That type of single-point-of-failure is, IMHO, problematic. Even if CIA/NSA or similar might not target me specifically, they most likely might target someone else using the same service and if they manage to break it, all my secrets come as a free bonus for them.

Storing sensitive data locally and have good backup solution seems much safer for the occasional hacking attempt from a jealous partner or someone trying to commit credit card fraud (if some state sponsored agency targets me specifically I am screwed anyway, either by using a secret subpoena, technically circumvent my protection or simply threat me with a big enough stick).

Improve this question
10
  • IMO the password requirements are a bit much for a reporter, but they are reasonable for a member of the development team or otherwise privileged member. They probably rolled the requirements for everyone instead of discriminating who needs the security. As for password manager, you may want to give KeePass a try. It uses local storage (no cloud) and I would consider it to be very strong. And of course you can opt not to store too sensitive passwords there either. – Peter Harmann May 6 '18 at 11:46
  • 2
    four word passphrase? Always check if you can break into another account using "correct horse battery staple" – Hagen von Eitzen May 6 '18 at 12:47
  • 2
    Link does not say "password manager in the cloud", so that entire paragraph is moot. You also have an incorrect understanding of the technology used to store passwords in the cloud. – schroeder♦ May 6 '18 at 15:08
  • 2
    From another part of the BMO wiki: "BMO is a core piece of infrastructure at Mozilla. It is used to track not only bugs and feature requests but also many other tasks across various teams." so, yeah, password complexity is required – schroeder♦ May 6 '18 at 15:09
  • 1
    @schroeder that's my impression as well - this is the kind of user that needs a password manager, because they will make bad password decisions without one, e.g. reuse with minimal variation and so on. – vidarlo May 6 '18 at 15:41
8

So my question is: are there any objective reasons for such a complex password for something like BMO? What is the worst thing that can happen if someone cracks an outside users password there?

Remember that the bug tracker may contain information pertaining to 0-days in the software, or other serious security bugs. Not all users have access to this information, but some do.

Such information may impact a large number of users should it become publicly known.

It's easier and better to enforce password policies for all users, and not depending on group. Many password hashing schemes will hide the complexity of the passwords, which means that it is only verifiable when actually changing the password.

because the password they require won't be easy to memorise

I memorize exactly three passwords: my computer account password, my remote access password and my password manager passphrase. The rest is stored in password managers (Lastpass and KeePass). This is suggested by the user guide you point to. This makes it easy to use unique passwords for each service, and you don't have to remember anything.

In addition, they do allow passphrases, which is easier to memorize. Four random words is certainly possible to remember, if you desire.

Finally some personal remarks about this issue: personally I am not too found of the thought of a password manager in the cloud (which is was BMO recommends).

They recommend a password manager. They don't mention a specific one, and does not mention cloud based at all. You should probably read the page you linked once more, as you infer things that is not stated there.

In addition it should be noted that Lastpass uses your passphrase as an encryption key for your data, so an attack against a different user may not yield your passwords.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.