0

I would like suggestions for a good strategy for dealing with web sites that have arcane rules about what must or must not appear in a password.

My ideal are the sites that allow a good range of characters, a relatively long password length, and no special rules. In those cases, my password is chosen by a password generator from e.g. 6820 equally probable possibilities. Nice and easy.

Even if there are rules, with a reasonably long length, I can often get an acceptable password by spinning the generator a few times.

The worst case are short passwords with rules like at least one character from each of two or three classes. My current strategy is to edit a generated password making as few changes as possible to make it acceptable. I don't like this, because it depends on my own ability to make random choices, which is not good.

Is there a better strategy, or even a known best strategy?

Improve this question
  • Are you asking what to do with sites that don't follow authentication best practices? Or are you asking what those best practices are? – Ghedipunk Aug 22 '19 at 17:56
  • @Ghedipunk I am asking about my best practices when constructing my password, given the site rules over which I have zero power. – Patricia Shanahan Aug 22 '19 at 17:57
1

The best known strategy for generating a password is to generate it randomly. The goal is for it to be as unique as possible, so that it's unlikely to be found in a password dictionary, which is often populated with passwords from previous breaches.

This doesn't change when the site has poor password requirements.

Many password managers will let you specify the types of characters that are allowed and required, as well as the password length. If you can't get your generated password to match the site's requirements, it's okay to edit the password by hand.

If you're feeling generous, and would like to help the other users of the site, you can go a step further and complain to customer service over the password requirements, citing best practices and standards, such as the NIST Authentication Guidelines.

When I complain to customer service, and if I don't care for a response, but would want to make sure their customer service department forwards the complaint to their developers -- or I see evidence that passwords are being handled in an absurdly unsafe way like being stored as plaintext -- I rudely question the intelligence of their developers, managers, and company officers while making certain that the best practices are well cited, such as pointing out the specific section and paragraph...

I.e., saying something along the lines of "the first paragraph of Section 5.1.1.2 of NIST Special Publication 800-63b sets 8 character passwords as the absolute minimum, and very strongly recommends going up to 64 characters or more. Only an idiot tells their employees to do the absolute minimum for security, and any developer who graduated grade school would know that the only technical reason to restrict password length is that bcrypt can't handle passwords longer than 72 bytes long! After all, every password is stored as an unrecoverable hash, so input length doesn't affect output length, right? RIGHT???"

I don't get responses when I send emails like that, but I do see that the password requirements change within weeks of sending those emails, so...

Improve this answer
  • The linked document in this answer will strengthen my hand in complaining to customer service organizations about this and related situations. It turns what were just my preferences into documented best practices. – Patricia Shanahan Aug 23 '19 at 13:15
0

Worst case: generate your random password, then add a few characters to meet the complexity requirements. Adding characters cannot decrease security.

Alternate idea: try a different, more configurable generator. KeePass, for example, while mostly a PW manager, also contains a highly configurable password generator. You can specify exact sets of characters to include, among many other options.

Improve this answer
  • 1
    Remember the worst case has limited password length. – Patricia Shanahan Aug 23 '19 at 14:12
0

You can use urandom in combination with tr and head to generate random passwords. With a a few small tweaks, you can adjust the length of the generated password and include/exclude specific types of characters to satisfy just about any site's requirements.

For example, to create a password 16 characters long containing just uppercase and lowercase letters:

head /dev/urandom | tr -dc '[:alpha:]' | cut -c 1-16

To create a password 12 characters long containing just uppercase and lowercase letters and digits:

head /dev/urandom | tr -dc '[:alpha:][:digit:]' | cut -c 1-12

To create a password 20 characters long containing uppercase and lowercase letters, digits, and symbols:

head /dev/urandom | tr -dc '[:alpha:][:digit:][:graph:]' | cut -c 1-20
Improve this answer
  • This seems to be about how to use shell programming to construct a password generator. That is irrelevant to my question, which mentions using a password generator. I have one installed everywhere I need it, including tablets that do not have shells. Answers that do not require shell use and programming are more generally useful. – Patricia Shanahan Aug 23 '19 at 2:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.