4

So, I understand why most commonly used password policies are used.

N character minimum? No low hanging fruit left for brute force attacks.

N character maximum? The database field can only be so long.

No unicode? The underlying database doesn't support it.

Include at least one letter, special character, number, and heiroglyph? Adds a few extra required bits.

The one I can't for the life of me understand though is the rule where no more than n consecutive characters (commonly two from what I've run into) may exist in the password. I can't think of a technical reason to do this, and it actually reduces the available password pool, thus making a brute force attack take less time. This practice seems too wide spread to not have some justification, I just can't think of what it might be.

  • 2
    Having never seen this policy before, I can only guess, but I suspect that they are trying to prevent people from simply repeating each character in their password. From a technical standpoint, I'd say this policy indeed makes it less secure, though. – Rens van der Heijden Aug 21 '15 at 6:28
  • 5
    Never saw this policy either. However, "The database field can only be so long." somehow indicates storing password in plaintext. Please don't do this. – bayo Aug 21 '15 at 6:37
  • Likewise no unicode ... (by which I assume they mean no non-ascii). If it's hashed, who cares? – Alfred Armstrong Aug 21 '15 at 8:38
  • 1
    These policies are implemented. Google maximum number repeating characters in password and you find several. And yes sometimes people go completely over the top setting policies, without apparent reason. – Jan Doggen Aug 21 '15 at 8:57
  • I think the line of thinking is that "Aaaaaaaa9" is a bad password, and preventing repeated characters should stop them from being used. I agree that it's a bad way to go about it though. – Polynomial Aug 21 '15 at 13:42
1

This rule does not make much sense. I believe the rationale between this rule is to avoid people padding their short passwords with repetition of a character (which is a pattern, hence identifiable by password crackers) to meet the minimum length, instead of entering different characters to create a more complex password.

E.g. if the user enters Jane1 as a password and the min length is 8, it will be refused. Then the user might just chose Jane1111. With the rule enforced, he'll be forced to choose something like Jane1yxc. However, he might as well choose Jane1234, which is actually more insecure than Jane1111.

0

It is simply trying to stop people getting round the minimum length rule by appending characters.

e.g. aB3 is not accepted because I need eight characters, therefore I'll use aB3xxxxx.

Rules like this are simply a losing battle for the site owners. They should be encouraging and advising users how to choose strong passwords, rather than enforcing rules that users can circumvent. For example, they could just circumvent the above by using aB3qwerty.

0

This only creates a small decrease in the key-space. If we assume our passwords are 10 characters long and drawn from uppercase and lowercase characters and numbers (so 62 characters), then there are 62^10 passwords.

Forbidding two repeated characters basically means we remove, after the first character, one choice for each future character. That's 62*61^10, which is 14% smaller.

The "no 3 repeated characters" (which I've seen occasionally) reduces the keyspace much less, less than 0.1%.

The aim of this requirement is to reduce the chance that users will type "easy to hack" passwords. In general passwords hacking tools don't start with aaaaaaaaaa and just work their way through every possible password, they search through "likely" passwords, and those built by taking one or two dictionary words, sticking them together, and adding some numbers, punctuation, or repeated letters, are the best place to start (as that is how most people build their passwords).

0

I believe it is more accurate to say that it's a technique to ensure a level entropy. This can be commonly identified by the N-GRAM technique for predicting text/speech. This is a method based on the probability that a pattern will repeat.

I would assume you can reduce your computational brute forcing if you can successfully predict when a user is going to repeat a pattern.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.