Guy who came up with all those crazy password rules now says he's sorry

[Siam_Sam]

@Darren_Garrison

So I can go back to using 12345?

I never stopped!

[Clothahump]

@CurtC

I see a gaping security hole here.

I don’t. If you are referring to the three letters of the site being visited, the formula is flexible enough that I can change it to split the 4 digits and put them in the site identifier.

So for Chase, instead of Mar@Cha1608, I could use Mar@C16ha08. As long as I am consistent in the structure of the password and use that same structure throughout, it’s all good.

[Melbourne]

@Khendrask

I have too many with things like “Your High School”, or “Your Pet’s Name”. .

Those are really just alternative password questions. So when you name your pet, the pet’s name should be a mixture of UPPER CASE and lower case latters, with some numbers and symbols, at least 8 characters long

Here Pr!n$e01…

[ftg]

I really wonder what those “security” question people are thinking.

Street you grew up on? Which of several are you supposed to pick?
Childhood pet? What childhood pet?
Favorite teacher? Umm, none of them?
Ideal vacation? How many words for this? And next month it’ll be different.

And on and on.

For most sites NONE of them will really work for me.

Yep, I do <weird non-word> <key question word> for each of them.

And as noted: even if you have real answers to these, too many people can guess them.

Security questions, reality shows, etc. We are morphing into Bizzaro World.

[hajario]

@ftg

I really wonder what those “security” question people are thinking.

Street you grew up on? Which of several are you supposed to pick?
Childhood pet? What childhood pet?
Favorite teacher? Umm, none of them?
Ideal vacation? How many words for this? And next month it’ll be different.

And on and on.

For most sites NONE of them will really work for me.

Yep, I do <weird non-word> <key question word> for each of them.

And as noted: even if you have real answers to these, too many people can guess them.

Security questions, reality shows, etc. We are morphing into Bizzaro World.

What’s so damn difficult? You don’t have to give the actual correct answer, you just have to be consistent. Just choose one particular street and teacher and stick to it. As if the web page is going to come back at you and say “Incorrect. You lived on a street other than Maple for six weeks longer. Please resubmit.”

By the way, reality shows have been around for a few decades. They’re nothing new. I have managed to not watch them. It’s really easy.

[CookingWithGas]

@Procrustus

I like “What color is an orange?”

Easy to remember.

And easy to guess.

@hajario

What’s so damn difficult? You don’t have to give the actual correct answer, you just have to be consistent. Just choose one particular street and teacher and stick to it…

I have logins to maybe 200 accounts. I might have one site out of those that uses childhood street as a security question. I might have to answer that question once every two years. How the hell am I going to remember what answer I gave two years ago? I’ll tell you how, I have to record them all, which in itself can be a security hole.

[Slash1972]

@Dr.Strangelove

Your idea is basically equivalent to storing the passwords in cleartext. Those 3-letter segments can be trivially brute-forced, and assembling them back together into the original password is also trivial.

Yeah, I actually thought about this driving home yesterday. You are correct, it’s not really adding anything. I think I answered too quickly yesterday because I had to go to a meeting

[Sunspace]

@CookingWithGas

I use a federal government system that prohibits any dictionary words anywhere in your password. They are just begging for people to either write down their passwords or forget them.

That is easily defeatable… just use words from other languages! No-one is going to be checking you password for words in Hittite or Quechua…

[ftg]

@hajario

What’s so damn difficult? You don’t have to give the actual correct answer, you just have to be consistent. Just choose one particular street and teacher and stick to it. As if the web page is going to come back at you and say “Incorrect. You lived on a street other than Maple for six weeks longer. Please resubmit.”

Please note: I clearly am sticking to a particular “street” and “teacher”. Just not remotely real ones.

[Mangetout]

@Clothahump

I don’t. If you are referring to the three letters of the site being visited, the formula is flexible enough that I can change it to split the 4 digits and put them in the site identifier.

So for Chase, instead of Mar@Cha1608, I could use Mar@C16ha08. As long as I am consistent in the structure of the password and use that same structure throughout, it’s all good.

If you *have *structure, it’s bad.

[gaffa]

That’s why I use LastPass. Yes, I’m having to trust a 3rd party, but they let Steve Gibson audit their code, and he says it’s secure. At some point you have to say “That’s good enough for me!”

So now all my passwords are complete long gibberish with a mix of upper and lower case, numbers, letters and typographical symbols indistinguishable from line noise (if you’re old enough to remember that.)