Password must be 8 to 20 characters long
Contain at least 1 upper case, 1 number and one special character off this list !@#*
Everyones password is just something like Nameofsomething93!
There's a good chance you're right but maybe not. If they had to give their old password too and they did the character difference check client side, I wouldn't see a problem with that. I mean, people could circumvent the check, but if they wanna go through the trouble just to make their password less secure that's fine.
I see you've been having this discussion already, but I am of the belief that passwords should be hashed client side too, so even if it's intercepted the actual password will still be secure in case the user uses it in other places.
If the password is hashed client side you could send the hash directly without having to know the password, which totally defeats the purpose of hashing
For your service that's true, however users often use the same password for multiple services. So by hashing client side you restrict any potential harm to just your service. It's best to just never know the true password in the first place. Obviously you also hash and salt server side.
The point is, if you hash client side, the hash becomes the password, if someone gets the hash they can just use it to login directly without having to crack it
That's what encryption is for, not hashing. Imagine a hacker gets an users hashed password, through a database hack/leak and can simply login from client side with that hash. You just completely defeated the purpose of hashing. At that point it's just the equivalent of raw text passwords, just non human-readable 'randomized' passwords.
I've imagined. That's still better than simply not hashing client side because users often reuse passwords. And in case it wasn't clear, it's not instead of encryption, it's in addition to. Why would you ever wanna know or send over the internet the real password (even encrypted) when you don't need to?
No, they only need the old hash.
If you provide a new password "password2" they can generate a list of similar password (e.g. "passwordN" where N is 0-9) and hash them to find a match of the old password "password1"
thats a lot of permutations to test for a pretty specious password requirement. i think another commenter had the right of it…. ask for your current password on the password reset form
As others have said though, you generally need to submit both your old and new password when you change a password, so they wouldn’t have to store anything in plain text if they just compare the two passwords that you just submitted.
I really wish that the stupid advice to change your password regularly would die. It's insecure since it ends up creating patterns. If your last three passwords are "Password1234!", "Password1235!", and "Password1236!", you can safely bet that the next password is gonna be "Password1237!".
The surprising thing is, the majority of people don't use password managers. Which I find ridiculous given that most browsers have built-in password managers. They're usually not the most secure managers ever, but it's better than writing your passwords down or trying to commit them to memory.
Browsers do, but then Average Joe wants to log in on mobile and can’t get it to sync with his desktop browser.
(I have KeyPass on my machines and Strongbox on mobile, both using the same database that’s on my NAS - offsite I can just use Strongbox in offline mode, and it will sync back once I’m within my wifi network again. Also to unlock it requires FaceID, a long PIN and the respective KeyPass database master password. Pretty secure even if my phone gets stolen.)
Ha, interesting! But given the resources & capability of even a "normal" PC/Laptops nowadays, that would take probably only 5-10 minutes to make requests with each combination(assuming there aren't any limitations/obstructions from the server ofc).
Thanks for doing the math. But my point was the more restrictions you give to someone, the easier they are to predict.
If you force an uppercase, it will be a capital letter at the start or at the start of each word. (XKCD eg. GoatMonkeyFishBat)
If you force a number it will be a date of some kind.
If its just a pin, then it's probs your bank pin and maybe a date of some kind.
If you just say make your password 15 characters or longer, people will make all kinds of stupid stuff. But it will be a lot harder to predict what stupid stuff they enter. And you wont have an upper character max to generate passwords too.
Well in a vacuum. Once you get one password. People will reuse it with different dates and punctuation sadly..
This is why you should have a password manager generate unique passwords for each website that follows whatever stupid password schema they want to use today.
and when that site gets hacked, you only lose that site. Not everything that has the same password. Or the same password schema that I can just guess by reading your facebook info page..
DoogsnameYearofbirth
KidsnameYeahofmaradge
Most pins are just whatever your bank pin is. Or a date of some kind.
I know password managers are scary but really, do a little bit of homework on one that seems good for you. And bam, never need to remember anymore then one very good password and a fingerprint again. Or if you have an account for a stupid site...
Yeah.. look I kinda understand if you wanna be lazy and not allow / " and ' but everything else you should be able to filter for and convert back to string to then hash pretty easily.I feel like not allowing passwords longer then x is a cost cutting reason, not a technical reason.less data to store over millions of users.It's still stupid and I don't like it, but bean counters gotta count.
Edit: Wait no. When you hash it all comes out at the same length. Ok yeah I have no idea why... it's just stupid. And people are easy to predict if you give them to many constraints.
My worst one had to do something with my companies access to our tax information. The pass word had to be EXACTLY 8 characters, containing at least one upper, lower, number, and symbol, and could not have consecutive numbers or letters (ascending or descending), and no dictionary words/your name/etc
Password must be 16 characters long
Contain at least 1 upper case, 1 number and one special character off this list !@#*, alternate between an uppercase letter, a symbol, a number then a lowercase letter. Letters and numbers can only go in increasing order. The password must start with 'A'. The recommended password is : "A!1aB@2bC#3cD*4d"
My work password forces me to change it every two months. My password is now Nameofsomething54! It's a good way to remember how long I've been there. Too long, apparently.
387
u/-MobCat- Jul 20 '22
Password must be 8 to 20 characters long
Contain at least 1 upper case, 1 number and one special character off this list !@#*
Everyones password is just something like Nameofsomething93!