P@$$w0rd S3cur!tyFollow

Ok, so I consider myself a moderate when dealing with passwords. I don't use common names, dates and/or words, none of my security questions and answers are legit and I vary the level of password difficulty pending on what I'm safeguarding. However, I don't use 20 character passwords or have paranoia that people are always trying to hack me.

So, with that being said, I've been getting rather frustrated with the varying password policies from websites. I applaud their desire to protect our data, but their policies aren't uniform and are dumb, making me create and remember more and more passwords. The more unnecessary restrictions you have, the less possibilities there are.

Prime example. Same website made me create a password that had to be at least so many characters, but no special characters. Later, in the same website, I had to create another password that had to be EXACTLY 8 characters, using at least one number, one special character, but only SOME special characters. (I don't remember the exact policies, but they were something to that effect). Because my first password violated the second password policy, I had to create an entirely different (modified) password for the same site! And, no, this wasn't Healthcare.gov.

As I start to do more stuff online, I run into this more and more and has become more and more frustrating. What's the point of creating a policy that doesn't allow special characters?

What say ye?

Funny you mention healthcare.gov. I was going to sign up for that until they told me my USERNAME had to have numbers and/or special characters. Password security recommendations are fine. Arbitrary restrictions left up to the developers to determine are asinine.

I have 3 different generic passwords I use commonly. Those are varied enough that I can almost always use one of them no matter the restrictions. Since most places give you 3 guesses on your password it works out well for the whole remembering part (which I suck at). After that important stuff has subtle variations of the above, something that easy enough for me to remember (i.e. somehow related), but changes the password fairly significantly, and has some part I can iterate on if I'm forced to change things up a bit, like the work password which changes every few months.

The questions are the bane of my existence though. Firstly I don't have a favorite teacher, or a favorite fruit, don't remember the model of my first girlfriend's car, split my childhood between a few different houses, can never seem to remember whether or not my first phone number should include the area code, and that theme continues for 90% of what they come up with. I'd make up fake answers for those (which I'm told is best to do anyway), but I get forced into using those questions so infrequently I can't seem to remember my fake answers.

I'll just stick with the herd thing and hope enough of the rest of you are feeble, injured, or somehow look more delicious so the predators will go after you first and leave me alone.

Edited, Oct 18th 2013 8:28am by someproteinguy

I disappointed no one has come up with something easier and more secure for the home computer user than passwords. Retina-scans, odor-recognition or fingerprint passes, heck even a swipe card would work.

I will not discuss my passwords here. TLW frequents this place.

Relevant.

That's how I am and that usually isn't an issue, but over time, I have come across ridiculous password policies that forces me to alter my passwords, creating new alterations.



Easy solution. Think of one place: Gotham City, One name : Peter Parker, One Pet Name: Alpha5, one car name: Pento and use those for every question. NEVER USE anything real that someone can use facebook/ social engineering to get.
Name of best friend/ girlfriend/ teacher/etc. = Peter Parker.

Place of birth; honeymoon; first vacation, etc = Gotham City

Now, the key is to remember this if a person challenges you on the phone. You have to ask are these MY security questions or are you using your database? A few years ago, a woman asked me the name of my son. I responded "??? I don't have a son, do you know something that I don't know?". There was an awkward pause, until I realized that she was asking my security question and answered. We laughed.



I think you misread what I wrote. I'm asking why create a policy that does NOT allow special characters.


I've been arguing this concept for awhile. The more restrictions that you give, the less possibilities there are.

Different strokes for different folks. That's too much automation involved with sensitive information. I like to have some interaction. Besides, how exactly are your passwords automatically dumped onto your PC if the generator is on a private network? Sounds like spillage.

You don't do online banking? I would imagine that anyone who has a program to create and update their passwords would also be a proponent of auto-pay. Not having to ever worry about paying bills is a great feeling.

Oh I have autopay, I just don't use online banking, I also have direct deposit but I don't need to do anything with it at all, I already go to the bank twice a month to talk about my investments with my representative, and if I have any actual pressing banking matters I can clean them up while I am there anyway.

I think maybe the most sensitive information I have on the internet might be my pay pal account, which Is tied to my credit card, but that is just a pay as you go credit card unaffiliated with my bank used solely to top up pay pal so I can play and buy games. Everything else is pretty much on my debit card, and statements from banking machines IF I need cash, which only happens if I go to the bar, or need to buy some more weed.

Lets see. Ya I don't think Ive ever visited the bank website outside of my bank and making my first password. Now I could...I just haven't.


Actually that is not true the Government made me put my birthdate and my sin number into an online form a few years back when I was applying to colleges and college loans.

Edited, Oct 18th 2013 11:10pm by rdmcandie

Edited, Oct 18th 2013 11:11pm by rdmcandie

I have a wireless password that follows more in line with the XKCD comic. I would love to see someone brute force it. I wonder how many decades it would take....

Just use whatever, then forget it.

Thats what I assumed, just another tool that is nice to have available should you need it.