What is a dumb password rule?
DimitriPapadopoulos opened this issue · 6 comments
- How do you define a dumb password rule?
- Some countries may have recommendations or regulatory rules. Companies need or tend to follow them. Instead of shaming the company, shame the recommendations and regulatory rules.
There are countries with password rules :O ? I don't think we have some in Germany. There is a pretty good understand what a bad password is and insurances wont pay in these cases but I don't think they rely on a written law.
Can you name a country that has such regulatory rules?
France for example, but these are general "recommendations" from the data protection authority (CNIL) more than regulatory rules:
L’authentification par mot de passe : longueur, complexité, mesures complémentaires
Companies will follow the above recommendations, because in case of personal data loss they might be held responsible.
But then is a mere minimal length for passwords considered to be a "dumb password rule"?
In Germany:
- BSI TR-03148 Sichere Breitband Router / CCC und OpenWrt: Technische Richtlinie des BSI zu sicheren Routern unzureichend
- Hinweise zum Umgang mit Passwörtern but then this document does not suggest "dumb password rules" as far as I can see.
I would define a dumb password rule as one that:
- restricts max length
- restricts characters allowed/disallowed
- enforces rigid complexity (kind of ambiguous, but stuff like need 1 uppercase, 1 lowercase, etc) xkcd
Password guidelines (aren't to my knowledge enforced, but are there as reference on what people should do)
- NIST: National Institute of Standards and Technology (US)
- password minimum length 8+
- block/reject compromised/common/sequential passwords
- ALL characters allowed
- NSC: National Cyber Security Centre (UK)
- encourage password manager use (generated passwords can be super complex)
- encourage memorable password (3 word (diceware) or CVC-CVC-CVC format)
- don't enforce complexity
- block/reject compromised/common passwords
I've added a note on the new site about page on the definition of a dumb rule. Which is, in fact, that there's no real definition here except that you'll probably know one when you see one. https://dumbpasswordrules.com/about/