Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I can understand if a government service requires this but it also happens with a normal, ecommerce website!


If it's a US Federal Government service, you should point out to them that they are going against the explicit recommendation of NIST[1].

1. https://pages.nist.gov/800-63-3/sp800-63b.html#sec5, under 5.1.1.2 Memorized Secret Verifiers, 'Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret.'


Sadly the US Federal Government is a massive and unwieldy collection of organizations. I work in the Federal government and my part of it doesn't comply with NIST's modern guidelines at all. They probably will at some point, but department/agency level IT changes take years to be approved.


I really don't understand why. Please explain.


I do not understand why a government service would require this. Governments should improve security, not undermine it.

(Then again, most governments don't seem to care much about what I think they should be doing.)


The generated password is usually just random string and hard to memorise. If you need to use the password outside of the web, e.g. on telephone or in a physical office, then it makes sense to use a password you creates. This is similar to the "master password" used by password manager, you should remember it by heart instead of generating a random one.


Well in my little corner of the US govt the web certificates are usually expired and I can't log into my work email from home.


Are they actually expired? In both corners of the US government that I've worked most of the certificates are self-signed and work computers have the agency's root certs added to the browser.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: