-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Propose password policy based on current standards #646
Comments
Mandatory XKCD: https://xkcd.com/936/ |
Not understanding the value of security, or being lazy, should never be a reason to weaken the security. Personally, to make the password more memorable, I use Secondly how often an average person needs to enter BIOS? Most likely the frequency is high right after buying the HW. But when settings are settled, one almost never enters BIOS setup. The password may be enrolled when one decides on the set of settings. Even better idea: remove the setup password if the presence of such option causes such willingness to abuse its use. |
And now we know which characters to include in the dictionary when bruteforcing your passwords ;) |
Good luck. Except that I mainly use the generated passphrases from bitwarden-like apps But in case like these where you need to memorize something, It may be good. And I just gave a few examples. There are more symbol I use, not necessarily in place of regular characters in words Anyway, don't forget to send me a ransom, when you get to my bank account. |
I guess I'll need to look for peer-reviewed studies showing the impact of password requirements here to show my point. |
Password policy is very common topic, we should just look at existing standards, here are some references: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#implement-proper-password-strength-controls Maybe we should change the title of the issue to less-triggerring one, like "Propose password policy based on current standards" ;) |
|
Sounds like something that can be applied to anything. So be it. |
I guess this is an antipattern we should not follow. |
When is this issue planned to be implemented, i.e. when will Dasharo accept passphrases as USER or ADMIN password? |
@BeataZdunczyk That should be not that difficult change, can we plan to include in the next releases? |
Working on the issue here: |
Dasharo/edk2#152 |
The problem you're addressing (if any)
The current password requirements are very strict and won't allow someone to use passphrases (because you need uppercase, lowercase, special, numeric, symbol(?) characters
It has been shown that strict password requirements cause people to re-use their passwords or use shorter ones because they simply can't remember so many complex strings of text, making their overall security lower: https://www.enzoic.com/blog/the-benefits-and-drawbacks-of-password-complexity-rules/
Describe the solution you'd like
Remove or loosen the password requirements
Where is the value to a user, and who might that user be?
People who use passphrases
People who are okay with using less secure passwords
Describe alternatives you've considered
FIDO2 auth in setup menu?
Additional context
https://neal.fun/password-game/
The password requirement code was imported completely from edk2-platforms without much thought if we want to actually have these requirements
The text was updated successfully, but these errors were encountered: