Why not let the administrator decide? [LWN.net]

Why not let the administrator decide?

Posted Aug 10, 2026 20:48 UTC (Mon) by mb (subscriber, #50428)
In reply to: Why not let the administrator decide? by donald.buczek
Parent article: Changes in shadow-utils password-expiration features

Not all passwords can be fetched from password managers on use. Like login passwords, the password manager's password itself, or any other password that needs to be typed in all the time (going to the password manager 100 times a day is impractical).

I have about 10 passwords which I have to remember for various reasons. Unfortunately some of them have relatively short expiry and to make it worse some of them even have conflicting character rules and new-after-expiry-rules.

So, no. In these cases a password manager doesn't help at all. Only getting rid of expiry helps.

And while we are at it get rid of stupid character rules as well. A password does not get noticeably better by forcing the user to add numbers, because that will just make them put a 1 at the end.

to post comments

Why not let the administrator decide?

Posted Aug 11, 2026 8:22 UTC (Tue) by geert (subscriber, #98403) [Link] (1 responses)

The really annoying character rules are the ones that insist on the presence of special characters, but reject half of the common special characters. So it takes a lot of cycling through "generate password" in your password manager until you end up with one that is accepted.

Why not let the administrator decide?

Posted Aug 11, 2026 9:02 UTC (Tue) by alx.manpages (subscriber, #145117) [Link]

I do something that so far has worked:

1). Generate a random password consisting of 64 [:album:] with `makepasswd --chars 64`.

2). If the system requires a symbol, I delete the last character, and replace it with a `+`. The choice of `+` is for a reason: when double-clicking the password, the `+` is considered part of the word, and thus I don't need to carefully select the characters.

3). In the rare case where `+` is not accepted as a symbol (happened to me last week, but it's very unusual), I replace it with some other symbol from the list of accepted symbols.

It's still annoying, and certainly doesn't make the password stronger, of course.

Why not let the administrator decide?

Posted Aug 11, 2026 9:12 UTC (Tue) by alx.manpages (subscriber, #145117) [Link] (3 responses)

> or any other password that needs to be typed in all the time (going to the password manager 100 times a day is impractical).

Have you tried pass(1)? I use it even for passwords that I use (quite possibly) 100 times a day. It stores my SSH key passphrase, for example, and I have configured ssh(1) to read it from pass(1). Being a command, which prints to stdout (or clipboard, with -c), it's easy to set up programs to use it, and use it 100 times a day if necessary.

> And while we are at it get rid of stupid character rules as well. A password does not get noticeably better by forcing the user to add numbers, because that will just make them put a 1 at the end.

I wanted to do this some time ago, but found some reticence (IIRC, the same reasons; that is, users forced by regulations). However, seeing that this seems to be working and that regulators will be forced to change, it seems we can probably also do that. I don't remember the exact rules we have for what is a complex password in shadow-utils (they are of course optional).

Why not let the administrator decide?

Posted Aug 11, 2026 9:45 UTC (Tue) by mb (subscriber, #50428) [Link]

Have you tried pass(1)?

I use my own password manager (https://github.com/mbuesch/pwman) since ages. It is command line and fully scriptable and pluggable into other apps that support this kind of thing. With ssh this might work. But with many other applications it doesn't (e.g. they have a GUI entry field only). So yeah, we might come down from 10 to 9 passwords that I absolutely have to remember.

I also do not want to unlock my pw database all the time, because that means I will have to frequently type in the most precious master password I have (people/cameras might see it). And it means that I have to decrypt all my passwords from the database into memory all the time (that's how it currently works. I have plans to fix this, but don't hold your breath), even if I just want to ssh into an raspberry-pi on my floor I unlock the keys to my whole life. And opening the password manager takes more time than usual, because the password is complex and the KDF is hard. I think the only options are remembering a dozen of main passwords or eventually use passkeys if everything supports this within the next three decades.

stupid character rules

I wanted to do this some time ago

Cool :)

Why not let the administrator decide?

Posted Aug 11, 2026 14:10 UTC (Tue) by Wol (subscriber, #4433) [Link]

Crazy idea, but might make administrators think ...

All of these stupid rules like "one special char, one number, etc etc", as you process and encrypt the password look for how many passwords suffer from them. Okay, you're going to get a few, but if you notice rather more than average, start downrating the strength of the passwords that match these rules.

You just want a mini database (plain text file) that says "x password changes, n complied with this stupid rule, o with that stupid rule, p with the other stupid rule", this isn't random, start complaining about passwords that match them. No need for the file to identify *which* stupid rule ...

At which point, any administrator who says "you need a strong password containing one special character, one number, one upper case, blah blah blah" is going to have the users coming back to them and saying "every time I try to follow the rules, the computer complains it's a weak password!".

Cheers,
Wol

Why not let the administrator decide?

Posted Aug 19, 2026 17:43 UTC (Wed) by LtWorf (subscriber, #124958) [Link]

i love pass. I also implemented support for calling it from trabucco so I can get a password in the copy buffer without using a shell of I need to paste it somewhere.

Why not let the administrator decide?

Posted Aug 11, 2026 15:52 UTC (Tue) by farnz (subscriber, #17727) [Link] (6 responses)

And while we are at it get rid of stupid character rules as well. A password does not get noticeably better by forcing the user to add numbers, because that will just make them put a 1 at the end.

It feels like the end point we're reaching towards is a human-friendly entropy estimator for passwords: roughly how long would it take a sophisticated password cracking tool to guess this password?

The entropy of "SzEp1r03G" (9 random characters, with 62 choices for each character, chosen by my computer's random number generator, so just under 54 bits of entropy) is similar to the entropy of a 4 Diceware word password such as "WrongnessPopulatePastorEclipse" (7776 words in a Diceware dictionary, 4 words, so just under 52 bits of entropy), and both passwords should thus be as acceptable (or unacceptable) to a systems administrator; a cracker who knows the exact algorithm used in both cases will take about the same amount of time to guess both passwords, whereas "lwn.net1998" is very easy to crack if you know the algorithm (domain name and date of founding for the site - extends nicely as an algorithm across many sites, but takes 1 guess per site).

The hard question is how to implement such an entropy estimator. I can estimate entropy for passwords I create algorithmically (since I can do the log2(possible choices) * number of choices made calculation) very easily, but shadow-utils won't know how the user created the password, and will need to make a guess about how hard it'll be for a password cracker to brute force the password.

Why not let the administrator decide?

Posted Aug 11, 2026 16:02 UTC (Tue) by alx.manpages (subscriber, #145117) [Link] (5 responses)

> The hard question is how to implement such an entropy estimator.

I don't think password validators should concern about entropy. Users should use password generators, and those know the entropy of what they generate. The validators should just accept that users know what they're doing (or that at least, they should know).

If the admin wants their users to have strong passwords, it should point them to password generators, or at most, require a minimum length. More than that is experimentally known to be useless, or even detrimental.

Why not let the administrator decide?

Posted Aug 11, 2026 16:39 UTC (Tue) by farnz (subscriber, #17727) [Link] (2 responses)

If you're trying to make passwords secure, you end up needing an entropy estimate in order to be able to detect users who are lying to you - they claim to use a password generator, but do things like "tweak" the generated password to be more memorable (so they change "swxjzdap", which is generated by an 8 character, 26 choices per character ⇒ 37 bits entropy, to "sexizdad" for memorability).

Note that a minimum length is a weak entropy estimate - you know that written text has an entropy around 1 bit per character in most alphabetical languages, so you know that a minimum length of 10 characters is going to be 10 or more bits of entropy.

Ultimately, though, while it's fun to think about how to make passwords secure, we already know how to do far better - key based authentication (like SSH keys) means that you've got as many bits as you want for the authenticate to a system approach (a 256 bit ECDSA SSH key is equivalent to a 10 word Diceware passphrase, or 22 characters of random case-sensitive letters and numbers), and you can have a master key backed by a hardware token to give you 2FA for unlocking access to your keys (with, again, the large number of bits a key can have).

Why not let the administrator decide?

Posted Aug 11, 2026 16:51 UTC (Tue) by mb (subscriber, #50428) [Link] (1 responses)

we already know how to do far better - key based authentication (like SSH keys)

These only solve part of the problem. If done properly then they still need a (local) password. Otherwise they are as insecure as storing your password database as passwords.txt on the local disk.

Why not let the administrator decide?

Posted Aug 11, 2026 18:38 UTC (Tue) by farnz (subscriber, #17727) [Link]

Even a strong password that's stored in ~/passwords.txt on my local disk is a significant security upgrade on a weak password on a networked system. Attacking a system that deliberately lets you log in over the network is significantly simpler than getting a copy of a file on my local disk.

And the admin can't guarantee that I'm not doing something stupid - I did point out that you can have the keys stored in a key manager that requires a hardware token to unlock (modern password managers can act as SSH agents, for example, requiring a hardware token to unlock the password manager). But making the attacker attack my system to get my account, rather than opening up attacks like "crack the password someone uses on MySpace, transform it and use it to log into your system" is a worthwhile endeavour.

Why not let the administrator decide?

Posted Aug 11, 2026 16:45 UTC (Tue) by mb (subscriber, #50428) [Link] (1 responses)

If the admin wants their users to have strong passwords, it should point them to password generators

Well, yes and no.

If the generator generates truly random passwords then: No. This only works, if the password does never have to be remembered. This does not work for many passwords that matter like main login passwords or password manager main passwords.
If the generator generates these readable random passwords (like pwgen (1)) then: Maybe. They are still kind of hard to remember and therefore risk being short or written down on Post-Its.
If the generator generates long xkcd-936 style passwords then: Yes. Is there a generator with a big enough word database that can do this?

The most important thing and at the same time the hardest thing is to get the old and counterproductive rules out of people's heads. There are rules like "8 chars are enough", "passwords must be as complicated as possible" or "no words from the dictionary" that truly hurt security, but are buried deep in peoples heads. I have no idea how to do that easily, though. Unlearning is harder than learning. :)

Why not let the administrator decide?

Posted Aug 11, 2026 21:08 UTC (Tue) by alx.manpages (subscriber, #145117) [Link]

If the generator generates long xkcd-936 style passwords then: Yes. Is there a generator with a big enough word database that can do this?

There is. :)

$ whatis xkcdpass
xkcdpass (1)         - generate memorable, secure multiword passphrases

https://manpages.debian.org/buster/xkcdpass/xkcdpass.1.en.html

I have no idea how to do that easily, though.

We can have a mention in the manual page of passwd(1). It isn't great, but that's as much as I can do.