41–50 of 114 posts
Earlier quoted context omitted.
Heh, our HR system had a following requirement: - password must be between 7 and 8 characters long - has to include one number - has to include one of the following: $#!*, no other special characters are allowed It was so horrendously bad it's not even funny.
> password must be between 7 and 8 characters long How do you enter a fractional character?
Earlier quoted context omitted.
> I use a password manager and generate 30-ish character long passwords Do note that you don't need anything more than 22 random mixed-case letters & digits: 26 lower-case letters plus 26 upper-case letters plus ten digits is 62, and 62²² ≈ 2¹²⁸. Completely agree re. the ineptitude of the developers of sites that try to limit one to less than that.
diceware.com
The problem is passwords, so long as we have passwords we are going to keep talking about password algorithms, password managers, password strength, password requirements, lost passwords, stolen passwords, phished passwords, forgotten passwords, expired passwords and all that crap. My startup is working on killing the password. What if we don't need passwords EVER? No need to argue about algorithm, strength, reset, l…
Good luck with legacy systems. Bad passwords will be around forever because of ancient software.
Oh, and
Earlier quoted context omitted.
> not something like LastPass Why? Friends have found LastPass to be pretty reliable and user friendly so far.
Among other things, they apparently use webpage encryption (their technology page indicates that AES is implemented in JavaScript for their website), which means that they have the ability to target any user at any point in time. Also, they're proprietary software. Password security is too important to entrust to proprietary software.
Is LastPass going to protect you against sophisticated State, or even potentially Corporate attackers? Maybe not. Will it protect you against random hacks and insecure sites better than just reusing the same password that you can remember? Yes.
I generally agree though that this is an area where open source software is preferable. I'm also really intrigued by the work Keybase is doing and hope that it might spur some interesting solutions for web auth as well.
The author recommends using a password algorithm that you can mentally process and then storing the results in a password manager. If you're going to store them why not let the password manager generate the pass for you?
My guess is that the intent is that the passwords would be recoverable by you without the aid of a password manager, but that the relative convenience of a password manager still adds benefits (e.g. behaviourally: guiding you away from any potential tendency to opt for "simpler" passwords out of laziness)
Just click "Forgot password"?
Earlier quoted context omitted.
diceware.com
This says that "alger klm curry blond puck" is easy to remember. I would forget that very quickly.
The problem is passwords, so long as we have passwords we are going to keep talking about password algorithms, password managers, password strength, password requirements, lost passwords, stolen passwords, phished passwords, forgotten passwords, expired passwords and all that crap. My startup is working on killing the password. What if we don't need passwords EVER? No need to argue about algorithm, strength, reset, l…
Earlier quoted context omitted.
This says that "alger klm curry blond puck" is easy to remember. I would forget that very quickly.
Yeah, the default word list is pretty terrible. Try one of the ones from the EFF: https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...
Here's a direct link: https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt