When it comes to composition and length, passwords mostly don't matter

Post by senectus1 » Fri, Jul 12, 2019, 1:25 AM UTC

simonebrunozzi wrote: post #34

privateSFacct wrote: post #23

Earlier quoted context omitted.

This. I deal with relatively higher volumes of information that must remain secure. With google, I have hardware authentication device and 10 codes. Every 30 days or so it asks me to plug in the hardware device. Randomly it asks me more often - I have no idea why but no objection. My password is secure as well and only used on google but THANKFULLY I do not need to change it all the time and so I don't have to write…

> No SMS text option. ... ridicolous Agreed. My Twitter account was recently hacked thanks to T-Mobile's incompetence. [0] [0]: https://medium.com/@simon/mobile-twitter-hacked-please-help-...

Post by mikekchar » Fri, Jul 12, 2019, 1:34 AM UTC

padobson wrote: post #43

mquander wrote: post #30

I think the thesis of this article is rather forced. The actual claim is something like: "Passwords don't matter, as long as your password isn't in the top few dozen common ones, it's not in any credentials breach accessible to attackers, it's longer than 8 characters or so, and you don't reuse it." That was a lot of criteria that seemed to matter, if you ask me.

And also "Passwords don't matter as long as you aren't important enough or connected to a person or organization important enough to try more than the most routine password vulnerabilities"

Post by TimTheTinker » Fri, Jul 12, 2019, 1:38 AM UTC

smacktoward wrote: post #10

TimTheTinker wrote: post #6

Note this is from the perspective of a security decision maker, like an IT administrator. Policy-wise, users can't be forced or trusted to create excellent passwords on their own. But as an individual, your passwords do matter. It makes a world of a difference to use a password manager and long, completely random passwords - such passwords are immune to all sorts of cracking attempts, and using them can often make MF…

The point of the article is that many common attacks work just as well against completely random, unique passwords as they do against weak/reused ones. If you get phished, it doesn't matter if your password is strong. If your machine has a keylogger on it, it doesn't matter if your password is strong. Etc. Lots of attacks boil down to the attacker convincing you to unknowingly divulge your password, and if that passw…

Post by mr_toad » Fri, Jul 12, 2019, 1:43 AM UTC

q_queue wrote: post #18

default-kramer wrote: post #2

> Your password doesn’t matter, but MFA does! Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA. I'd be much more interested what that percentage is when you only consider people who use password managers. (Which is not to imply that MFA isn't good.)

Furthermore many sites make it difficult to use a password manager because it's hard to block automated password guessers and not interfere with password managers trying to enter passwords.

Post by danShumway » Fri, Jul 12, 2019, 1:45 AM UTC

kortilla wrote: post #47

danShumway wrote: post #21

Earlier quoted context omitted.

Eh... cars are really big. A better way of phrasing this is, "if this were true, your wallet/phone would get stolen a lot more often." But aren't wallet/phone thefts relatively common? > You're less secure from targeted attacks from people who know you IRL I'm also not completely certain this is true. If a YubiKey is the only thing securing most people's accounts, I don't need to target you. I can walk into a coffee…

A wallet is useful to a thief, a yubikey is not. There is little overlap between petty thieves and people trying to get into a particular target’s account.