231–240 of 316 posts
I used to have to deal with an enterprise system that required quarterly password changes. The interesting thing about this system was it would refuse to let you set a new password that wasn't sufficiently different from the previous several passwords... Which almost certainly means they were implementing this security measure by storing the passwords in plaintext on the server.
Earlier quoted context omitted.
Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…
I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.
Earlier quoted context omitted.
Surely the whole point of a password manager is to have a different long complex password for each system you login to without needing to remember any of them but your master password?
What part of the parent comment are you replying to?
My response is that not everyone uses a PM, so the other two points are not moot.
Also, FWIW, I find myself rather uneasy about using a PM, so the other two points aren't moot, at least for me. "One password to rule them all" means that you've created one nice big juicy target that needs to be breached once, versus a bunch of little targets that have to each be breached individually. To take one real-life example, if the TSA wants to rifle through your digital life, it will be much, much harder for them if you don't have a PM.
I used to have to deal with an enterprise system that required quarterly password changes. The interesting thing about this system was it would refuse to let you set a new password that wasn't sufficiently different from the previous several passwords... Which almost certainly means they were implementing this security measure by storing the passwords in plaintext on the server.
Earlier quoted context omitted.
There's absolutely no way a five word password is better than 32 random characters. Two plain old random words, the entropy of that is less than 16 bits each, but we'll round up. One of the biggest cities in the US is probably even less useful, but let's credit it for 16 bits. And let's rate Zaphod Beeblebrox as one-in-a-million for entropy purposes. That's 68 bits. It's somewhere between 11 and 12 random alphanumeri…
I like to also purposefully misspell words, or use some kind of alternative representation of letters, like use 'keeb0rd' instead of 'keyboard'.
Earlier quoted context omitted.
What part of the parent comment are you replying to?
I think he means that a password manager (PM) renders the other two points moot. Password expiry? No problem - my PM generates a new one easily. Complex rules? No problem - my PM will follow any rules you like. My response is that not everyone uses a PM, so the other two points are not moot. Also, FWIW, I find myself rather uneasy about using a PM, so the other two points aren't moot, at least for me. "One password t…
Earlier quoted context omitted.
Bruce Schneier's summarization [0] of NIST's revised recommendations: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases. 2. Stop it with password expiration. That was an old idea for an old way we used computers.…
Surely the whole point of a password manager is to have a different long complex password for each system you login to without needing to remember any of them but your master password?
Earlier quoted context omitted.
What part of the parent comment are you replying to?
I think he means that a password manager (PM) renders the other two points moot. Password expiry? No problem - my PM generates a new one easily. Complex rules? No problem - my PM will follow any rules you like. My response is that not everyone uses a PM, so the other two points are not moot. Also, FWIW, I find myself rather uneasy about using a PM, so the other two points aren't moot, at least for me. "One password t…
Earlier quoted context omitted.
To me, there's an irony in that "Zaphod Beeblebrox's kite harasses Tuscon." is not only _more_ memorable on it's own, but is probably a _better_ password than "ZBw3hHg1tFWdhdt?Hoh2hXcrZmn" Stop using passwords, just use a "pass sentence." My last few passwords at my previous employer: "Tim, bring me chicken #15" "Mary, stop looking at me!" "Nothing you can do about 2!" "The coffee here is gross." Seriously.
There's absolutely no way a five word password is better than 32 random characters. Two plain old random words, the entropy of that is less than 16 bits each, but we'll round up. One of the biggest cities in the US is probably even less useful, but let's credit it for 16 bits. And let's rate Zaphod Beeblebrox as one-in-a-million for entropy purposes. That's 68 bits. It's somewhere between 11 and 12 random alphanumeri…
Surely that depends on the hashing function. Moreover, these passwords are usually used for authentication rather than encryption, making the speed of the GPU irrelevant.
Even for encryption, you should probably store a strong key on a hardware TPM and only using the weaker key to authenticate towards the TPM.