This reminds me of my teenage years. I used to use passwords that do not rely on personal facts (i.e birthday) or social relationzs (i.e my city..etc) but tried to be smart and relied on creating passwords that is related to what I feel because I thought that it is harder for people to know that. So I had a password "Ihate_My_Math_Teacher" for anything that is related to study for a while.
I Know What Your Password Was Last Summer
11–20 of 103 posts
Re: I Know What Your Password Was Last Summer
#12I always wonder why employers don't just set passwords for their users and only give them the option to randomize them. Seems like an ideal solution, if using passwords is a requirement.
Maybe it would be fine if it was random 4 words like in the XKCD, but otherwise it would cause people to plaster sticky notes everywhere and hardcode it in their computers, no?
if you work from home, a sticky note with a strong password might be safer than a memorized employee-chosen password
Re: I Know What Your Password Was Last Summer
#13I always wonder why employers don't just set passwords for their users and only give them the option to randomize them. Seems like an ideal solution, if using passwords is a requirement.
Requiring SSO mostly does this, except for the SSO passphrase. That should be randomly generated, but usually isn't.
Re: I Know What Your Password Was Last Summer
#14Not mentioned in the article, but I bet seasonal/time-related passwords are due to password rotation policies. I work for a company too slow or stupid to have understood how counterproductive such policy is, and all my passwords are an update of the former. Because we humans cannot remember multiple strong passwords.
Yes, NIST changed their guidance to advise against password rotation for this exact reason.
I think the answer is distributed password managers, myself.
Re: I Know What Your Password Was Last Summer
#15I always wonder why employers don't just set passwords for their users and only give them the option to randomize them. Seems like an ideal solution, if using passwords is a requirement.
Some employers just buy a 1Password license for their staff.
Re: I Know What Your Password Was Last Summer
#16[flagged]
Re: I Know What Your Password Was Last Summer
#17[flagged]
Can someone message Dang to ban this account?
Re: I Know What Your Password Was Last Summer
#18Do I understand things correctly if they claim to have cracked 31,200 passwords of which 481 were "TooBlue2022", and they then go on to think that this is a password used by multiple people? (To be more precise, this is not claimed directly for the top 10, but it is implied for the season words.)
Is it nog a bit more likely that there was some duplication in the hashes?
Or that this password is used by one prolific account creator? Or that it is the default password after signup for some blue service?
Re: I Know What Your Password Was Last Summer
#19In the same theme, something to add to their list of common passwords is the What3Words database of locations
It's something like 50trillion sets of looks-random strings. That's quite a lot, but if the list could be narrowed very significantly to get some likely results by selecting locations in:
1) cities where a company is physically located
2) large capital & global cities
3) significant landmarks
I see sysadmins using the tool all the time as a temporary password generator.
Re: I Know What Your Password Was Last Summer
#20I always wonder why employers don't just set passwords for their users and only give them the option to randomize them. Seems like an ideal solution, if using passwords is a requirement.
There's been more than a few times where I've been annoyed because a site or employer refuses to allow randomly generated passwords or allow me to copy/paste into the password field.
I firmly believe the safest option is a local password manager with randomized passwords that you maintain local backups of.