Live data from Hacker News

Password Algorithms

penguindreams.org

111–114 of 114 posts

Re: Password Algorithms

#111
post #60

Earlier quoted context omitted.

> that the passwords would be recoverable by you Just click "Forgot password"?

Passwords can be used for systems other than websites, where "forgot password"-type reset doesn't always exist.

I assume you're talking about OS logins or something. But lets be honest here, 99% of the passwords we use daily are for websites or web based services

Re: Password Algorithms

#112

It occured to me last night that password strength is a predatory system similar to capitalism. My bank recently reduced it's max password length from 20 characters to 15, so in an E-mail I was writing to the CEO demanding they fix it, I was recommending improvements and I realize that an 18 character password SHOULD be minimum, however... If an 18 character password is minimum that actually reduces the length of bru…

With an alphabet size of A, the number of passwords with N characters is equal to A-1 times the number of passwords with fewer than N characters, plus 1.

This means that if you allow at least uppercase and lowercase letters in the password, setting a minimum decreases the search space by less than 2%, assuming the minimum equals the maximum.

If we even increase the maximum a tiny bit above the minimum, this decreases exponentially. Allowing a length of 8-20 instead of 18-20 only increases the search space by 0.0007%.

So you have to ask yourself whether that tiny fraction of a percent more security for you against brute force attackers (which a proper password of that length is already secure enough against) is really worth having your money in a bank with easy to hack accounts. As a customer, part of the cost of all those hacked accounts is going to find its way to you eventually.

Re: Password Algorithms

#113
post #69

Earlier quoted context omitted.

I have BANKS and INSURANCE companies require CASE SENSITIVE, alphanumeric only passwords. It's pure insanity.

> I have BANKS and INSURANCE companies require CASE SENSITIVE, alphanumeric only passwords. It's pure insanity. Of course passwords would be case sensitive, why wouldn't they be?

I meant case INSENSITIVE.

Apparently everyone thinks I'm a fuckin' retard over that of a typo.

Great audience. 10/10, would post again.

Re: Password Algorithms

#114

Earlier quoted context omitted.

This says that "alger klm curry blond puck" is easy to remember. I would forget that very quickly.

Try to make a (short) story/idea connecting those random words. Stories, something with sense and meaning, are easier to remember. correct horse battery staple is the usual example about this.

It's funny, I just came back to HN and saw your comment. I have absolutely no idea what that password was and I'm sure I would have forgotten the short story. Maybe that story would work for one main password on a password manager, but I don't think it would work for me at least for more than one or two passwords.
Post reply on HN