91–100 of 117 posts
Earlier quoted context omitted.
I completely agree, but too many websites put upper limits on the password length (which is completely idiotic) to be able to do this in practice.
Well, how would they fit the passwords in the database if there was no limit? =)
Hahahahaha. This is a total embarrassment and it is why we can't have nice things. There is always this for a decent alternative: https://howsecureismypassword.net/
46 quintillion years
score!
Earlier quoted context omitted.
I agree! I've been using passphrases for about 12 years, but in this form: Ia! Ibupfa1y,bitf: (It's the first letter of every word in that sentence.) A sentance relevant to me that also refers to the site is easier for me to remember than random words. But perhaps I could make it longer... Use the kxcd idea too. The entropy is huge unless/until everyone starts making 3 word passphrases the same way with very common w…
Using a password manager
Can you recommend a password manager that works on all browsers/devices that you trust?
I have not found that yet, so I use passphrases customized to the site.
Edit: Also fundamentally it means that to access a single site from a compromised device, I'm potentially giving a nice list of all of my credentials.
This is what I wrote in their 'Contact' form, which returned an error: 'The form you submitted contained the following errors Missing Data.(DIFFERENT_IP) Return to Previous Page' I used your password checker here: http://www.getsafeonline.org/themes/passwrdcheck/index.html I notice that it has set the form field to hide my password as I type it, that there are two lock symbols next to the password box, and that the b…
I did a WHOIS, and seeing a domain registration date back to 2005 gave an air of credibility. So then I visited Internet Archive and browsed several pages https://web.archive.org/web/20080701000000*/http://getsafeon... They seem like experts... experts in subtle verbal manipulation for those without technical understanding, at least that is how it reads for me. Over years of archives, including the OP post, 'protect…
And see how pixelated their main banner image is?
Not only bad grammar, but poor images. Really am ammeter website.
Earlier quoted context omitted.
> but that concern is moot if you use unique words You could say the same thing about passwords using random characters. The problem isn't getting people to remember them, it's getting people to use random passwords/unique words in the first place. Telling people to "use a long sentence" will just result in them picking common sentences most of the time like "To be or not to be" or "Live long and prosper".
Well, let's say you have a 5-digit password made up of letters and numbers. That's 60466176 combinations. Now let's say you have a 4-word passphrase. There are about 120,000 words in English. There may be more if you include derivatives of words. That includes 2.0736e+20 combinations, not considering the entropy introduced by spaces between words or punctuation marks. That's just to demonstrate the power of passphras…
If a site generates a password for the human it would result in a more even distribution of randomly-generated passphrases and reduce passphrase re-use across different sites. The human could then write it down or memorize it (or record it in their password manager, which defeats the purpose of using passwords entirely).
Passwords are mostly dead at this point, and more two-factor service providers need to pop up to prevent over-reliance on passwords. http://twofactorauth.org/
We should stop using the term "password" and start emphasizing pass phrases . A full sentence is much easier to remember, yet harder to crack, than a shorter, cryptic password. Or, as XKCD put it: http://xkcd.com/936/ There's a widespread misconception that words are always bad because of dictionary attacks, but that concern is moot if you use unique words or simply use a long sentence. A major advantage of sentences…
Why? Once you changed the word "password" to "passphrase", and get rid of those insane password requirements (must contains 1 upper case, 1 lower case, up to X length, 1 symbol, must not repeat same character twice or consecutively, etc), people start to use passphrase. But with enough attacks, you will build a passphrase table and people who use passphrase then will use the same passphrase on multiple sites which means it is the same as password and then site developers will come out and say "we will implement additional requirements - at least this length with these complexity".
A password which is 12 chars long and complex enough is hard to break. The problem is that people use the same password and credentials gets stolen every day. Can you trust random forums today running your password?
What a wonderful tool: http://www.getsafeonline.org/themes/passwrdcheck/results.htm... Password12345 is ranked 93% Exceptional!
Earlier quoted context omitted.
Using a password manager
Yes, even better. Can you recommend a password manager that works on all browsers/devices that you trust? I have not found that yet, so I use passphrases customized to the site. Edit: Also fundamentally it means that to access a single site from a compromised device, I'm potentially giving a nice list of all of my credentials.
1Password works on iOS, Android, and Mac (as confirmed by me) and they claim Windows, too. Browser-wise, I can confirm Chrome and Safari. That works for me, as it covers all of my use cases. YMMV, and it most certainly will if you're running Linux.
Downside: good $DEITY is it pricey by the time you cover all of your mobile devices and desktops. The amount of hassle it saves me probably pays for it, but covering all platforms at my house is bumping up against $100 (not including a couple of paid upgrades along the way).
Earlier quoted context omitted.
I completely agree, but too many websites put upper limits on the password length (which is completely idiotic) to be able to do this in practice.
Well, how would they fit the passwords in the database if there was no limit? =)