3 ms·
I personally like the Stanford policy[1]. It basically boils down to: the longer the password, the fewer restrictions. Each password needs to be at least 8 char
by mbreese 11y ago
I personally like the Stanford policy[1]. It basically boils down to: the longer the password, the fewer restrictions. Each password needs to be at least 8 characters, but if you only have 8 characters, you might need uppercase, lowercase, a symbol and a digit. If you have 12 characters, you only need upper/lower/digit. Once you hit 20 characters, you can have whatever you want.
I think that this is a good balance between security for short passwords, while still allowing ridiculously long ones (pass-phrases).
[1] http://arstechnica.com/security/2014/04/stanfords-password-policy-shuns-one-size-fits-all-security/ http://arstechnica.com/security/2014/04/stanfords-password-p...
- warfangle 11y agoAlmost like you're validating on entropy and not specific rules..........
- Dylan16807 11y agoThe concept is nice, but their numbers are horribly, unforgivably wrong. 8 random upper/lower/digit/symbol characters are equal to 9 random mixed-case letters. Not 16. Their cutoffs for different mixes are 8, 12, 16, 20. Realistic cutoffs would look more like 10, 11, 11, 14. Even worse, they encourage counting the individual letters in words. Never do that. Random words are only as good as two random characters.
- technion 11y ago$ dd if=/dev/urandom bs=32 count=1 | xxd -p That nearly every site on the Internet will refer to that output as "not strong enough" and instead suggest P@ssword1 as a better alternative definitely speaks to the issue.