3 ms·
The worst bias is letting the users choose their passwords. They should use a generator such as [1]. The reason is that the "entropy" is not a characteristic of
by yoha 10y ago
The worst bias is letting the users choose their passwords. They should use a generator such as [1]. The reason is that the "entropy" is not a characteristic of a password but of the way it is generated. Computers are much better at entropy than humans.
[1] http://passwordcreator.org/ http://passwordcreator.org/
- zamalek 10y agoOr, better yet, a password manager. If you aren't using one yet, now is a great opportunity.
- yoha 10y agoI agree that password managers are great. They let you use completely different passwords for each service, efficiently mitigating any compromise. Also, they tend to encourage you to use actually random passwords (using a generator). However, most users will not bother, and getting them to use at least decent passwords would be a great step forward. Additionally, you still need a master password for your password manager.
- ben_jones 10y agoAlso you can't really rely on a free password manager (which is what users will generally select) to be a long-time solution. Either because they go out of business, change their monetization model, get hacked, whatever. It's one of those things that sounds good, but in reality is unable to gain critical mass for human reasons.
- Ntrails 10y agoWork sent around a stupid cardboard stand which was supposed to tell us all about being excellent at our work, and the checking processes required before sending anything to clients etc etc. We were changing domains at the same time, so my new password root is now based on the first three characters of the first 3 lines of the thing, which included some punctuation, then the standard numeral to increment every 90 days. My password was in plain sight for a couple months before I got around to binning it, which actually makes life a lot easier. Especially when you're not using it often enough for it to be muscle memory - which is the problem my parents face.
- yoha 10y agoHowever, such an approach corresponds to a few dozens bits of entropy at best (some for the approach, some for the length of text used, and a few for the numeral depending on whence it comes). As stated by zamalek, the trick to not memorizing many passwords is to use a password manager.
- wglb 10y agoWhat could possibly go wrong: This page was served over an insecure connection. It could have be forged or altered in transit. In red letters. There is a certain degree of trust that non-technical users are asked to do that should leave us with at least a mild level of discomfort.