3 ms·

No doubt some self-proclaimed "security expert" did it long ago and it got picked up by a few places and the rest is history. There are many such anti-patterns

by satysin 10y ago

No doubt some self-proclaimed "security expert" did it long ago and it got picked up by a few places and the rest is history. There are many such anti-patterns around like requiring "complex" passwords with upper, lower, special, etc. characters yet do not work with >16 characters. Something that pisses me off to no end is Microsoft not allowing spaces in their passwords for some unknown reason. If it were up to me I would have one limit to passwords, length. A minimum of 12 characters. Sure you will get some moron using aaaaaaaaaaaa but they are the kind of people who will find a way to use an idiotic password no matter what. The reality is passwords need to die. We should be encouraging pass-phrases.

quaunaut 10y ago
Using newer cracking techniques[1], pass-phrases are as quick to crack as many others. I honestly think password managers should not exist without the ability to randomly generate new passwords. 1. https://hashcat.net/oclhashcat/ https://hashcat.net/oclhashcat/
- satysin 10y ago
  For sure in an ideal world all users would have a password manager that generates 60+ character long passwords that are unique to every service but sadly that probably won't happen for a long time.
  - imtringued 10y ago
    In an ideal world we wouldn't have blackhat hackers. A more practical solution is to simply generate a public/private key pair on registration.
- DanBC 10y ago
  oclhashcat is weak against a properly chosen 7 word diceware phrase.
- Someone1234 10y ago
  That is why, with a pass phrase, the number of WORDS should be equal to the number of LETTERS in a random alphanumeric password. So if the password rule is 8 truly random characters, you should be aiming for 8 words in your pass phrase password. This is an easy rule to remember and to teach people. The actual explanation for this is a little complex and includes things like the average person's vocabulary, known sentence structure inc. transition words, language itself, and enigma cracking techniques. The biggest criticism phrase based passwords receive is that people go from an 8 character random password to a three word phrase-based password and then act like they've improved security because it contains more characters. Phrase based passwords can be secure with a little bit of education, even against the best available crackers.
- herbst 10y ago
  I was honestly surprised when i touched that software again after many years and more than one major hardware upgrade. 7 Chars WPA2 would be cracked within a few seconds, 8 chars takes like 10 minutes or a little more. And i dont even own a really good graphic card.
rectang 10y ago
> The reality is passwords need to die. For a different approach, consider the distributed trust authorities of Apache Milagro (incubating): http://milagro.incubator.apache.org/ http://milagro.incubator.apache.org/

by satysin 10y ago

quaunaut 10y ago

Using newer cracking techniques[1], pass-phrases are as quick to crack as many others. I honestly think password managers should not exist without the ability to randomly generate new passwords. 1. https://hashcat.net/oclhashcat/ https://hashcat.net/oclhashcat/

satysin 10y ago
For sure in an ideal world all users would have a password manager that generates 60+ character long passwords that are unique to every service but sadly that probably won't happen for a long time.
- imtringued 10y ago
  In an ideal world we wouldn't have blackhat hackers. A more practical solution is to simply generate a public/private key pair on registration.
DanBC 10y ago
oclhashcat is weak against a properly chosen 7 word diceware phrase.
Someone1234 10y ago
That is why, with a pass phrase, the number of WORDS should be equal to the number of LETTERS in a random alphanumeric password. So if the password rule is 8 truly random characters, you should be aiming for 8 words in your pass phrase password. This is an easy rule to remember and to teach people. The actual explanation for this is a little complex and includes things like the average person's vocabulary, known sentence structure inc. transition words, language itself, and enigma cracking techniques. The biggest criticism phrase based passwords receive is that people go from an 8 character random password to a three word phrase-based password and then act like they've improved security because it contains more characters. Phrase based passwords can be secure with a little bit of education, even against the best available crackers.
herbst 10y ago
I was honestly surprised when i touched that software again after many years and more than one major hardware upgrade. 7 Chars WPA2 would be cracked within a few seconds, 8 chars takes like 10 minutes or a little more. And i dont even own a really good graphic card.

rectang 10y ago

> The reality is passwords need to die. For a different approach, consider the distributed trust authorities of Apache Milagro (incubating): http://milagro.incubator.apache.org/ http://milagro.incubator.apache.org/