6 ms·

Her password advice is literally the opposite of the classic https://xkcd.com/936/ https://xkcd.com/936/.

by _cairn 10y ago

magic_beans 10y ago
Whom should I trust?
- _cairn 10y ago
  Well, I am not very well informed on this topic, however, I tend to believe that the math checks out in the "correct horse" principle. This is a vast oversimplification, but basically longer passwords are better - the brute force complexity of additional length is in the exponent, the character diversity (special chars/numbers/upper+lower case) is in the base. Therefore, make your passwords as long (and randomly chosen - i.e. selection method should not be easy to guess!) as you possibly can.
cdubzzz 10y ago
There has been lots of discussion surrounding that comic. I have read a few articles over time and ultimately landed, one way or another, on considering it bad advice. Here is some info from a quick search: https://security.stackexchange.com/questions/6095/xkcd-936-short-complex-password-or-long-dictionary-passphrase https://security.stackexchange.com/questions/6095/xkcd-936-s...
- _cairn 10y ago
  Cool thanks for the link! Were you meaning to say that you consider the "correct horse" password selection principles bad advice? Or that the advice given by the author of the article is bad advice?
  - cdubzzz 10y ago
    I feel the "correct horse" method is bad advice. Though, certainly not terrible. I actually followed it for a while and it works amazingly well for memory, but over time I was convinced that the best route is a password manager with randomly generated passwords.
    - _cairn 10y ago
      I agree, I think a manager with randomly generated (and long) passwords is the way to go in terms of security + ease of use sweet spot. edit: in addition to 2FA/yubikey type measures.
    - Symbiote 10y ago
      That doesn't make it bad advice. The comic advises using correct-horse style passwords rather than tr0ubaDour-style. That is good advice.
    - DanBC 10y ago
      What do you use to unlock your password manager? A 7 word diceware passphrase would be a good idea.

Her password advice is literally the opposite of the classic https://xkcd.com/936/ https://xkcd.com/936/.

by _cairn 10y ago

Her password advice is literally the opposite of the classic https://xkcd.com/936/ https://xkcd.com/936/.

magic_beans 10y ago

Whom should I trust?

_cairn 10y ago
Well, I am not very well informed on this topic, however, I tend to believe that the math checks out in the "correct horse" principle. This is a vast oversimplification, but basically longer passwords are better - the brute force complexity of additional length is in the exponent, the character diversity (special chars/numbers/upper+lower case) is in the base. Therefore, make your passwords as long (and randomly chosen - i.e. selection method should not be easy to guess!) as you possibly can.

cdubzzz 10y ago

There has been lots of discussion surrounding that comic. I have read a few articles over time and ultimately landed, one way or another, on considering it bad advice. Here is some info from a quick search: https://security.stackexchange.com/questions/6095/xkcd-936-short-complex-password-or-long-dictionary-passphrase https://security.stackexchange.com/questions/6095/xkcd-936-s...

_cairn 10y ago
Cool thanks for the link! Were you meaning to say that you consider the "correct horse" password selection principles bad advice? Or that the advice given by the author of the article is bad advice?
- cdubzzz 10y ago
  I feel the "correct horse" method is bad advice. Though, certainly not terrible. I actually followed it for a while and it works amazingly well for memory, but over time I was convinced that the best route is a password manager with randomly generated passwords.
  - _cairn 10y ago
    I agree, I think a manager with randomly generated (and long) passwords is the way to go in terms of security + ease of use sweet spot. edit: in addition to 2FA/yubikey type measures.
  - Symbiote 10y ago
    That doesn't make it bad advice. The comic advises using correct-horse style passwords rather than tr0ubaDour-style. That is good advice.
  - DanBC 10y ago
    What do you use to unlock your password manager? A 7 word diceware passphrase would be a good idea.