13 ms·
I'd argue that what passes for best practice (i.e., symbols, numbers, upper/lower case) is not best practice. As always, relevant xkcd: https://xkcd.com/936/ h
by ruytlm 9y ago
I'd argue that what passes for best practice (i.e., symbols, numbers, upper/lower case) is not best practice.
As always, relevant xkcd: https://xkcd.com/936/ https://xkcd.com/936/
For many services, I have a few 'default' words or phrases that I'll use as a base for the password to build up length, followed by a word or two that tie to the specific service; to make up an example, for Twitter it might be "extrawordsthensocialchirpynoise".
Of course then the symbol/number/upper/lower rules become a pain in the arse - unless you build them into the extra words: "3Xtraword$thensocialchirpynoise".
Though all that said, I can't actually remember what my HN password is...
- dredmorbius 9y agoI've been checking the xkcdpass utility (available on Debian). Generated 50 sets of 100,000,000 passwords each, comprised of six words (the default), then sorted these uniq, and counted the output lines. Any duplicates would result in fewer than 100,000,000 lines. All fifty trials had no dupes. Took most of a week to run that, on an older box :) Previously mentioned: https://news.ycombinator.com/item?id=14757672 https://news.ycombinator.com/item?id=14757672
- kalleboo 9y agoI'm not typing a 13 character phrase every 15 minutes when I unlock my phone. Before TouchID, I didn't even bother with a PIN since it was such a PITA to unlock