5 ms·

Because the ONLY requirement should really be > 8 (or more) characters. Any other requirement will generally lead to users creating passwords with predictable p

Because the ONLY requirement should really be > 8 (or more) characters. Any other requirement will generally lead to users creating passwords with predictable patterns. https://www.ncsc.gov.uk/guidance/password-guidance-simplifying-your-approach https://www.ncsc.gov.uk/guidance/password-guidance-simplifyi... "Traditionally, organisations impose rules on the length and complexity of passwords. However, people then tend to use predictable strategies to generate passwords, so the security benefit is marginal while the user burden is high." Edit: Adding NIST guidelines too, which say the same https://nakedsecurity.sophos.com/2016/08/18/nists-new-password-rules-what-you-need-to-know/ https://nakedsecurity.sophos.com/2016/08/18/nists-new-passwo...

reustle 9y ago
But, he's not advocating for more password requirements.
- snowwolf 9y ago
  I know. I'm commenting more on the state of the industry where password complexity requirements are still a thing despite expert consensus that they make things worse.
proaralyst 9y ago
I'd add 'not in the 10,000 most common passwords' to that requirement.
Scirra_Tom 9y ago
A password not in a common password list should probably be another imo.
Asdfbla 9y ago
I'm curious how far practical implementations of the NIST guidelines take the advice to preempt dictionary attacks by not letting users choose known bad choices. Of course the advice is perfectly reasonable, but when a user can't choose 'password', they will probably try 'password1' - not really much safer against the usual password cracking software, do you check that too then? But I guess the article mentions that dilemma too. I guess it's again a tradeoff between not annoying the user and annoying the password cracker sufficiently. :)
- proaralyst 9y ago
  password1 and reasonable mutations of password are probably present in the top 10000 passwords. If that's not the case in general, a good benchmark would be 'can hashcat break this given a reasonable mutation pattern'. The zxcvbn project pretty much provides that.

reustle 9y ago

But, he's not advocating for more password requirements.

snowwolf 9y ago
I know. I'm commenting more on the state of the industry where password complexity requirements are still a thing despite expert consensus that they make things worse.

proaralyst 9y ago

I'd add 'not in the 10,000 most common passwords' to that requirement.

Scirra_Tom 9y ago

A password not in a common password list should probably be another imo.

Asdfbla 9y ago

I'm curious how far practical implementations of the NIST guidelines take the advice to preempt dictionary attacks by not letting users choose known bad choices. Of course the advice is perfectly reasonable, but when a user can't choose 'password', they will probably try 'password1' - not really much safer against the usual password cracking software, do you check that too then? But I guess the article mentions that dilemma too. I guess it's again a tradeoff between not annoying the user and annoying the password cracker sufficiently. :)

proaralyst 9y ago
password1 and reasonable mutations of password are probably present in the top 10000 passwords. If that's not the case in general, a good benchmark would be 'can hashcat break this given a reasonable mutation pattern'. The zxcvbn project pretty much provides that.