4 ms·
What is the desired requirements for passwords these days then? No passwords just a magic link or some open but difficult to hack standard (12+ characters?). I
by andy_ppp 9y ago
What is the desired requirements for passwords these days then? No passwords just a magic link or some open but difficult to hack standard (12+ characters?).
I’ve always liked the idea of using a predefined sentence structure and having lots of choices to increase entropy, e.g. The magic butterfly flapped faithfully. Article adjective noun verb adverb. No one does this of course.
- chrismorgan 9y agoIn Topicbox, we use emailed codes/magic links by default, but you can set a password and use that if you prefer (and if you want 2FA, you must use a password). We then use zxcvbn for password strength detection, denying weak passwords (those where it is estimated to take less than 10⁶ attempts to guess). I believe this is working well for us. In FastMail, it’s much the same but without emailed codes as an option, because it is your email account that you’re trying to log in to. I think we support almost arbitrary lengths and arbitrary Unicode in both now. (And note that due to how the fancier password hashing algorithms like bcrypt work, supporting beyond ~72 characters without loss of entropy actually tends to take deliberate design; and if you get it wrong, it can be a DoS vector—Django had such a problem a few years back, where you could feed it a 1MB password and keep it occupied hashing it for ages.) I have wondered before how secure a single astral plane Unicode code point would be as a password. I haven’t investigated the question at all.
- andy_ppp 9y agoThis is excellent advice and zxcvbn [1] looks awesome. [1] https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn