3 ms·
Great idea. Another tool to enable dickhead sysadmins to enforce even more capricious password rules. Hint: the more rules enforced, the more predictable the p
by thanks_I_hateit 8y ago
Great idea. Another tool to enable dickhead sysadmins to enforce even more capricious password rules.
Hint: the more rules enforced, the more predictable the passwords become. Lazy people will find ways to be just as lazy, in a smaller password space. More passwords start to look the same.
- FRex 8y agoThese are not any rules. This haveibeenpwned list was made of password lists that were already leaked in hacks before and its author criticizes the 'now add a number', 'now add a symbol', 'now add a capital' rules that result in 'mypassword1_A'.
- Johnny555 8y agoThere's only one rule that should be needed - a long (24+ char) random string. With a long enough password, mixed case, punctuation, etc becomes less relevant.
- tomjen3 8y agoNobody can remember a random string that long -- which might be okay, if you assume (which I don't think is unreasonable) that it is written down or remembered by a password app.
- tylersmith 8y agoEverybody should be using a password manager. The times of it being reasonable to use garbage passwords because you want to remember them is long past.
- Spivak 8y agoWhat's the password for your local machine before you can launch the password manager? What's the password for the password manager? What do you do on a shared machine that doesn't have your password manager software installed? What's the password for the place where you could download your database on a new machine? Password requirements so complex humans can't remember them is just slang for DIY 2FA where the factors are a weak password and possession of your user's database. You might as well just require actual 2FA at that point and lax the requirements.