3 ms·
There's only one rule that should be needed - a long (24+ char) random string. With a long enough password, mixed case, punctuation, etc becomes less relevant.
by Johnny555 8y ago
There's only one rule that should be needed - a long (24+ char) random string. With a long enough password, mixed case, punctuation, etc becomes less relevant.
- tomjen3 8y agoNobody can remember a random string that long -- which might be okay, if you assume (which I don't think is unreasonable) that it is written down or remembered by a password app.
- tylersmith 8y agoEverybody should be using a password manager. The times of it being reasonable to use garbage passwords because you want to remember them is long past.
- Spivak 8y agoWhat's the password for your local machine before you can launch the password manager? What's the password for the password manager? What do you do on a shared machine that doesn't have your password manager software installed? What's the password for the place where you could download your database on a new machine? Password requirements so complex humans can't remember them is just slang for DIY 2FA where the factors are a weak password and possession of your user's database. You might as well just require actual 2FA at that point and lax the requirements.