4 ms·
That's definitely true, though you can simplify matters by saying "I'm always going to try to have passwords that are safe against offline attacks".
by hyperpape 8y ago
That's definitely true, though you can simplify matters by saying "I'm always going to try to have passwords that are safe against offline attacks".
- acdha 8y agoI would ask what’s the cost benefit ratio for defending against offline attacks with increasingly unpleasant password requirements versus things like increased KDF rounds, general server security improvements, and the defense in depth measures which increase the costs of actually profiting from a user account compromise. I think we’ve historically been shaped by classic Unix crypt() memories where something couldn’t easily be fixed without breaking compatibility even though that era is largely in the past.
- hyperpape 8y agoI see how this wasn’t obvious, but I never actually said anyone should implement any particular password requirements, just that certain requirements might not increase entropy as much as you might think. My above comment about offline attacks was my personal stance/ideal: I use a password manager for just about everything, not something I’d mandate. As a developer, in many contexts I might implement min 8 chars with no special char requirements. I think the bad password check is also a good idea.