3 ms·

Ask HN: Why are passwords still complicated in 2018?

I was reminded the other day of the classic XKCD comic on password strength: https://www.xkcd.com/936/ What struck me though is that this comic came out in 2011. That was seven years ago. In all that time I've never seen a website allow, enforce, or recommend phrases of the format recommended by the comic. I'm also taking a security course right now and the material also recommends longer phrase based passwords without special characters, numbers, or capitals. So my question is: What happened? What I don't understand is if everyone working in security is recommending this approach why does no one actually support it?

bradknowles 8y ago
The people who have implemented this solution have done so and moved on. We’ve combined it with password managers, so that we can have hundreds or thousands of totally unique passwords for all the various different things that require them. The next step is FIDO, and hardware that replaces even this process with something we hope is even more secure.