4 ms·

i hate this kind of pedantry. it just has to be better than what people currently use, which is stuff like password1, or 123456. yes, in an ideal world we would

i hate this kind of pedantry. it just has to be better than what people currently use, which is stuff like password1, or 123456. yes, in an ideal world we would all use password managers, but that hasn't happened yet, either.

strictnein 8y ago
Yep, exactly this. Perfect is the enemy of good. This is like the people who argue against your nontechnical relatives writing down their passwords. In reality, if they do that and have unique passwords for all their accounts, they're actually doing really well! The base comparison seems to be a mixed character password with a length of 14. That's far more complex than the vast majority of passwords out there, so the simple three word password would be significantly more "secure" than the average password used. Password managers are relatively easy to setup for technical people, but getting everything working on your home pc, tablet, and phone isn't a simple task for many people. The threat 99.999999% of us face isn't that someone will bruteforce our password using a Cray. The attack that is currently occurring against you and the people you know is credential stuffing, which simply targets password reuse.
PaulMoore 8y ago
I'm sorry, but that's nonsense if you actually think about it. Existing passwords are broken in a matter of milliseconds, perhaps a few seconds. Do you honestly believe it's sufficient consolation to an end-user to know it took 40 seconds instead? The end result is the same... they're breached. My point is simple. We already have FAR superior techniques in 2018 and wasting time advocating questionable techniques is an exercise in futility. The people who follow the advice are still at considerable risk, the majority will ignore it and remain almost as vulnerable.
- guitarbill 8y ago
  That's if they're encrypted in the first place. Avoiding re-use is far more important, as others have said in this thread. And humans are bad at remembering random combinations of letters and numbers, but ok at remembering words. If I could get my parents to use a password manager, I would. But until then, three words is better than re-use, and your pedantry still isn't helping the people who need it most, i.e. people lacking technical literacy in the first place.
  - PaulMoore 8y ago
    I'm guessing you mean hashed, or am I being pedantic? ;) Anything is better than re-use, that's not really an argument. If I recommended using "1", "2", "3" for three different sites, that's technically better than reusing the same password... but still not safe. Labelling it as pedantry really ignores the wider point. Having 3 unique passwords which take 40 seconds to break really isn't a great improvement, neither is it pedantic to point out that fact.

strictnein 8y ago

Yep, exactly this. Perfect is the enemy of good. This is like the people who argue against your nontechnical relatives writing down their passwords. In reality, if they do that and have unique passwords for all their accounts, they're actually doing really well! The base comparison seems to be a mixed character password with a length of 14. That's far more complex than the vast majority of passwords out there, so the simple three word password would be significantly more "secure" than the average password used. Password managers are relatively easy to setup for technical people, but getting everything working on your home pc, tablet, and phone isn't a simple task for many people. The threat 99.999999% of us face isn't that someone will bruteforce our password using a Cray. The attack that is currently occurring against you and the people you know is credential stuffing, which simply targets password reuse.

PaulMoore 8y ago

I'm sorry, but that's nonsense if you actually think about it. Existing passwords are broken in a matter of milliseconds, perhaps a few seconds. Do you honestly believe it's sufficient consolation to an end-user to know it took 40 seconds instead? The end result is the same... they're breached. My point is simple. We already have FAR superior techniques in 2018 and wasting time advocating questionable techniques is an exercise in futility. The people who follow the advice are still at considerable risk, the majority will ignore it and remain almost as vulnerable.

guitarbill 8y ago
That's if they're encrypted in the first place. Avoiding re-use is far more important, as others have said in this thread. And humans are bad at remembering random combinations of letters and numbers, but ok at remembering words. If I could get my parents to use a password manager, I would. But until then, three words is better than re-use, and your pedantry still isn't helping the people who need it most, i.e. people lacking technical literacy in the first place.
- PaulMoore 8y ago
  I'm guessing you mean hashed, or am I being pedantic? ;) Anything is better than re-use, that's not really an argument. If I recommended using "1", "2", "3" for three different sites, that's technically better than reusing the same password... but still not safe. Labelling it as pedantry really ignores the wider point. Having 3 unique passwords which take 40 seconds to break really isn't a great improvement, neither is it pedantic to point out that fact.