4 ms·
5. Don't force password rotations. 6. Don't force me to use certain character classes if my password is long enough and therefore entropic enough without them.
by guitarbill 8y ago
5. Don't force password rotations.
6. Don't force me to use certain character classes if my password is long enough and therefore entropic enough without them. Special characters suck and are inconsistently supported.
- FabHK 8y agoYes and yes... How come huge institutions can't follow password best practices?
- kccqzy 8y agoAt work I once proposed a solution to address 6. Basically we want to accept either a short password with many different character classes, or a long one with just lower case (or something similar). We tried a prototype where we used zlib to compress the password and measure the compressed length as a proxy for its complexity. I really liked this solution but we didn't adopt it because it's literally unexplainable to normal users.
- adrianmonk 8y agoMy workaround for #6 is that basically all passwords are auto-generated to include A-Z, a-z, and 0-9. If this doesn't pass character class muster, then I manually append something like "-" to the end of the generated password. I've already got my entropy needs met in other ways, and "-" is special enough to be considered special, but not special enough to be unsupported. In other words, sorry for the pun, but I have special token that I use as a token special.