9 ms·
Yes, this same thing happens on the ship I work on in the summers. There are about 300 people, and about half have to reset their password when they come on boa
by nowarninglabel 16y ago
Yes, this same thing happens on the ship I work on in the summers. There are about 300 people, and about half have to reset their password when they come on board. There is the arbitrary 8 character, at least 1 #, at least 1 special character, at least 1 capital, can't match a dictionary word, and can't be close to the previous password. Also can't contain their name. Try explaining that to 150 people over and over again...it is so painful to watch some people try half a dozen, even a dozen times and still not get a password that will work, and then the vast majority will either write it down in a public place, share it, or forget it.
I'd based on the available data that could have just as much security, without all the user hassle, if we just require long passwords, no other requirement. Can you see how much easier it is to just say, your password has to be 16 characters or longer. Just think of a passphrase. For instance: IWa1kmydogonSaturdays
Easy to remember, and I would argue, though would want to try to provide some evidence, that this would be just as, if not more secure than 8 characters with ridiculous requirements.
- gjm11 16y ago> if we just require long passwords, no other requirement ... then I bet lots of users will choose passwords like "passwordpasswordpassword".
- trafficlight 16y agoI'd go with passwordpasswordpasswordpassword. Just to be safe.
- gcr 16y agoThe wise thing is to allow for and encourage the use of passphrases. Sentences are both easier to remember and harder to guess!
- joe24pack 16y agoand of course only an alliteratively poetic machinist would think to use "sublimeswarfswirlsslowly"
- nowarninglabel 16y agoPossibly, but I sure would like some data on this. Theoretically, I could try this out by getting approved from the CIO first and then just checking the hash vs the hash for passwordpasswordpassword and passwordpasswordpasswordpassword as well as any password in the top 100 from the previous leak that was > 16 characters (not sure if there are any). As said, I'd like some to get some real data as opposed to stipulations, but obviously it's hard to get this kind of data.
- Dove 16y ago> just require long passwords, no other requirement. I particularly liked the suggestion (elsewhere) to set passwords to a random combination of three dictionary words. It's hard to remember 7Gw$kW_ws, but I bet I could come up with a meaning for "dog shower flange".
- ErrantX 16y agoThat's not much better entropy on the password. It wouldn't take long to go through all three word combinations based on a normal english dictionary. With a password the key is always entropy. You can use all the smarts in the world to avoid the pre-computation attacks on your password... but never forget that brute force is not limited to character by character attack :)
- s-phi-nl 16y agohttp://www.baekdal.com/tips/password-security-usability http://www.baekdal.com/tips/password-security-usability says that it would take 2,537 years to crack a password with three common words, at a rate of 100 guesses per second, and flange isn't common. That's long enough for me.
- ErrantX 16y agoRight, so someone trying to brute force the password into the interface is limited by the speed of the program (or any artificial limits it should have built in :)). In fact, just one word with a couple of numbers has the same effect. Don't forget though, you are trusting this password to a site. If they are hacked, what then? Your 2K years turns into minutes or hours.
- kgo 16y agoThis guy picks that upper limit based on the idea that an attacker can't hit the webserver more than 100 times a minute, which makes me question how much he knows about crypto. He doesn't take into account someone who has access to the password hashes. So assume they've got something lame like SHA-1 hashes, even on commodity hardware you're talking about 100,000 hashes a second. Now you're at 2.5 years. Setup a simple cluster or buy some CPU cards, and you easily get into the three month range.
- cafard 16y agoEasy to remember, not so easy to type into a password box. Or maybe for you it is easy, but it wouldn't be for me.