5 ms·

Title: your password doesn’t matter Content: your password matters very much What?? My takeaway is that your password matters quite a lot, you need to use a

Title: your password doesn’t matter Content: your password matters very much What?? My takeaway is that your password matters quite a lot, you need to use a password manager to generate strong, unique passwords, and turn on MFA everywhere you can. Not “your passwords don’t matter”

brianoconnor 6y ago
Check out the table. I believe the bottom line is, that length and symbols and all those restrictions don't add any security because the relevant threats are not password probing.
- auslegung 6y ago
  I did look at the table, and the very first row, credential stuffing, requires that your password be non unique. So your password matters.
  - robomc 6y ago
    yeah I think the point is that, a typical password validation policy wont be able to spot that risk. although one that cycled passwords regularly would presumably do the trick.
    - closeparen 6y ago
      Wonder if anyone has ever written password validation to attempt credential stuffing on a few popular websites and reject the password if it works.
      - WorldMaker 6y ago
        Pwned Passwords is a most common password (hashes) database compiled from years of breach data: http://haveibeenpwned.com/Passwords http://haveibeenpwned.com/Passwords Though the takeaway in the article is that you really only need to check Top X and Top X may be as low as 10 assuming other mitigations are in place.
    - WorldMaker 6y ago
      Password cycling studies show that it generally weakens passwords and only increases the likelihood that fallible human beings recycle the same (variations of) passwords across multiple services. About all this article shows that is the only "complexity" test that matters is that a password shouldn't be in the Top X most used passwords, and X may be as low as 10 (much less the thousands you can easily check with Pwned Passwords) if you are attempting (distributed) password spray detection in your login systems, MFA, etc.
xavierlint 6y ago
Found: > Your password doesn’t matter except for password spray (avoid the top guessed passwords with a dictionary checker of some kind) or brute force (use more than 8 characters, or use a password manager if you are really nervous). That’s not to say your password isn’t terrible. It’s definitely terrible, given the likelihood that it gets guessed, intercepted, phished, or re-used. At the bottom of the article.
multidim 6y ago
To be charitable to the article: people who are not security-minded often make password decisions that "don't matter". You advise your grandpa to do better than "password" and he might move to "Password1!". You advise him to not reuse passwords...and that's really hard without a password manager, so he reuses passwords. But yeah, your password choices very much matter and those choices can foil {credential stuffing, password spray, brute force}, which is admitted but downplayed in the article. Considering that most people reading the article will be security-minded, a far better title would have been "Your Users' Password Choices Often Don't Matter".

brianoconnor 6y ago

Check out the table. I believe the bottom line is, that length and symbols and all those restrictions don't add any security because the relevant threats are not password probing.

auslegung 6y ago
I did look at the table, and the very first row, credential stuffing, requires that your password be non unique. So your password matters.
- robomc 6y ago
  yeah I think the point is that, a typical password validation policy wont be able to spot that risk. although one that cycled passwords regularly would presumably do the trick.
  - closeparen 6y ago
    Wonder if anyone has ever written password validation to attempt credential stuffing on a few popular websites and reject the password if it works.
    - WorldMaker 6y ago
      Pwned Passwords is a most common password (hashes) database compiled from years of breach data: http://haveibeenpwned.com/Passwords http://haveibeenpwned.com/Passwords Though the takeaway in the article is that you really only need to check Top X and Top X may be as low as 10 assuming other mitigations are in place.
  - WorldMaker 6y ago
    Password cycling studies show that it generally weakens passwords and only increases the likelihood that fallible human beings recycle the same (variations of) passwords across multiple services. About all this article shows that is the only "complexity" test that matters is that a password shouldn't be in the Top X most used passwords, and X may be as low as 10 (much less the thousands you can easily check with Pwned Passwords) if you are attempting (distributed) password spray detection in your login systems, MFA, etc.

xavierlint 6y ago

Found: > Your password doesn’t matter except for password spray (avoid the top guessed passwords with a dictionary checker of some kind) or brute force (use more than 8 characters, or use a password manager if you are really nervous). That’s not to say your password isn’t terrible. It’s definitely terrible, given the likelihood that it gets guessed, intercepted, phished, or re-used. At the bottom of the article.

multidim 6y ago

To be charitable to the article: people who are not security-minded often make password decisions that "don't matter". You advise your grandpa to do better than "password" and he might move to "Password1!". You advise him to not reuse passwords...and that's really hard without a password manager, so he reuses passwords. But yeah, your password choices very much matter and those choices can foil {credential stuffing, password spray, brute force}, which is admitted but downplayed in the article. Considering that most people reading the article will be security-minded, a far better title would have been "Your Users' Password Choices Often Don't Matter".