5 ms·

> Researchers have increasingly come to the consensus that the best passwords are at least 11 characters long, randomly generated, and made up of upper- and low

> Researchers have increasingly come to the consensus that the best passwords are at least 11 characters long, randomly generated, and made up of upper- and lower-case letters, symbols (such as a %, *, or >), and numbers. Those traits make them especially hard for most people to remember Sounds pretty wrong to me. I think when they say "the best passwords" they mean the hardest to crack. But a password that you need to remember that's hard to remember is not a good password. It doesn't take much research to understand that passphrases are the best kind of password. 4 random words (if throttled, 5-6 if not eg for local encryption). It's a bit silly to me for this article to imply these people are spending years researching passwords, and this is what they come up with. We need to switch to client side certs already. Passwords for websites are obsolete.

lostcolony 6y ago
I mean...passphrases, plus a little noise thrown in, make sense for logging into a password manager. After that, the advice sounds pretty correct to me.
- billytetrud 6y ago
  If you're using a password manager, shouldn't you just have it generate a random strong password you don't expect to remember? If you're remembering it, it's really best to not use noise, just plain correctly spelled lower case words. Adding an additional word adds both more security and is easier to remember than adding an ampersand somewhere in your password
  - lostcolony 6y ago
    What it generates you have control of. So you can say "I want uppercase, lowercase, numbers, characters, of length X". So the guidelines are still relevant. The only thing you should remember is the password into your password manager, and if you want to add more words, by all means; I just find it quicker to type, no harder to remember, while making a dictionary attack unfeasible, by adding a character or two to the passphrase. I.e., "correct!horsebattery,staple" (though I agree that at four words you're fine anyway; I'm just saying that with a little noise thrown in I can type two or three words, plus a couple standalone, easy to remember characters for the same level of complexity)
    - billytetrud 6y ago
      Fair enough

lostcolony 6y ago

I mean...passphrases, plus a little noise thrown in, make sense for logging into a password manager. After that, the advice sounds pretty correct to me.

billytetrud 6y ago
If you're using a password manager, shouldn't you just have it generate a random strong password you don't expect to remember? If you're remembering it, it's really best to not use noise, just plain correctly spelled lower case words. Adding an additional word adds both more security and is easier to remember than adding an ampersand somewhere in your password
- lostcolony 6y ago
  What it generates you have control of. So you can say "I want uppercase, lowercase, numbers, characters, of length X". So the guidelines are still relevant. The only thing you should remember is the password into your password manager, and if you want to add more words, by all means; I just find it quicker to type, no harder to remember, while making a dictionary attack unfeasible, by adding a character or two to the passphrase. I.e., "correct!horsebattery,staple" (though I agree that at four words you're fine anyway; I'm just saying that with a little noise thrown in I can type two or three words, plus a couple standalone, easy to remember characters for the same level of complexity)
  - billytetrud 6y ago
    Fair enough