4 ms·
> Experiments have shown that users do not choose a new independent password; rather, they choose an update of the old one. Such experiments clearly do not int
by solatic 6y ago
> Experiments have shown that users do not choose a new independent password; rather, they choose an update of the old one.
Such experiments clearly do not introduce the use of password managers which promote the generation of long passwords with high entropy.
Specifically in the case of master login passwords, where the usage of a password manager isn't feasible (like Active Directory and Windows logins), this may be the case. And it still requires that the domain forbid PIN/biometric logins and thus result in people complaining about entering long passwords with entropy each time.
- teekert 6y agoIf only I could use my pw manager at the windows login prompt.
- jackson1442 6y agoExactly. My university requires a yearly password update. I have to manually enter my password to log into computers, print release stations, a billion domains that just use an LDAP connector instead of our Shibboleth page, servers after home directory wipes, etc. My password needs to be something I can quickly type, so I just use the same one (a strong, multiple-word passphrase) and add its validity period to the end. This actually makes hitting arbitrary password requirements easy too; make one word capitalized (or one lowercased), separate each with an allowed symbol, and the validity period is numeric so it passes just about every security check while being easy to type and remember.
- syntheticnature 6y agoIndeed, my work login password, with regular rotation requirements, has been dropping entropy by a few bits each time it comes up for renewal. I work to make my work passwords as different as I can, but that password doesn't get used enough for me to trivially remember it, and it can't be offloaded to a password manager easily.
- cyberpunk 6y agoI store a 32 char random string on a yubikey and have it setup so a “long press” on it enters it, works pretty well...
- Godel_unicode 6y agoI'm curious why you use this and not the Windows integration with yubikey? https://www.yubico.com/products/computer-login-tools/ https://www.yubico.com/products/computer-login-tools/
- cyberpunk 6y agoI'm on a Mac and couldn't be arsed setting it up properly ;) It's fairly easy to put a static OTP on two keys incase I lose one also instead of trying to register two with the OS. Also I can use it for various other things (like password manager secret etc) which don't support yubis out of the box.
- Larrikin 6y ago1password syncs to your phone. I can count on one hand the number of passwords I actually have memorized
- benhurmarcel 6y agoI use 1password for everything, but I need to type my professional Windows password every time I log in, I'm not copying a password from my phone every time I come back from the bathroom.
- kevin_thibedeau 6y agoThey've allowed third party fingerprint scanners to handle login so the APIs are there to do it.
- michaelcampbell 6y agoIndeed. I use a passphrase, or a series of typeable but random words in the 'correcthorsebatterystaple' vein for that.
- iso1631 6y agoI used my PW generated password on a site earlier, the site refused to accept it. 2^102 bit aren't enough (18 from 52 random upper/lower characters) aren't accepted, but P@55word was fine.
- andromeduck 6y agoPassword must between 6-12 characters... rips hair out
- ben0x539 6y agoThis is _specifically_ the one place where we require a rotating password too, so I think those experiments are informative.