4 ms·

Do password requirements even matter? I get having a minimum length, but many sites still require specific characters to be present.

pembrook 5y ago
Not really. Length is the most important thing, and forcing capitals and weird characters and numbers is much harder to remember than a 12 letter lowercase passphrase. Also 80% of users still don’t use a password manager, which means they’re probably using Password1! on every site.
- woutr_be 5y ago
  My company also enforces some pretty strict rules; no repeating combinations, or things like “1234” or “abcd”. I suspect most people now have to write down their passwords, making it less safe.
- doublerabbit 5y ago
  > Also 80% of users still don’t use a password manager, which means they’re probably using Password1! on every site. That's a random figure to preach, but okay. I refuse to use a password manager and nor is my password "Password1!". Each password is different for each system ranging from 7-9 characters. Do people really struggle to recall their passwords that they need a password manager?
  - woutr_be 5y ago
    > Do people really struggle to recall their passwords that they need a password manager? If you only use 2 or 3 systems, probably not. I recall the passwords for my desktop and work laptop easily, even though I change those every few months. But if we’re talking about passwords on each apps/website, then yes, yes I do struggle to recall those. Especially websites that don’t require me to log in every day, or websites I don’s use on a daily basis.
  - CJefferson 5y ago
    How many passwords do you have? Thinking of websites I accessed over the weeked, I have a couple of work accounts, a personal email, 3 social media sites and at least three sites where I buy things. That's 9 passwords for sites I use frequently, and there will be a couple of dozen more sites I don't use frequently. No way I can remember that many passwords.
    - doublerabbit 5y ago
      Interesting. I have around eight. Work laptop decryption password, Work Email, Work VPN, SSH Key Cert Password,Personal Email, HN, Reddit, bank card and then a generic password for other trash which I don't really care if gets leaked. The passwords contain special characters too. I can recall each one with no problem, no matter how long it's been. Only one password has a close match to any of the others.
      - CJefferson 5y ago
        I suppose if you don't have PayPal, Amazon, eBay, or any other online shop that would be ok -- but I wouldn't call any of those "trash", as they often remember my banking details, or at least have my purchase history + address, which I'd prefer not leaking.
  - Zachery 5y ago
    I have over 100 documented accounts between work, personal, and shared with my family. There is absolutely no way I am going to be able to manage all of those in my head forever. I can easily recall the passwords for these that I used frequently. But not the ones I don't use normally.

pembrook 5y ago

Not really. Length is the most important thing, and forcing capitals and weird characters and numbers is much harder to remember than a 12 letter lowercase passphrase. Also 80% of users still don’t use a password manager, which means they’re probably using Password1! on every site.

woutr_be 5y ago
My company also enforces some pretty strict rules; no repeating combinations, or things like “1234” or “abcd”. I suspect most people now have to write down their passwords, making it less safe.
doublerabbit 5y ago
> Also 80% of users still don’t use a password manager, which means they’re probably using Password1! on every site. That's a random figure to preach, but okay. I refuse to use a password manager and nor is my password "Password1!". Each password is different for each system ranging from 7-9 characters. Do people really struggle to recall their passwords that they need a password manager?
- woutr_be 5y ago
  > Do people really struggle to recall their passwords that they need a password manager? If you only use 2 or 3 systems, probably not. I recall the passwords for my desktop and work laptop easily, even though I change those every few months. But if we’re talking about passwords on each apps/website, then yes, yes I do struggle to recall those. Especially websites that don’t require me to log in every day, or websites I don’s use on a daily basis.
- CJefferson 5y ago
  How many passwords do you have? Thinking of websites I accessed over the weeked, I have a couple of work accounts, a personal email, 3 social media sites and at least three sites where I buy things. That's 9 passwords for sites I use frequently, and there will be a couple of dozen more sites I don't use frequently. No way I can remember that many passwords.
  - doublerabbit 5y ago
    Interesting. I have around eight. Work laptop decryption password, Work Email, Work VPN, SSH Key Cert Password,Personal Email, HN, Reddit, bank card and then a generic password for other trash which I don't really care if gets leaked. The passwords contain special characters too. I can recall each one with no problem, no matter how long it's been. Only one password has a close match to any of the others.
    - CJefferson 5y ago
      I suppose if you don't have PayPal, Amazon, eBay, or any other online shop that would be ok -- but I wouldn't call any of those "trash", as they often remember my banking details, or at least have my purchase history + address, which I'd prefer not leaking.
- Zachery 5y ago
  I have over 100 documented accounts between work, personal, and shared with my family. There is absolutely no way I am going to be able to manage all of those in my head forever. I can easily recall the passwords for these that I used frequently. But not the ones I don't use normally.