4 ms·

> sites get downgraded if they don't require strong passwords Assuming "strong", as usual, means uses upper+lower letters, numbers, symbols, etc., this directl

> sites get downgraded if they don't require strong passwords Assuming "strong", as usual, means uses upper+lower letters, numbers, symbols, etc., this directly contradicts NIST's current password recommendations. They recommend enforcing a minimum length instead, and recommend a "minimum minimum" of 8. They also recommend checking passwords against a set of the most common ones from leaks. The NCSC's top 100k list is good (pre-filtering those under your minimum helps too--only 47k remain after removing pws under 8 chars): https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt https://github.com/danielmiessler/SecLists/blob/master/Passw...

France_is_bacon 5y ago
From my understanding, the only real way to create a password is to make it really, really long. Like, "Sometimes 10 people will get together on Friday night. Wow!" Or whatever you want. Makes it easy to remember. Personally I just usually string a bunch of random numbers and upper/lower/special characters - 40 of them. Just like this: https://www.youtube.com/watch?v=rERApU26PcA https://www.youtube.com/watch?v=rERApU26PcA
- slapfrog 5y ago
  I tried long memorable passphrases for a time, but a few of my passphrases were not as memorable as I expected and I ended up having to reset several of them. Eventually I got fed up with it and switched to an offline FOSS password manager and use generated passwords from that. To unlock the password manager, I use a single long passphrase that I am confident I can remember. Now I worry that I'm putting all my eggs in one basket, but at least my passwords won't be guessed or forgotten.
  - France_is_bacon 5y ago
    Right. I always make sure to write them all down, as I won't remember either. But they are to make sure that random hackers don't gain access. Nobody is really going to break into my office and steal my passwords, as I am not an international spy.
- bingidingi 5y ago
  i use song lyrics; nggyunglydngtaahy

France_is_bacon 5y ago

From my understanding, the only real way to create a password is to make it really, really long. Like, "Sometimes 10 people will get together on Friday night. Wow!" Or whatever you want. Makes it easy to remember. Personally I just usually string a bunch of random numbers and upper/lower/special characters - 40 of them. Just like this: https://www.youtube.com/watch?v=rERApU26PcA https://www.youtube.com/watch?v=rERApU26PcA

slapfrog 5y ago
I tried long memorable passphrases for a time, but a few of my passphrases were not as memorable as I expected and I ended up having to reset several of them. Eventually I got fed up with it and switched to an offline FOSS password manager and use generated passwords from that. To unlock the password manager, I use a single long passphrase that I am confident I can remember. Now I worry that I'm putting all my eggs in one basket, but at least my passwords won't be guessed or forgotten.
- France_is_bacon 5y ago
  Right. I always make sure to write them all down, as I won't remember either. But they are to make sure that random hackers don't gain access. Nobody is really going to break into my office and steal my passwords, as I am not an international spy.
bingidingi 5y ago
i use song lyrics; nggyunglydngtaahy