2 ms·
> 1. No password that was included in a breach a la the “haveibeenpwned” hash check system[0]. Now imagine that in some years every password below 20 character
by memco 5y ago
> 1. No password that was included in a breach a la the “haveibeenpwned” hash check system[0].
Now imagine that in some years every password below 20 characters has been in some breach on haveibeenpwned and now every user of every system needs a new password that is 21+ characters. Some period of time will occur wherein everyone will upgrade rinse and repeat.
> No requirements for special characters or not, just long well randomized passwords, or more aptly, passphrases.
I get your point, but these are incompatible thoughts: well-randomized requires certain levels of variation or it isn't well-randomized.
- kemotep 5y agoWell randomized as in not your daughter’s name and her birthday as a password. But I get what you mean. Diceware passwords can provide “sufficiently random” passphrases that, if the end user chooses, does not have to have any numbers or special characters. For the first part, yes at some point in the future, any password n-1 will be in the database. Getting users to get used to generating 20+ character strong passwords is a challenge today. Once we can solve that, through education, we can then move beyond passwords and single factor authentication.