3 ms·

The company I work for currently gave me my password, comprised of four space-separated words, on my first day. It has no expiry and can only be changed at req

The company I work for currently gave me my password, comprised of four space-separated words, on my first day. It has no expiry and can only be changed at request or if compromised. My only gripe with this approach is that my specific password is a bit awkward to type. I tend to pick passwords at least partly based on "keyboard feel" and it's annoying that there's one word that has a lot of repetition of colocated letters. Other than that it's a fantastic model and hugely preferred over routine password resets.

felipeccastro 3y ago
This seems an interesting approach, if sufficiently safe for most cases. What if, when creating an account and choosing a password, the app enforced very long passwords but suggested a default, random one like in your example? This would have most of the benefits of the suggestion in the article (high entropy) while still not removing the choice of the user to pick their own preferred password. Does your company also use 2FA? I'd be curious to see if very long passwords are secure enough to not need the 2FA anymore, as most methods are annoying to the user.
- KnobbleMcKnees 3y ago
  Yes, 2/3FA with a hardware key and push for login and access to anything security critical, and 2FA via push for everything else.
amelius 3y ago
> comprised of four space-separated words correct horse battery staple? https://www.explainxkcd.com/wiki/index.php/936:_Password_Strength https://www.explainxkcd.com/wiki/index.php/936:_Password_Str...
dredmorbius 3y ago
NB, the EFF's "diceware" passphrase generator method recommends six words for effective security: <https://www.eff.org/dice https://www.eff.org/dice> Note that if your attacker knows the dictionary used, the effective strength of a passphrase isn't based on its string length but on the number of individual words within the phrase. Six words gives an effective key strength of 2^77 bits.
- KnobbleMcKnees 3y ago
  We use six for anything related to an external system or third party (with multi factor where available), and these are password managed behind the same four word pass, plus multifactor. I'm assuming they stuck with four to make them memorable by actually humans. Even then I have my moments where I type in an adjective form instead of a noun for a particular word/variant.
  - dredmorbius 3y ago
    It's also possible to change effective strength by tweaking the dictionary size --- the total universe of words changes the effective strength of some combination, though lengthening the phrase has a bigger effect. Coming up with grammatical combinations (adjective noun verb adverb preposition article noun, say: "brown dog ran quickly past the barn") might create more memorisable patterns, though at a cost of key strength. Taking this to its logical conclusion, we'd have poetic stanzas of epic sagas randomly generated for mnemonic power utilising rhyme and meter....

felipeccastro 3y ago

This seems an interesting approach, if sufficiently safe for most cases. What if, when creating an account and choosing a password, the app enforced very long passwords but suggested a default, random one like in your example? This would have most of the benefits of the suggestion in the article (high entropy) while still not removing the choice of the user to pick their own preferred password. Does your company also use 2FA? I'd be curious to see if very long passwords are secure enough to not need the 2FA anymore, as most methods are annoying to the user.

KnobbleMcKnees 3y ago
Yes, 2/3FA with a hardware key and push for login and access to anything security critical, and 2FA via push for everything else.

amelius 3y ago

> comprised of four space-separated words correct horse battery staple? https://www.explainxkcd.com/wiki/index.php/936:_Password_Strength https://www.explainxkcd.com/wiki/index.php/936:_Password_Str...

dredmorbius 3y ago

NB, the EFF's "diceware" passphrase generator method recommends six words for effective security: <https://www.eff.org/dice https://www.eff.org/dice> Note that if your attacker knows the dictionary used, the effective strength of a passphrase isn't based on its string length but on the number of individual words within the phrase. Six words gives an effective key strength of 2^77 bits.

KnobbleMcKnees 3y ago
We use six for anything related to an external system or third party (with multi factor where available), and these are password managed behind the same four word pass, plus multifactor. I'm assuming they stuck with four to make them memorable by actually humans. Even then I have my moments where I type in an adjective form instead of a noun for a particular word/variant.
- dredmorbius 3y ago
  It's also possible to change effective strength by tweaking the dictionary size --- the total universe of words changes the effective strength of some combination, though lengthening the phrase has a bigger effect. Coming up with grammatical combinations (adjective noun verb adverb preposition article noun, say: "brown dog ran quickly past the barn") might create more memorisable patterns, though at a cost of key strength. Taking this to its logical conclusion, we'd have poetic stanzas of epic sagas randomly generated for mnemonic power utilising rhyme and meter....