4 ms·

What if we started saying 'passphrase' instead of 'password' and made the minimum be 4 words and 18+ characters. It wouldn't be overwhelming to new users if th

by seats 14y ago

What if we started saying 'passphrase' instead of 'password' and made the minimum be 4 words and 18+ characters. It wouldn't be overwhelming to new users if they had examples of what a memorable passphrase is. You'd likely need to disallow specifically using the example passphrase but other than that, I'd be curious to see how well non-technical users respond to an interface asking them for a phrase.

rwallace 14y ago
We also need to get rid of the stupid habit of blanking out the password on the screen as it's typed, which imposes a time penalty exponential in the password length, or at least make it optional and disabled by default.
- FuzzyDunlop 14y ago
  Re: this. Just have an option to 'display password' on the field itself somewhere, like you get when entering your WiFi password, or passwords on your phone. Re: GP. Attackers would just switch to brute-forcing with common phrases. Song lyrics, expressions, etc. Then your passphrase rules will change to accommodate that, and be even more confusing. "The quick brown fox jumps over the lazy dog" and other long, memorable phrases, will be as insecure as "password123". http://arstechnica.com/business/2012/03/passphrases-only-marginally-more-secure-than-passwords-because-of-poor-choices/ http://arstechnica.com/business/2012/03/passphrases-only-mar...
  - seats 14y ago
    Really interesting article and absolutely a fair point, but from the article itself, pass phrases are still better. Just not a cure all. The title ("... only marginally better ...") does not match the body ("... vast improvement ...") >> The "30 bits of security" means the chances of a single guess cracking a four-word passphrase would be one in 230. What's more, the two-word phrases cracked in the study provided just 220.8 (or 20,656/0.0113) bits of security. Another way of expressing the same finding is that a dictionary of slightly less than 21,000 phrases is enough to guess the login credentials that slightly more than 1 percent of people in the real world will use. To be sure, that's a vast improvement over the security of normal passwords. Analyses of compromised passwords leaked onto the 'Net, including a corpus of 32 million plaintext codes dumped following the 2009 hack of online games provider RockYou, show that it's trivial to crack a sizable proportion of real-world codes. A dictionary of just two of the most common passwords—123456 and 12345 respectively—typically guess 1 percent of login credentials.

by seats 14y ago

rwallace 14y ago

We also need to get rid of the stupid habit of blanking out the password on the screen as it's typed, which imposes a time penalty exponential in the password length, or at least make it optional and disabled by default.

FuzzyDunlop 14y ago
Re: this. Just have an option to 'display password' on the field itself somewhere, like you get when entering your WiFi password, or passwords on your phone. Re: GP. Attackers would just switch to brute-forcing with common phrases. Song lyrics, expressions, etc. Then your passphrase rules will change to accommodate that, and be even more confusing. "The quick brown fox jumps over the lazy dog" and other long, memorable phrases, will be as insecure as "password123". http://arstechnica.com/business/2012/03/passphrases-only-marginally-more-secure-than-passwords-because-of-poor-choices/ http://arstechnica.com/business/2012/03/passphrases-only-mar...
- seats 14y ago
  Really interesting article and absolutely a fair point, but from the article itself, pass phrases are still better. Just not a cure all. The title ("... only marginally better ...") does not match the body ("... vast improvement ...") >> The "30 bits of security" means the chances of a single guess cracking a four-word passphrase would be one in 230. What's more, the two-word phrases cracked in the study provided just 220.8 (or 20,656/0.0113) bits of security. Another way of expressing the same finding is that a dictionary of slightly less than 21,000 phrases is enough to guess the login credentials that slightly more than 1 percent of people in the real world will use. To be sure, that's a vast improvement over the security of normal passwords. Analyses of compromised passwords leaked onto the 'Net, including a corpus of 32 million plaintext codes dumped following the 2009 hack of online games provider RockYou, show that it's trivial to crack a sizable proportion of real-world codes. A dictionary of just two of the most common passwords—123456 and 12345 respectively—typically guess 1 percent of login credentials.