4 ms·
Why not just use real words with longer password instead? That'd be easier to type than these shorter "word-like" syllables
by eviks 2y ago
Why not just use real words with longer password instead? That'd be easier to type than these shorter "word-like" syllables
- bombcar 2y agoEven if horse-battery-staple works mathematically people don't trust that it's "really random". 1password supports it as "memorable password".
- eviks 2y agoWe know from user generated passwords that people trust even less random stuff just fine But you could always have an option for a different, more random-looking, style
- david422 2y agoHere's a format I really like: 3CatsHave12Legs! Easy to memorize, and pretty strong.
- rhaps0dy 2y agoHow many more passwords of this format can you construct? `have` is fixed, the `!` at the end is a classic, and the 12 number is pre-determined by true cats and the 3. So the only degrees of freedom you have are: - the entity number (3) - the kind of entity (Cats) - the kind of part (Legs) and that's not a huge number of combinations.
- bayindirh 2y ago"My4BikesHave9WheelsBecause1IsATricycle?" is a valid one for example?
- nothercastle 2y agoYou have to type that all in without error and the archaic app needs to actually support that many characters
- BobaFloutist 2y agoTyping that all in without error is considerably easier than typing TMJ0ltu*zif52Cb& in without error.
- bayindirh 2y agoI write longer passwords than that periodically. Archaic applications will get shorter variants. No two app will share the same password. All are no problems for me. With or without a password manager.
- Dilettante_ 2y agoThe question mark makes this look like it's the title of a new hit light novel
- mangodrunk 2y agoWhy mention memorizing passwords? Most people have dozens of passwords, and most people would have trouble memorizing even a simple word for dozens of passwords. I have a lot of trouble with those annoying security questions which one would assume would be constant and easy to answer.
- samatman 2y agoHave you not memorized the password to your password manager? How would that even work?
- gregjor 2y agoFaceID or YubiKey
- samatman 2y agoOk, but if there isn't a high-entropy sequence of "something you know" somewhere in the system, you've created some pretty bad failure modes. 1Password requires a master password periodically, but can otherwise be unlocked by AppleID (presumably also true for secure-element biometrics on other platforms). I maintain that a good secrets management system has a number of passwords which should be memorizable (and memorized) which is greater than zero. Possibly by only one element.
- gregjor 2y agoEvery password manager I know of, including Apple's, requires a strong password to unlock the vault. FaceID or YubiKey allow me to bypass typing that so often, but anyone trying to get into my accounts or password manager would have to know the strong password and get past the physical/biometric 2FA.
- mr_mitm 2y agoThe vast majority of passwords does not need to be easy to memorize because they should be stored in a password manager. In fact, I'd argue that the harder it is to memorize, the stronger the password. Yet they still need to be typed on cell phone keyboards, TVs, or communicated over phone (shared passwords are the best compromise if asymmetric cryptography is not an option), in which case you usually need to spell it out anyway.
- bombcar 2y agoCell phone keyboards should have a "QR code input" and then you could just use a QR code generated by your password manager dynamically.
- Bud 2y ago[dead]
- edweis 2y agoSeclist actually has a similar password "correct-horse-battery-staple" in one of their dictionary. curl https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Discovery/DNS/dns-Jhaddix.txt | grep "horse-battery-staple"
- zikduruqe 2y agoJust use the dictionary on your local machine. sort -R /usr/share/dict/words | head -n 4| sed 's/.\*/&/;$!s/$// ' |tr '\n' '-' |sed 's/-$/\n/' unsterilized-compoundedness-betrayer-pentathlon
- scoot 2y ago> Seclist actually has a similar password "correct-horse-battery-staple" in one of their dictionary. There's a well-known reason for that (and for GPs comment): https://xkcd.com/936/ https://xkcd.com/936/
- DuckConference 2y agoIn theory* having to type it is supposed to be a rare edge case.
- lemagedurage 2y agoWhen typing through a TV remote or console controller, shorter passwords might be preferred, especially if parts are still easily memorizable. Also, I think some website still have a relatively low upper limit for password length.
- wlesieutre 2y agoApple TV lets you use your phone to input passwords, so in Apple's ecosystem they wouldn't care about that. And being Apple, they wouldn't care about people needing to use anyone else's devices. Website length limits are a problem though, in the worst case there are websites that silently truncate your password so you don't even realize that the first 12 (or whatever) characters are the only part that matters. If your first 12 characters are two words with a dash in the middle, that could be a real vulnerability. Another benefit of passkeys is that it limits the ability of websites to do that kind of stupid shit.
- tssva 2y agoRoku, who has about 50% of the streaming device market in the US, supports entering passwords via their mobile apps. Having to enter a password on a streaming device is rare event for me at least. Almost all of the apps on my Roku support using an off device web browser to authenticate.
- jeffhuys 2y ago> Roku, who has about 50% of the streaming device market in the US Wow, really? That's surprising to me, do you have a link so I can see the rest of the stats?
- tssva 2y agohttps://www.coolest-gadgets.com/streaming-devices-statistics/ https://www.coolest-gadgets.com/streaming-devices-statistics...
- tzs 2y ago