3 ms·
I was presently surprised by the password requirements when I created a bugzilla account just the other day. - Password must be at least 12 characters long
by extraduder_ire 2y ago
I was presently surprised by the password requirements when I created a bugzilla account just the other day.
- Password must be at least 12 characters long.
- And the password must also contain either of the following:
- A phrase containing at least four unique words of three characters or longer
- or password contains at least 3 of the following qualities:
- uppercase letters
- lowercase letters
- numbers
- punctuation characters
- or more than 12 characters
I went with the phrase option.
- jorvi 2y agoI’ve seen minimums of 8 and 12, and maximums as low as 20. AgileBits obviously has done a lot more profiling, but it would be nice if they developed a universal password formula that was still memorable. So with words, “-“ separator (or maybe “.” separator?), maximum length 18, one whole word capitalized, random single digit at the end or beginning. That way you keep maximum entropy, keep it readable, whilst fitting within the rules of “all” sites. Although within 5-10 years I see passkeys having largely taken over, especially because mom and pop won’t be able to forget those, and they won’t be able to forget their fingerprint or face either.
- jszymborski 2y agoNot sure why people are re-inventing the wheel here. Just use zxcvbn[0] to determine password strength, and reject passwords if it falls below an unacceptable minimum. Because you can compute it client-side, you can give real-time feedback. [0] https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn