4 ms·

I'm no expert, but I did take a CISSP course a while ago. One thing I actually remember ;P, is that it recommended long passwords in in lieu of the number, spec

I'm no expert, but I did take a CISSP course a while ago. One thing I actually remember ;P, is that it recommended long passwords in in lieu of the number, special character, upper, lower ... I don't remember the exact wording of course and maybe it did recommend some of that, but it talked about having a sentence rather than all that mess in 6-8 characters, but many sites still want the short mess that I never will actually remember

mcoliver 1y ago
entropy is stronger than complexity. https://xkcd.com/936/ https://xkcd.com/936/
- joseda-hg 1y ago
  I wonder how many people have used Correct Horse Battery Staple as a password thanks to this comic
  - D-Coder 1y ago
    Ah, just mix them up randomly: Staple Battery Correct Horse!
  - smj-edison 1y ago
    > Makes password "xkcd.com/936"
vlovich123 1y ago
While the password recommendation stuff is changing (the US government updating it guidelines last year), it’s generally best practice to not share passwords which itself implies using a password manager anyway which makes the whole “long passphrase” vs “complex” password moot - just generate 32 lowercase random characters to make it easier to type or use the autogenerated password your password manager recommends. The long passphrase is more for the key that unlocks your password manager rather than the random passwords you use day to day.
- kbolino 1y ago
  There's also login passwords, and depending on how many systems you have to log into, these can be quite numerous. There are some attempts to address this with smartcards and FIDO tokens and so on, but it's not nearly universal yet. At least SSH keys are common for remote login nowadays, but you still need to log into some computer directly first.
  - vlovich123 1y ago
    I find it rare to have a huge number of machines to log into that aren't hooked up to a centralized login server. Still, nothing prevents you from having passwords for each individual machine that needs it. It's cumbersome to type it in but it works, which is why I recommended all lowercase (faster to type on a mobile device).
  - smeg_it 1y ago
    Yeah, I've thought about a yubi key or something, but haven't pulled the trigger.
- smeg_it 1y ago
  I guess I'm weird, I use my browser, yet I haven't wanted to store that in the cloud, so it doesn't sync to my phone. Let me know if that's paranoia isn't justified. For me, if it becomes more universal, something like a yubi key that I can keep on my key-chain might work.

mcoliver 1y ago

entropy is stronger than complexity. https://xkcd.com/936/ https://xkcd.com/936/

joseda-hg 1y ago
I wonder how many people have used Correct Horse Battery Staple as a password thanks to this comic
- D-Coder 1y ago
  Ah, just mix them up randomly: Staple Battery Correct Horse!
- smj-edison 1y ago
  > Makes password "xkcd.com/936"

vlovich123 1y ago

While the password recommendation stuff is changing (the US government updating it guidelines last year), it’s generally best practice to not share passwords which itself implies using a password manager anyway which makes the whole “long passphrase” vs “complex” password moot - just generate 32 lowercase random characters to make it easier to type or use the autogenerated password your password manager recommends. The long passphrase is more for the key that unlocks your password manager rather than the random passwords you use day to day.

kbolino 1y ago
There's also login passwords, and depending on how many systems you have to log into, these can be quite numerous. There are some attempts to address this with smartcards and FIDO tokens and so on, but it's not nearly universal yet. At least SSH keys are common for remote login nowadays, but you still need to log into some computer directly first.
- vlovich123 1y ago
  I find it rare to have a huge number of machines to log into that aren't hooked up to a centralized login server. Still, nothing prevents you from having passwords for each individual machine that needs it. It's cumbersome to type it in but it works, which is why I recommended all lowercase (faster to type on a mobile device).
- smeg_it 1y ago
  Yeah, I've thought about a yubi key or something, but haven't pulled the trigger.
smeg_it 1y ago
I guess I'm weird, I use my browser, yet I haven't wanted to store that in the cloud, so it doesn't sync to my phone. Let me know if that's paranoia isn't justified. For me, if it becomes more universal, something like a yubi key that I can keep on my key-chain might work.