3 ms·

Here are two real world issues that could arise http://vbuterin.blogspot.ca/2011/08/password-strength-rebuttal-to.html http://vbuterin.blogspot.ca/2011/08/pass

by cantos 14y ago

Here are two real world issues that could arise http://vbuterin.blogspot.ca/2011/08/password-strength-rebuttal-to.html http://vbuterin.blogspot.ca/2011/08/password-strength-rebutt... I think some cryptographers and security people have given rebuttals as well but I can't find them at the moment.

kijin 14y ago
Interesting, but I think the author is focusing too much on the desktop experience. Try typing 'Tr0ub4dor&3' vs. 'correct horse battery staple' on a phone. Having to shift between alternate layouts every other character is not only annoying but also makes you prone to forget which character you were trying to type. With a full-size keyboard, on the other hand, you can rely on muscle memory to get it right without even thinking. As for shoulder surfing, I find it rather difficult to shoulder-surf someone who is typing on a glossy 4-inch screen, and you can always choose unusual words/spellings to throw off people who try to guess. Corrupt hearse buttery scalpels!
- cantos 14y ago
  I agree that it would be a better system for phones. I'm not sure about full size keyboards. Muscle memory will allow you to learn the password with only simple characters more quickly but eventually both will be learned. Then the only factor that matters is how accurately the user can type. I don't think muscle memory could ever get 100% accuracy for typing one character correctly. Anything less than 100% and longer passwords will be worse. If you type a key correctly 99.9% of the time then you will lose about twice as much of your time to wrong password entries with an 11 vs 20 char password.
blablabla123 14y ago
> Here are two real world issues that could arise Definitely true. On the other hand, non-tech folks often don't even make an attempt to remember password an put them on sticky notes in front of the screen. (At it can still get worse...) I think for these people long alphanumeric passwords are the best.

by cantos 14y ago

kijin 14y ago

Interesting, but I think the author is focusing too much on the desktop experience. Try typing 'Tr0ub4dor&3' vs. 'correct horse battery staple' on a phone. Having to shift between alternate layouts every other character is not only annoying but also makes you prone to forget which character you were trying to type. With a full-size keyboard, on the other hand, you can rely on muscle memory to get it right without even thinking. As for shoulder surfing, I find it rather difficult to shoulder-surf someone who is typing on a glossy 4-inch screen, and you can always choose unusual words/spellings to throw off people who try to guess. Corrupt hearse buttery scalpels!

cantos 14y ago
I agree that it would be a better system for phones. I'm not sure about full size keyboards. Muscle memory will allow you to learn the password with only simple characters more quickly but eventually both will be learned. Then the only factor that matters is how accurately the user can type. I don't think muscle memory could ever get 100% accuracy for typing one character correctly. Anything less than 100% and longer passwords will be worse. If you type a key correctly 99.9% of the time then you will lose about twice as much of your time to wrong password entries with an 11 vs 20 char password.

blablabla123 14y ago

> Here are two real world issues that could arise Definitely true. On the other hand, non-tech folks often don't even make an attempt to remember password an put them on sticky notes in front of the screen. (At it can still get worse...) I think for these people long alphanumeric passwords are the best.