5 ms·

Use a two-factor auth plugin like https://wordpress.org/extend/plugins/google-authenticator/ https://wordpress.org/extend/plugins/google-authenticator/ It works

Use a two-factor auth plugin like https://wordpress.org/extend/plugins/google-authenticator/ https://wordpress.org/extend/plugins/google-authenticator/ It works with the Google Authenticator app. Duo Security is also good: http://wordpress.org/extend/plugins/duo-wordpress/ http://wordpress.org/extend/plugins/duo-wordpress/ The WordPress.com team have already announced two-factor auth support for wp.com blogs, and are working on an official solution for wp.org sites: http://macmanx.com/2013/04/12/two-step-authentication-on-wordpress-com/ http://macmanx.com/2013/04/12/two-step-authentication-on-wor...

GabrielF00 14y ago
One problem is that WordPrss sites are often built by small web designers for clients with limited computer skills and very little patience for complex passwords, much less two-factor authentication. For 2/3 of the WordPress sites I administer, I use a very long, complex admin password. The other site is for a group that wanted multiple admin accounts, but the people who use these accounts have a lot of trouble with complex passwords. After several emails telling me that "the website doesn't work" because the user had trouble with a long password with special characters, I gave up and switched it to an easy-to-remember password with just uppercase and lowercase letters.
- didip 14y ago
  I try to educate using [XKCD style password](http://xkcd.com/936/ http://xkcd.com/936/) to mainstream people. So far, they seemed to get it.
NuZZ 14y ago
Or just generate random 15+ character passwords for admin accounts. From the article it appears the concern is from brute forcing "admin" account passwords. Good luck bruting MT#r!}A1(hIQ4^pC*7`K.KGiL\&[A\k#TUC4R<R?
- WA 14y ago
  Good luck typing that without a password manager ;)
  - johnpowell 14y ago
    I just use a text file on my computers desktop and a usb thumb drive. I don't note what the password is for. So my Amazon password is something like dkwjRw#4camzR4%7hjfgdelsdshWE
    - WA 14y ago
      And how do you solve that if you want to log in to amazon form your computer and from your mobile phone?
  - NuZZ 14y ago
    I dont think it's practical to rely on memory for passwords anymore. If it's a site you really couldnt give a damn about, then sure, as long as you're okay with whatever information you submit being potentially linked to that password and to any other information.
yaix 14y ago
Simply use five random dictionary words as a password and you are fine. The browser will store then the password easy login. Two-facor auth just adds to complexity, and that is a bad thing when it comes to secutiry. You want to be able to easily understand that a system is secure. The more complex a system is, the larger the likelyhood of a surprise "whoops, I overlooked that" somewhere down the road.
- ra 14y ago
  Or any slightly obscure memorable phrase. e.g. mycatmiffylikesbiscuits or tallspeakerswithoutafaceplaterattle or emptyhandlebeerglasshasfoam ...
  - ZoFreX 14y ago
    No. The key word in the comment you replied to was "random". "mycatmiffylikesbiscuits" is a pretty terrible password.
    - danenania 14y ago
      How so? Assuming about 100,000 common words in the English language, with a five word phrase aren't you talking about 10000000000000000000000000 combinations for a dictionary attack to churn through? Even if you narrow it down to phrases that make grammatical sense (which certainly isn't a trivial thing to do algorithmically), you're still talking pretty astronomical numbers, and that doesn't account for the large increase in the corpus that would be needed for an attack that could include a name like "miffy" in its attempts.
      - chii 14y ago
        But if the attacker knew with good probability that your passphrase is a valid sentence, they'd have ways to eliminate incorrect sentences, and so reduce the search space a bit (or a bit more, depending on how clever they are).
      - ZoFreX 14y ago

GabrielF00 14y ago

One problem is that WordPrss sites are often built by small web designers for clients with limited computer skills and very little patience for complex passwords, much less two-factor authentication. For 2/3 of the WordPress sites I administer, I use a very long, complex admin password. The other site is for a group that wanted multiple admin accounts, but the people who use these accounts have a lot of trouble with complex passwords. After several emails telling me that "the website doesn't work" because the user had trouble with a long password with special characters, I gave up and switched it to an easy-to-remember password with just uppercase and lowercase letters.

didip 14y ago
I try to educate using [XKCD style password](http://xkcd.com/936/ http://xkcd.com/936/) to mainstream people. So far, they seemed to get it.

NuZZ 14y ago

Or just generate random 15+ character passwords for admin accounts. From the article it appears the concern is from brute forcing "admin" account passwords. Good luck bruting MT#r!}A1(hIQ4^pC*7`K.KGiL\&[A\k#TUC4R<R?

WA 14y ago
Good luck typing that without a password manager ;)
- johnpowell 14y ago
  I just use a text file on my computers desktop and a usb thumb drive. I don't note what the password is for. So my Amazon password is something like dkwjRw#4camzR4%7hjfgdelsdshWE
  - WA 14y ago
    And how do you solve that if you want to log in to amazon form your computer and from your mobile phone?
- NuZZ 14y ago
  I dont think it's practical to rely on memory for passwords anymore. If it's a site you really couldnt give a damn about, then sure, as long as you're okay with whatever information you submit being potentially linked to that password and to any other information.

yaix 14y ago

Simply use five random dictionary words as a password and you are fine. The browser will store then the password easy login. Two-facor auth just adds to complexity, and that is a bad thing when it comes to secutiry. You want to be able to easily understand that a system is secure. The more complex a system is, the larger the likelyhood of a surprise "whoops, I overlooked that" somewhere down the road.

ra 14y ago
Or any slightly obscure memorable phrase. e.g. mycatmiffylikesbiscuits or tallspeakerswithoutafaceplaterattle or emptyhandlebeerglasshasfoam ...
- ZoFreX 14y ago
  No. The key word in the comment you replied to was "random". "mycatmiffylikesbiscuits" is a pretty terrible password.
  - danenania 14y ago
    How so? Assuming about 100,000 common words in the English language, with a five word phrase aren't you talking about 10000000000000000000000000 combinations for a dictionary attack to churn through? Even if you narrow it down to phrases that make grammatical sense (which certainly isn't a trivial thing to do algorithmically), you're still talking pretty astronomical numbers, and that doesn't account for the large increase in the corpus that would be needed for an attack that could include a name like "miffy" in its attempts.
    - chii 14y ago
      But if the attacker knew with good probability that your passphrase is a valid sentence, they'd have ways to eliminate incorrect sentences, and so reduce the search space a bit (or a bit more, depending on how clever they are).
    - ZoFreX 14y ago