5 ms·
Don't use an "idiot" password, use a long password.. Good passwords aren't complex, they're LONG.. "this is a really dumb password" is probably actually a re
by sbarre 12y ago
Don't use an "idiot" password, use a long password.. Good passwords aren't complex, they're LONG..
"this is a really dumb password" is probably actually a really good password. ;-)
And also, your "problem" is simply your decision to trade security for convenience.
You need to weigh the risks vs. reward and make the choice for yourself. If something goes wrong, at least you'll know why.
- runn1ng 12y agoThe problem is to tap all of that into your phone, every time iOS decides it desperately needs it again, with just stars instead of letters. That's annoying.
- hyperpape 12y agoIt's a pain, but really not that bad. You tweet from your phone (or use email/SMS/whatever else). 20 characters is manageable and secure, as long as it's randomly generated.
- runn1ng 12y agoIf it's randomly generated, it's impossible to remember to fill in on your phone. Unless you have it on a piece of paper in your wallet.
- deleted 12y ago[deleted]
- vertex-four 12y agoReally? I remember quite a few four-word (xkcd-style) random passphrases.
- hyperpape 12y agoBingo. I'm actually thinking of diceware.
- pbhjpbhj 12y ago20 chars: bu-Y6Bx(94ijk1Y5$kWx
- baddox 12y agoI've got a fairly long iCloud password with upper and lower case letters, numbers, and symbols. After four or so years of typing it on iOS devices, I have the muscle memory to type is extremely fast without thinking about it. In fact, to figure out the actual characters of the password, I have to visually reconstruct the physical typing that I do from muscle memory.
- sytringy05 12y agoLong passwords (aka the xkcd scheme) aren't secure anymore - https://www.schneier.com/blog/archives/2014/03/choosing_secure_1.html https://www.schneier.com/blog/archives/2014/03/choosing_secu... The only good passwords are ones that stay well away from dictionary words..
- danielweber 12y agoSix really random words -- not a sentence -- gives you pretty good security. Six words chosen from this list http://world.std.com/~reinhold/diceware.wordlist.asc http://world.std.com/~reinhold/diceware.wordlist.asc truly at random gives you almost 80 bits of entropy. And six random words are easier to remember than 16 totally random letters. EDIT seriously, 221073919720733357899776 is a really big search space. If you have a computer that can search a billion per second, it's going to take 1000 computers 1000 years to catalog just 14% of the search space.
- prutschman 12y agoThe Schneier article is puzzling; the security of the diceware/XKCD scheme doesn't rely on the word list being secret, just on the words from the list being chosen randomly. 4 words randomly chosen from a list of 5000 provide about 49 bits of entropy when the list of words is fully known. Against an attacker who knows exactly how you chose your password, it's (roughly) the same level of security as a 14-digit numeric code, or an 8 letter case-sensitive alphanumeric code. It's just supposed to be easier to remember.
- Thimothy 12y agoHis point is that using actual, grammatically correct, sentences is not the same as using several random words. As your mobile keyboard autocomplete well knows, after a certain word there are words more probable than others. How many people use this kind of approach, I don't know. Schneier seems to focus on "three random letters" kind of attacker.
- dredmorbius 12y agoA good password is one that's not known or readily knowable. There are archives of know passwords -- millions of them. These should be rejected on any online service. There are tools for guessing passwords. Any password which falls into any of he likely-to-be-guessed divisions should _also_ be rejected. Dictionary words _could_ work in a sufficiently large namespace. But that's pretty iffy.