4 ms·
I like using phrase passwords like this, but unfortunately a lot of sites have massive lists of ridiculous rules which disallow these sorts of passwords, despit
by FreakyT 12y ago
I like using phrase passwords like this, but unfortunately a lot of sites have massive lists of ridiculous rules which disallow these sorts of passwords, despite their apparent security.
Google currently gets it right, but a lot of IT departments I've encountered are absolutely adamant about things like "must contain 1 number, 1 symbol, 1 uppercase, 1 lowercase" etc, essentially enforcing a completely non-memorable string of 8 random characters.
- ntucker 12y agoIf you know your passwords are strong without those requirements, you could always come up with a standard prefix that adds no security but serves only to satisfy those rules. For example, all your passwords could begin with "$A1a". Unfortunately, this doesn't help when you run into the truly bizarre (but fortunately rare) case of sites that disallow specific characters (e.g. '$', which I believe I discovered is disallowed on Seattle City Light's website).
- akerl_ 12y agoThis is yet another wonderful use case for password managers. Let them remember the weird symbol combo you needed to log in to all the shitty sites, and use your awesome wordsmith skills to craft a nonsense string of words for your master password.
- FreakyT 12y agoGood point, though I've often found that even that doesn't help because of "no dictonary word" requirements. So a password like $A1aHackerNews would still fail because it contains dictionary words.