4 ms·

Just a hypothetical, but what if an application started encouraging users to enter a "login sentence" instead of a password. i.e.: "Please enter a sentence that

Just a hypothetical, but what if an application started encouraging users to enter a "login sentence" instead of a password. i.e.: "Please enter a sentence that you'll be asked to remember each time you login." Obviously, the standard constraints of length and complexity (albeit slightly altered) can be enforced. It's much easier for me to remember "Please close the window, I'm cold." then it is for me to remember "XSDJd94*(lo03X.._". The "horse battery staple" XKCD comes to mind.

daddykotex 12y ago
That could be an interesting idea, but I'm wondering if the user wouldn't expect an unobfuscated input box to type in his sentence. Or if he would expect : "Please close the window, I'm cold." to be the same as "Please close the window, I'm cold" (no end period here)
- VLM 12y ago
  If you ate all the whitespace and punctuation and uppercase'd it as part of your password input routine, it wouldn't be all that much worse than existing shorter passwords yet make life a lot easier for valid users. Another interesting strategy, not discussed so far, is everyone in almost all lives and professions has some pool of weird technical names that can be concatenated together for a password. I'm partial to "unpopular yet cool integrated circuit ID codes of the 80s". I thought I invented that idea and was introduced to an old programmer using concatenated library calls from multiple languages (so his passwords were concatenations like a java soundex algo library call followed by some obscure fortran matrix manipulation) My mom knows the long legal names of some obscure real estate cases / judgments / citations / forms.
nkozyra 12y ago
Simple does this and it's fantastic but perhaps only because it's the only service I use that requires this. In other words, while it's useful from a password complexity standpoint to utilize longer passwords, and while this makes remembering them easier, it doesn't change the fundamental issue that managing many unique passwords is difficult for most people. This leads to the same general mistakes (that password manager application users don't face): 1. Reusing a password (in this case a better one, but the problem remains) 2. Writing all of their passphrases down somewhere. In general, I still prefer the use of pass phrases versus passwords, but this still requires a password manager for most people to be able to affect safe password habits. (Thinking of this grammatically it's also interesting that we still refer to a group of jumbled characters as a pass'word.')
ilitirit 12y ago
I use the same passphrase, with something extra based on a few rules.* www.example.com: !ThisIsMyPassword!6eec9b9f news.foobar.com: !ThisIsMyPassword!9ef61f95 Problems: - It can be pain to use on a mobile device. - Some sites limit the length of the password - Need rules for sites that force you to update your password *Not my true password nor the rule that I use.

daddykotex 12y ago

That could be an interesting idea, but I'm wondering if the user wouldn't expect an unobfuscated input box to type in his sentence. Or if he would expect : "Please close the window, I'm cold." to be the same as "Please close the window, I'm cold" (no end period here)

VLM 12y ago
If you ate all the whitespace and punctuation and uppercase'd it as part of your password input routine, it wouldn't be all that much worse than existing shorter passwords yet make life a lot easier for valid users. Another interesting strategy, not discussed so far, is everyone in almost all lives and professions has some pool of weird technical names that can be concatenated together for a password. I'm partial to "unpopular yet cool integrated circuit ID codes of the 80s". I thought I invented that idea and was introduced to an old programmer using concatenated library calls from multiple languages (so his passwords were concatenations like a java soundex algo library call followed by some obscure fortran matrix manipulation) My mom knows the long legal names of some obscure real estate cases / judgments / citations / forms.

nkozyra 12y ago

Simple does this and it's fantastic but perhaps only because it's the only service I use that requires this. In other words, while it's useful from a password complexity standpoint to utilize longer passwords, and while this makes remembering them easier, it doesn't change the fundamental issue that managing many unique passwords is difficult for most people. This leads to the same general mistakes (that password manager application users don't face): 1. Reusing a password (in this case a better one, but the problem remains) 2. Writing all of their passphrases down somewhere. In general, I still prefer the use of pass phrases versus passwords, but this still requires a password manager for most people to be able to affect safe password habits. (Thinking of this grammatically it's also interesting that we still refer to a group of jumbled characters as a pass'word.')

ilitirit 12y ago

I use the same passphrase, with something extra based on a few rules.* www.example.com: !ThisIsMyPassword!6eec9b9f news.foobar.com: !ThisIsMyPassword!9ef61f95 Problems: - It can be pain to use on a mobile device. - Some sites limit the length of the password - Need rules for sites that force you to update your password *Not my true password nor the rule that I use.