3 ms·
Sure, but in analyzing a password for acceptable entropy, one should be smart enough to dilineate between: LLLLLLLLLL and 8x~3uLLx&#@_o But most people who
by nkozyra 12y ago
Sure, but in analyzing a password for acceptable entropy, one should be smart enough to dilineate between:
LLLLLLLLLL
and
8x~3uLLx&#@_o
But most people who write password analysis are doing some really quick and dirty checks like [name/email not in password], [password exceeds X chars], [password contains at least 1 of these chars], etc. If you're going to introduce some other check, it should have the nuance to provide some allowances. I've had my auto-generated, 20-char digit/char/symbol PW from keepass get rejected for such things.
- muaddirac 12y ago> I've had my auto-generated, 20-char digit/char/symbol PW from keepass get rejected for such things. Huge pet peeve of mine. Really? "(uJgP6h9=8Uc6x?}#B6Q" isn't enough for you?
- curun1r 12y ago> Really? "(uJgP6h9=8Uc6x?}#B6Q" isn't enough for you? Not after you've posted it on HN. That's only half joking...the biggest vulnerability in any password system is the humans involved. Security advisors should design around the natural behavior of their users, not try to force users into acting unnaturally. Otherwise, users will figure out how to introduce vulnerabilities that get around the constraints imposed upon them (the oft-cited writing passwords down).
- pluma 12y agoMemo: ATTN All Employees The password "(uJgP6h9=8Uc6x?}#B6Q" (no quotation marks) has been scientifically determined to be the most complex password. Please make sure to change every password to this new password within 24 hours. Signed, The Mgt.
- yk 12y agoObviously not, there is not e that could be replaced with a 3.