3 ms·

I still think that the standard should just become a 100-200 characters password limit with no other restriction. That way the majority of user can just use com

by NhanH 12y ago

I still think that the standard should just become a 100-200 characters password limit with no other restriction. That way the majority of user can just use common long sentence (music lyrics, event) as their password. I know the password cracker supposedly will include those into their database eventually. But I have trouble believing that adding a whole sentence in a lyric (ie: thisisasongtwinkletwinklelittlestar ...) will have lower entropy then whatever arbitrary restriction to add a special character (ie: thisisasong!@#$) would be. Ordinary user does not use Unicode in password, and I'm not even sure if half the password system out there won't break with unicode password. It seems like since we're sticking with Ascii, length almost universally add entropy, isn't it?

jsprogrammer 12y ago
Why an arbitrary 100-200 character limit? "I still think that the standard should just become a 8-16 characters password limit with no other restriction."
- Dylan16807 12y ago
  Anything much over a kilobyte has zero benefit and has potential to cause issues or slowdowns when shoved through a path that expects a short string. It's very doubtful you'd type such a crazy-long password by hand, and if you have a password manager there's absolutely no reason to go beyond something like 256 bits of noise encoded as hex.
Dylan16807 12y ago
I like the "We have a list of the top 10k passwords. You can't use one of those." rule. >common long sentence Oh god no. Don't use a common sentence as the majority of your password. Don't try to be more clever than the password cracker. It's easy to get lists of common sentences and lyrics. Sure, a common sentence is better than a single special character, but it might only be as good as 3-4 random characters. Assume the cracker knows your method, and go based on an estimate of entropy. So perhaps a random character is 6 bits, a random word is 12, and a common lyric is almost certainly between 20 and 30. Keep adding things until you have 80 or 100 or 128 or whatever your goal is. (I would strongly recommend not using 44 as your goal.)
- NhanH 12y ago
  I just want to clarify the point about long common sentence: we keep getting stuck with comparing 100 characters commoN sentence with truly good password from rng. Of course the latter is far better, but the average user is not going to use RNG to generate password. The comparison is between common long sentence against 20 characters password with arbitrary restriction.
  - Dylan16807 12y ago
    20 characters where the user attempts to be random is going to be much better than any common sentence. Even 10 characters of attempted random is going to be better. Maybe even 5, if they were going to use a song everyone knows. Increasing the minimum size past a point doesn't help security, it just leads to people using low-entropy padding methods. Whether a sentence is better than "no restriction", I'm not sure, but that's not a very fair comparison because you can't force them to use a sentence either. I'd say what you should recommend is a series of words that don't make a sentence, but where they can remember a scenario. Or you could have the computer generate random words and let them make a sentence out of them. But don't use a preexisting sentence, or a tiny modification to one. It will be far weaker than it should.

by NhanH 12y ago

jsprogrammer 12y ago

Why an arbitrary 100-200 character limit? "I still think that the standard should just become a 8-16 characters password limit with no other restriction."

Dylan16807 12y ago
Anything much over a kilobyte has zero benefit and has potential to cause issues or slowdowns when shoved through a path that expects a short string. It's very doubtful you'd type such a crazy-long password by hand, and if you have a password manager there's absolutely no reason to go beyond something like 256 bits of noise encoded as hex.

Dylan16807 12y ago

I like the "We have a list of the top 10k passwords. You can't use one of those." rule. >common long sentence Oh god no. Don't use a common sentence as the majority of your password. Don't try to be more clever than the password cracker. It's easy to get lists of common sentences and lyrics. Sure, a common sentence is better than a single special character, but it might only be as good as 3-4 random characters. Assume the cracker knows your method, and go based on an estimate of entropy. So perhaps a random character is 6 bits, a random word is 12, and a common lyric is almost certainly between 20 and 30. Keep adding things until you have 80 or 100 or 128 or whatever your goal is. (I would strongly recommend not using 44 as your goal.)

NhanH 12y ago
I just want to clarify the point about long common sentence: we keep getting stuck with comparing 100 characters commoN sentence with truly good password from rng. Of course the latter is far better, but the average user is not going to use RNG to generate password. The comparison is between common long sentence against 20 characters password with arbitrary restriction.
- Dylan16807 12y ago
  20 characters where the user attempts to be random is going to be much better than any common sentence. Even 10 characters of attempted random is going to be better. Maybe even 5, if they were going to use a song everyone knows. Increasing the minimum size past a point doesn't help security, it just leads to people using low-entropy padding methods. Whether a sentence is better than "no restriction", I'm not sure, but that's not a very fair comparison because you can't force them to use a sentence either. I'd say what you should recommend is a series of words that don't make a sentence, but where they can remember a scenario. Or you could have the computer generate random words and let them make a sentence out of them. But don't use a preexisting sentence, or a tiny modification to one. It will be far weaker than it should.