Timeline for Specific character based policy for passwords
Current License: CC BY-SA 4.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 5, 2020 at 9:41 | comment | added | WoJ | @JörgWMittag: I do use Bitwarden (and self host it as well) and I was about to open a feature request for that :-| -- I never realized that there was something else than "password" in the choices. Thanks a lot for opening my eyes (it is truly a great product BTW) | |
| Jun 5, 2020 at 6:32 | comment | added | Jörg W Mittag | @WoJ: Bitwarden has an xkcd-style passphrase generator. E.g., it just generated this for me: "Decibel-Basin-Resurface-Ideally-Shelve1". (This is not an endorsement of Bitwarden, it just happened to be the only password manager that had clients for all OSs and plugins for all browsers I needed at the time I made the decision. The tradeoff that it is using its own cloud sync service instead of allowing me to choose was a tradeoff I was willing to make at the time.) | |
| Jun 3, 2020 at 15:14 | comment | added | WoJ | @Ray: yes it is a way lower if the passphrase means something (even more when this is "something well known"). It does not have to mean something, even when the words are connected it is a problem ("blue red yellow green"). All this said, it may be much better than "password1234". The real problem is how to correctly define your "way lower" and my "much better" in the actual context of the OP (any anyone else) use | |
| Jun 3, 2020 at 15:10 | comment | added | WoJ | @schroeder: yes, my comment was in the context of The better option is to demand randomly generated passwords. (...) ("just use this password manager") The result from a password manager will not be a word-based passphrase (and now that I think of it - it is something which is missing in the one(s) I use(d). | |
| Jun 3, 2020 at 14:09 | comment | added | Ray | @WoJ And to follow up schroeder's comment, the xkcd method you mention specifically assumes that the words are all selected uniformly at random. The entropy's way lower if you use passphrases that mean something. | |
| Jun 3, 2020 at 13:29 | comment | added | schroeder♦ | @WoJ "random" does not have to mean "random string". "Random 3 words" is a standard by the UK's NCSC. | |
| Jun 3, 2020 at 12:41 | comment | added | WoJ | It is not always possible (or rather - practical) to use random passwords. An example is Windows login. In that case a xkcd-like passphrase is better. Otherwise yes - password managers. | |
| Jun 2, 2020 at 13:47 | vote | accept | Woodstock | ||
| Jun 2, 2020 at 12:40 | history | edited | schroeder♦ | CC BY-SA 4.0 |
added 47 characters in body
|
| Jun 2, 2020 at 12:39 | comment | added | Conor Mancone | Good point on how this basically asks people to ask like random number generators. One (of the many) reasons why people are so bad at passwords is because we are, inherently, terrible random number generators. | |
| Jun 2, 2020 at 12:36 | history | answered | schroeder♦ | CC BY-SA 4.0 |