Timeline for Specific character based policy for passwords
Current License: CC BY-SA 4.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 4, 2020 at 12:22 | comment | added | OrangeDog | To complicate matters, it's possible (though highly unlikely) for a high-entropy generator to produce a terrible password such as your example. | |
| Jun 4, 2020 at 9:54 | comment | added | Conor Mancone | @TannerSwett yes, I 100% agree. When talking about entropy though it only makes sense to talk about how passwords are generated. You don't need to specify how the password will be cracked to decide how much entropy it has. In a conversation about calculating cracking time then obviously you do need to know something about how it will be cracked | |
| Jun 4, 2020 at 1:27 | comment | added | Sophie Swett | @ConorMancone But what matters, at least much of the time, is the method that will be used to crack the password. The length of time that a password cracker will take to find your password depends on your password and the cracker, but not the method that was used to generate the password. For that matter, the age printed on your driver's license is what determines whether or not you can buy beer. :) What the password generation method does, of course, is provide a practical guarantee that a password will take at least such-and-such many attempts to crack. | |
| Jun 3, 2020 at 23:50 | comment | added | Conor Mancone | @JanHudec unfortunately not true. The entropy is intrinsic to the password generation method. A 4 digit number has 9999 possibilities - that is the entropy. If an attacker doesn't realize that and tries to brute force all 4 character alphanumeric strings then they will make quite a lot more work for themselves, but the entropy of the password hasn't changed. Your comment is like saying my age is determined by my drivers license - while my drivers license may be one way to find out my age, my age is still intrinsic to me. | |
| Jun 3, 2020 at 19:04 | comment | added | Jan Hudec | Actually, the entropy is determined by the method that will be used to crack it, which may or may not be related to the one used to generate it. | |
| Jun 3, 2020 at 12:31 | comment | added | Hans-Martin Mosner | I found that a good option is to use a password manager such as KeePass and let it generate passwords (and store them, of course.) By using cloud storage (my own server, encrypted password database) it is possible to access passwords from anywhere and have them automatically entered into login forms when needed. | |
| Jun 3, 2020 at 11:50 | comment | added | bdsl | If you mandate that then perhaps you might as well make your system choose the random password for them. If you do that then of course you will control how much entropy goes in to it. | |
| Jun 2, 2020 at 13:48 | comment | added | Woodstock | thank you, upvoted! I am mandating that people choose a random password, but I agree that's an ask for the average user. | |
| Jun 2, 2020 at 12:36 | history | answered | Conor Mancone | CC BY-SA 4.0 |