The Password Problem has been spoken on many times, but most places I've seen offer terrible solutions such as modifying a dictionary word, changing your password requirements to include special characters (or using dumb password complexity requirements at all), etc.
I'm thinking the temporary solution to the password problem from the user side will be to use an OSS, securely encrypted (community-checked) password manager such as KeePass, etc. (which exactly is another question), but is there a good article that recommends this to users and cites scholarly articles? I'm thinking something along the lines of:
- Install a password manager (here's how link) (Ref. to Academic paper with rationale)
- machine- (or better yet dice-) generate your master password. (ref. to penetration testing of diceware-generated passwords)
- setup 3 security levels in the generation profiles in your password manager, use the strongest (longest, highest entropy (Ref. to what entropy is)) when allowed.
- For each site, check password against dics, turn on two-factor wherever possible, don't use "security" questions. (Refs)
note: for the above, blogs, wikis, and other user-contributed sites are considered invalid citations. Actual academic journals are preferred, but official documentation sites are acceptable as well. The article I'm seeking can be a blog (but not Wikipedia), but the scholarly references it cites cannot.
I'm primarily looking for an end-user-side article or post, though one that also includes a section educating website owners on the server-side of this problem (citing, for instance, The NIST) would be even better.
An article or page that is already written is preferred, but iff none exists, we will have to make an answer to this question the first one.