Stop forcing arbitrary password rules

Re:Stop forcing arbitrary password rules by dagss on Saturday October 24, 2015 @06:55AM (#10443181)

Point is you can use passphrases that are easier for humans to remember, but you then need to measure entropy as numbers of words and size of dictionary and 16 characters is too little. https://xkcd.com/936/

[ Parent | on HN ]

Re:Stop forcing arbitrary password rules by lhecker on Saturday October 24, 2015 @07:10AM (#10443204)

Yep exactly that. It would be great if I could just use some whole words as the password for accounts which I need to use often or are really important and thus IMHO make password stores impractical (e.g. desktop login, Gmail, …)

[ Parent | on HN ]

Re:Stop forcing arbitrary password rules by eru on Saturday October 24, 2015 @08:51AM (#10443436)

Add second factor authorization for these, in any case. Google Authenticator app on the phone works reasonably well, or perhaps even get a physical token.

[ Parent | on HN ]

Re:Stop forcing arbitrary password rules by freehunter on Saturday October 24, 2015 @10:27AM (#10443684)

I use a passphrase on my Gmail account in the manner of "This is the password I am using for Gmail". Works just fine.

[ Parent | on HN ]

Re:Stop forcing arbitrary password rules by WhitneyLand on Saturday October 24, 2015 @11:14PM (#10445818)

Pass phrases can be a problem because they are attacked using dictionaries just like words are. Choose carefully.

[ Parent | on HN ]