News for hackers. Stuff that matters.

A comment on The “Chad” bug. Parent comment

Re:The “Chad” bug by mbreese on Thursday December 31, 2015 @12:36AM (#10816366)
I personally like the Stanford policy[1]. It basically boils down to: the longer the password, the fewer restrictions. Each password needs to be at least 8 characters, but if you only have 8 characters, you might need uppercase, lowercase, a symbol and a digit. If you have 12 characters, you only need upper/lower/digit. Once you hit 20 characters, you can have whatever you want.

I think that this is a good balance between security for short passwords, while still allowing ridiculously long ones (pass-phrases).

[1] http://arstechnica.com/security/2014/04/stanfords-password-p...

[ Parent | on HN ]
Re:The “Chad” bug by technion on Thursday December 31, 2015 @02:47AM (#10816711) 

    $ dd if=/dev/urandom bs=32 count=1 | xxd -p
That nearly every site on the Internet will refer to that output as "not strong enough" and instead suggest P@ssword1 as a better alternative definitely speaks to the issue.
[ Parent | on HN ]
Re:The “Chad” bug by warfangle on Thursday December 31, 2015 @12:54AM (#10816414)
Almost like you're validating on entropy and not specific rules..........
[ Parent | on HN ]
Re:The “Chad” bug by Dylan16807 on Thursday December 31, 2015 @02:30AM (#10816668)
The concept is nice, but their numbers are horribly, unforgivably wrong.

8 random upper/lower/digit/symbol characters are equal to 9 random mixed-case letters. Not 16.

Their cutoffs for different mixes are 8, 12, 16, 20. Realistic cutoffs would look more like 10, 11, 11, 14.

Even worse, they encourage counting the individual letters in words. Never do that. Random words are only as good as two random characters.

[ Parent | on HN ]