News for hackers. Stuff that matters.

A comment on VNC Roulette. Parent comment

Re:VNC Roulette by Sophira on Sunday March 27, 2016 @09:22AM (#11369877)
> I'm all for educating people on these issues, but the true way to protect them from their own stupidity is to ensure that it is impossible for them to start up a vnc server without enforcing a strong password.

What is a 'strong password'? Minimum 12 characters, 2 symbols, 2 caps, 2 lower case? "1!qQaAzX2@wWsSxX" fits (and exceeds) those requirements.

Trying to enforce strong passwords doesn't work; people just make up new insecure passwords.

[ Parent | on HN ]
Re:VNC Roulette by gcr on Sunday March 27, 2016 @11:09AM (#11370180)
Five random english words (100000^5) is stronger than 12 random printable ASCII characters (95^12). It's more memorable, too.

User-hurting policies like "Thou shalt have at least 2 symbols in thine password" are partly to blame.

[ Parent | on HN ]
Re:VNC Roulette by Dylan16807 on Sunday March 27, 2016 @02:27PM (#11370915)
You want to be careful that you don't end up with "five random english words (4000^5)", though.

And it's hard to enforce people not using phrases.

[ Parent | on HN ]