New NIST password guidelines: don't require character types or rotation

Re:New NIST password guidelines: don't require character typ... by soft_dev_person on Wednesday December 14, 2016 @07:50AM (#13175581)

I tend to do manual "diceware"-passphrase generation when I need to (i.e. I cannot use my password manager for any reason).

So just random words and half-words are appended, like: 'misfortune behold oratory plexum'

Then again, these things tend to just stick very well in my mind, so it may not be appropriate for everyone. Also, I only need to do this on certain services, so it's not that many to remember.

The hard part is when they then reply with "requires at least one upper case character, number, symbol, etc.". A certain XKCD comic comes to mind...

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by loup-vaillant on Wednesday December 14, 2016 @08:03AM (#13175629)

My method:

  Lorem ipsum random garbage 1

I get a special character (space), lower case, upper case, and numbers. Change the number for rotation, it works if they don't search for short Hamming distances. Worked at my last gig.

[ Parent | on HN ]