News for hackers. Stuff that matters.

A comment on The man who wrote the book on password management regrets the error. Parent comment

Re:The man who wrote the book on password management regrets... by JohnStrange on Wednesday August 09, 2017 @10:33AM (#14969321)
Maybe I'm paranoid, but I advice to my customers that any passphrase with an entropy below 80 bits is insecure, around 140 bit is fairly secure, and anything above 200 bit entropy is very secure.
[ Parent | on HN ]
Re:The man who wrote the book on password management regrets... by contravariant on Wednesday August 09, 2017 @10:53AM (#14969595)
I can understand why you'd want to be more careful with generated passphrases, but 80 bits of entropy is like a 16 character long alphanumeric password. That seems fairly secure to me for most purposes.

Unless the hash is 'broken' but then your options are fairly limited anyway.

[ Parent | on HN ]
Re:The man who wrote the book on password management regrets... by JohnStrange on Wednesday August 09, 2017 @11:01AM (#14969710)
80 bits of entropy is between 12 and 13 visible ASCII characters and between 14-15 ASCII letters.

Yes, if you go below that I'd say it's insecure. It's a conservative estimate, I admit. An entropy of 60 might be okay, too, but there is no harm in making passwords more secure.

[ Parent | on HN ]
Re:The man who wrote the book on password management regrets... by Bromskloss on Wednesday August 09, 2017 @01:11PM (#14971338)
> but there is no harm in making passwords more secure.

Well, it makes them harder to remember and slower to type (and increases the chance of making an error and having to type it again). I hesitate slightly to do things that require me to type my long password. :-)

[ Parent | on HN ]
Re:The man who wrote the book on password management regrets... by Abekkus on Wednesday August 09, 2017 @10:44AM (#14969473)
Assuming that password complexity is the weak link in their practices.
[ Parent | on HN ]
Re:The man who wrote the book on password management regrets... by JohnStrange on Wednesday August 09, 2017 @10:54AM (#14969611)
Uhm, no, independently of that...
[ Parent | on HN ]