News for hackers. Stuff that matters.
Re:Password Requirements: Myths and Madness by wkat4242 on Thursday December 22, 2022 @10:28PM (#34102053)
I know passphrases are better. But, the problem is there's much more to type every time you want to unlock your computer. And thus also many more chances to make a typo.

Of course there's TouchID and Windows hello but they don't work if your laptop is closed in a dock. Or in my case a Mac mini at home.

This is why I still stick to the truly random sorry password, I have no issues remembering arbitrary strings for some reason :)

Re:Password Requirements: Myths and Madness by ddejohn on Thursday December 22, 2022 @11:06PM (#34102237)
Typing a passphrase is so much easier. You already have muscle memory for typing English (or whatever your first language) words. I can type probably type a 60 character passphrase consisting of real words at least as quickly as than I can type a 15 character password with special characters, if not faster.
Re:Password Requirements: Myths and Madness by wkat4242 on Thursday December 22, 2022 @11:11PM (#34102260)
For you maybe, not for me. I'm pretty good with arbitary strings. And I'd only use specials that don't require shift :)

Luckily my work still allows 10-char with specials or passphrases of 16 and longer without.

Also, the incessant screen locking really annoys me, every time I step away for a coffee my PC is locked again, and this is also at home where my environment is completely secure and I'm the only one living there. I actually work in security but sometimes there is just no reason and it becomes just a barrier.

In the past I used an app to jiggle the mouse every once in a while but that doesn't work anymore. I now made a digispark that does the same in hardware.

Re:Password Requirements: Myths and Madness by AstralStorm on Friday December 23, 2022 @01:04AM (#34102751)
Use a secure element with a password manager already. Specifically, certain password managers can handle yubikey as storage.
Re:Password Requirements: Myths and Madness by midasuni on Friday December 23, 2022 @05:22AM (#34104198)
I type my arbitrary 12 character password for my laptop as quickly as I’d type two 6 letter common words, due to muscle memory, as I don’t have to change it every few months.
Re:Password Requirements: Myths and Madness by ddejohn on Friday December 23, 2022 @04:54PM (#34111029)
> 12 character password

Those are rookie numbers!

In all serious, my point is roughly that typing Sp3c1al_(h4racTer_p@ssw0rd$ is like O(n) whereas typing passphrases is like O(log n). Once you hit a certain length, pass phrases start pulling ahead in ease-of-use.

We're already constantly maintaining muscle memory just by typing normal words every day. With muscle memory for special character passwords, you have to start over from scratch every time you have to change one.

In other words, imagine I flipped over a flashcard with a new passphrase on it consisting of lowercase English words, and asked you to type it. Now imagine I flip over a flashcard with a new, special character password. How many more times do you think you'd have to reference the flashcard with the special character password while typing it out and developing the muscle memory over the flashcard with the passphrase?

Re:Password Requirements: Myths and Madness by NLips on Friday December 23, 2022 @03:18AM (#34103458)
Windows allows you to use a PIN for regular device logon - so you have a longer, more secure password for general use of the account, but an eg 8 digit numeric PIN _only_ for that device.
Re:Password Requirements: Myths and Madness by wkat4242 on Friday December 23, 2022 @03:40AM (#34103605)
That's nice yeah, I wish mac had this too :'(