News for hackers. Stuff that matters.
Re:Password Requirements: Myths and Madness by lttg on Friday December 23, 2022 @12:35AM (#34102618)
I was in charge of password policy for a healthcare app. We tried to use phrases, often cited as more secure than character/length requirements.

The doctors hated it. They didn't understand what a phrase was, it was too different from every other system they interacted with, and it was extra cog load in their already busy days.

Re:Password Requirements: Myths and Madness by nicoburns on Friday December 23, 2022 @06:40AM (#34104735)
Why not just have a length requirement and recommend a phrase? “Passphrase” isn’t that common a word, so it merits an explanation. But “your password has to be long, but you don’t need to use special characters, and can use regular english word if you want” is surely easy enough to understand.
Re:Password Requirements: Myths and Madness by puffoflogic on Friday December 23, 2022 @02:31PM (#34109736)
> it was too different from every other system they interacted with

Translation: they couldn't use the same standard password they use for their banking, their email (also used for 2fa), Facebook, and this porn site they found by clicking on a pop-up ad.