News for hackers. Stuff that matters.
Re:Ask HN: Password best practices? by Phoenix912 on Wednesday January 22, 2014 @09:47AM (#7102756)
You should use KeePass, with automatically generated passwords and expiration dates. 60 characters is far too much, 16 is good with numbers, letters and special characters.

I don't use any american solutions due to Snowden's revelations. I don't want NSA on my passwords. Prefer an open source program.

If you want a cloud system, with keepass on your smartphone automatically updated, I think you should create your owncloud server.

Re:Ask HN: Password best practices? by Piskvorrr on Wednesday January 22, 2014 @10:29AM (#7103073)
Why does it matter to the user how many characters are in the password? Xe never interacts with that string directly anyway; and password _length_ strongly correlates with password _strength_. 16 is way, way too low - the rainbow tables for this size are already widely available, and most sites still go for the lowest security possible (single password hash, unsalted).
Re:Ask HN: Password best practices? by Suitov on Wednesday January 22, 2014 @01:13PM (#7104329)
I go for 64 as a default length, but it's surprising how many sites respond with "No! You can't havee more than 8/10/12 characters or I'll sulk!" Makes me extremely suspicious re: just how they're storing them.