Comment by accountyaccount | Hacker News Reader

Comment by accountyaccount | Hacker News Reader

accountyaccount

• Password requirements outside of length really don't do squat except make it harder for people to remember their already weak passwords

• Using the same short passwords over and over again.

• Using short passwords <8 characters

• Using very commonly used passwords (password123)

• Security questions

Just use a password manager. Choose one strong 10+ character password that you can remember. Choose the first letter of every word from song lyrics you like if you have to.

Example: lwbeiycwlmdrgag (loving would be easy if your colors were like my dreams red gold and green).

It would take the standard web hack billions of years to figure out that password. Even if someone had massive computing resources behind the crack (not typical, and very expensive) it would take over a week. Password123 or Fido16 might take a minute.

Yubikeys (both two-factor and very long static passwords, with pins) go a long way. And a handful of Yubikeys handed out to your staff is cheaper than a data breach.

It's not protection from idiocy, but if you're a Microsoft shop, default long passwords avoid stuff that Microsoft is rather coy about (e.g., LANMAN hash attacks against passwords < 14 characters long are still a thing, sigh).

> Choose the first letter of every word from song lyrics you like if you have to. Example: lwbeiycwlmdrgag (loving would be easy if your colors were like my dreams red gold and green).

I'm not sure that's a strong password. A web crawler could generate a list of n-grams from the first word of every word on every web page

and that would be how many potential passwords?

i pick a random order of a 52 card deck as my password. is that a strong password? you could just iterate over all of them. might take a whole though.

now my password is EITHER the song thing or a random order of a 52 card deck, you dont know which one. am i having a strong password yet?

"a web crawler could just read every page on the internet and then construct all the potential n-grams of every word of every page on the internet and then easily figure out your password" sounds slightly optimistic.

youd only have to clone half the google operation to crack some random weirdos password.

Reply on news.ycombinator.com