Hacker News Reader

> highly randomized (you don’t get to choose Summer2024!)

Sure.

> designed to be stored offline somewhere as a break glass.

That's fair.

> The OTP is usually very long,

No, 10 digits is not very long, that's just 10^10 (about 2^33). The xkcd password ( https://xkcd.com/936/ ) is better than that. It's better than Summer2024 perhaps, but not all that much better.

View on HN

Sorry, when I said OTP I mean the recovery code OTP. They’re often 16 hex, so 16^16

The xkcd password requires the use of spaces as legal characters. For some reason, this is still an issue with the majority of orgs with complex password requirements.

I practically see red when they tell me I can’t use spaces in my password. What kind of clown car are you idiots running over there?

I worked for a government agency who banned @, because it would SQLi and break their Oracle-based LOB apps when you logged on and when they synced your password in the clear.

correcthorsebatterystaple isn't much worse

*correct:battery-horse,staple. is a lot better though.

much more difficult to recall without the aid of a passwd manager

Reply on news.ycombinator.com