NIST recently published their four-volume SP800-63-3 Digital Identity Guidelines. Among other things, they make three important suggestions when it comes to passwords:
-Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because artificially complex passwords are harder to type in. And they don't help that much. It's better to allow people to use pass phrases.
-Stop it with password expiration. That was an old idea for an old way we used computers. Today, don't make people change their passwords unless there's indication of compromise.
-Let people use password managers. This is how we deal with all the passwords we need.
These password rules were failed attempts to fix the user. Better we fix the security systems.
Does this mean we can stop composing our passwords like Q*bert?
(Score: 2) by Snotnose on Wednesday October 11 2017, @12:07AM (3 children)
Think of a phrase. XKCD sez it needs to make sense. Me? Rocket Engines Burning Fuel So Fast, by Black Sabbath. Password? R3bfsfBS. Not an actual password I've ever used, but an idea how I come up with passwords. XKCD is pretty much on the mark when it comes to passwords.
When the dust settled America realized it was saved by a porn star.
(Score: 2) by t-3 on Wednesday October 11 2017, @01:54AM
I often look at my bookshelf, pick a memorable title, and use that. Otherwise, a phrase with another coded phrase embedded (morse, number substitution, etc.). Of course, for stuff I don't care about, I just use one of the passwords I've used since I was a kid.
(Score: 0) by Anonymous Coward on Wednesday October 11 2017, @12:51PM (1 child)
XKCD recommends *against* cryptic passwords like "R3bfsfBS". In fact it recommends against passwords in general.
(Score: 2) by Yog-Yogguth on Sunday October 15 2017, @11:22AM
But most places do not allow you to use long pass-phrases that would be easy to remember so you have to adapt as best you can.
Or "BMpdNAytULp-pTWbeTRsyHTaaBYc." and stay out of my lunch box everybody! :)
Bite harder Ouroboros, bite! tails.boum.org/ linux USB CD secure desktop IRC *crypt tor (not endorsements (XKeyScore))