[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 7 Apr 2016 22:50:33 +0200
From: Per Thorsheim <per@...rsheim.net>
To: passwords@...ts.openwall.com
Subject: Re: Password creation policies
Den 07.04.2016 22.40, skrev e@...tmx.net:
>>> The "password creation policy" concept is deeply MISLEADING. It confuses
>>> all our objectives and analytical tools with marketing and coercion.
>>
>> Blazing guns! Better arguments please.
>
> This is a real argument.
> The decomposition helps solving problems.
> Unrelated entities mixed into the topic -- do not.
Ah. By "password creation policy", I think of some sort of rules for
ordinary humans to create passwords that are "strong enough" (accepted
by the system where they are to be used), AND memorable, as we still
prefer and have to comply with EULA, standards & even law saying we are
not allowed to write down our passwords. Something I'm trying to change btw.
> I phrased this point few weeks ago thusly:
>
> [the article] is written from a standpoint of a service provider and
> assumes "him" to influence users' password creation strategy -- this is
> an erroneous stance in and of itself. It conflates responsibilities! The
> password _guessing_ attacks constitutes a private "dispute" between the
> defender and the attacker while the mediator, the service provider, has
> its own huge pile of problems: how to deflect all the rest types of
> attacks -- and those must not be confused with the former.
Almost all articles in the media about password cracking and password
weakness assumes that passwords hashes, if not also usernames, user
info, even unique per user salt values have already been stolen, and an
attacker has "unlimited" resources at his disposal.
But yes, you have a good point that the online or offline guessing
attacks are just part of the pile of problems.
>> We discuss anything related to passwords, including biometrics, 2SV,
>> 2FA, linguistics, statistics, psychology, math, crypto, voodoo, magical
>> unicorns and MASSIVE gpu clusters. And more!
>
> I do not call you to limit the scope of your discussion, I want to avoid
> confusion between "password choosing strategy" and "password creation
> policy" -- let's not substitute one discussion with another; they are
> not the same and the "policy problems" are apparently derivative to the
> "password problems".
:-)
.per
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
