[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 24 Aug 2016 22:40:01 +0200
From: "e@...tmx.net" <e@...tmx.net>
To: passwords@...ts.openwall.com
Subject: Re: GMOs And Passwords
On 08/24/2016 10:32 PM, ArkanoiD wrote:
>
>
> On Wed, Aug 24, 2016 at 11:18 PM, e@...tmx.net <mailto:e@...tmx.net>
> <e@...tmx.net <mailto:e@...tmx.net>> wrote:
>
>
> (1) it is completely different area of responsibility.
> do not mess with the users' free will.
> expending of your "care" beyond the boundaries of your responsibility
> always cases more trouble than good.
>
> (2) an ideal password should FAIL all checks.
> checks are LIMITATIONS.
> a password that complies to a policy is worse than a password that
> does not.
>
>
> Things tend to get more complicated if there is multi-entity
> interactions with uneven distribution of skills, risks and liability.
>
> Say, if you have a small group of well-educated persons, it might work
> as you say. Especially if risks and liabilities fall on the same person.
> Though shit happens anyway (which is endless source of lulz).
>
> If we consider some kind of corporate slavery where you as a manager is
> responsible for others' failures; or if you run a public service and you
> know YOU will be blamed if your users' negligence -- it becomes a
> rational decision to intervene with certain restrictions of free will of
> some for better outcome for the rest. Just because the alternative is
> worse! For you, for the company, maybe even for them but they fail to
> admit it!
in this case i can suggest you a policy which is a function of the
password length: apply (policy(length(password)) to password)
i.e. to shorter passwords you apply stronger policies, which relax with
the length, and may for certain length threshold be reduced to empty policy.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
