Date: Mon, 30 Oct 2017 22:24:55 +0100 From: "e@...tmx.net" <e@...tmx.net> To: passwords@...ts.openwall.com Subject: Re: Real world password policies > There is definitely a tradeoff between blacklist size and user > frustration--a blacklist that is too long is even worse than a complex > set of composition rules, because you can't predict what will be > acceptable and what won't. the most frustrating part is that those policies (all competing which is stupider) ARE MANDATORY. if i am stupid enough to have a bad password JUST TELL ME THAT. whether i want to remain stupid is not your business. also there is an interesting possibility for an unforeseen social consequences: when every worthless facebook or forum enforce "strong" (or at least what they perceive as strong) password policies, they encourage the users to reveal their PASSWORD CHOOSING STRATEGIES which could be inappropriately strong for such petty usecases, thus weakening the users' choice in other serious usecase that are indeed requiring better passwords. are you following me? i am sorry for not being very eloquent... it is already difficult for the users to maintain the loads of paswords... and every password policy is trying to place more burden onto the user. to the point where the user will eventually use one of his serious passwords for some stupid facebook. do you see this danger? please encourage your users to maintain A SEPARATE PASSWORD CREATING STRATEGY for all non-critical password beggars and feed them with passwords as similar as possible.
Powered by blists - more mailing lists
Powered by Openwall GNU/*/Linux - Powered by OpenVZ