Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 30 Oct 2017 22:24:55 +0100
From: "e@...tmx.net" <e@...tmx.net>
To: passwords@...ts.openwall.com
Subject: Re: Real world password policies

> There is definitely a tradeoff between blacklist size and user 
> frustration--a blacklist that is too long is even worse than a complex 
> set of composition rules, because you can't predict what will be 
> acceptable and what won't.

the most frustrating part is that those policies (all competing which is 
stupider) ARE MANDATORY.

if i am stupid enough to have a bad password JUST TELL ME THAT.
whether i want to remain stupid is not your business.

also there is an interesting possibility for an unforeseen social 
consequences:
when every worthless facebook or forum enforce "strong" (or at least 
what they perceive as strong) password policies, they encourage the 
users to reveal their PASSWORD CHOOSING STRATEGIES which could be 
inappropriately strong for such petty usecases, thus weakening the 
users' choice in other serious usecase that are indeed requiring better 
passwords.

are you following me? i am sorry for not being very eloquent...

it is already difficult for the users to maintain the loads of 
paswords... and every password policy is trying to place more burden 
onto the user. to the point where the user will eventually use one of 
his serious passwords for some stupid facebook.

do you see this danger?

please encourage your users to maintain A SEPARATE PASSWORD CREATING 
STRATEGY for all non-critical password beggars and feed them with 
passwords as similar as possible.

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ