Date: Thu, 7 Apr 2016 22:50:33 +0200 From: Per Thorsheim <per@...rsheim.net> To: passwords@...ts.openwall.com Subject: Re: Password creation policies Den 07.04.2016 22.40, skrev e@...tmx.net: >>> The "password creation policy" concept is deeply MISLEADING. It confuses >>> all our objectives and analytical tools with marketing and coercion. >> >> Blazing guns! Better arguments please. > > This is a real argument. > The decomposition helps solving problems. > Unrelated entities mixed into the topic -- do not. Ah. By "password creation policy", I think of some sort of rules for ordinary humans to create passwords that are "strong enough" (accepted by the system where they are to be used), AND memorable, as we still prefer and have to comply with EULA, standards & even law saying we are not allowed to write down our passwords. Something I'm trying to change btw. > I phrased this point few weeks ago thusly: > > [the article] is written from a standpoint of a service provider and > assumes "him" to influence users' password creation strategy -- this is > an erroneous stance in and of itself. It conflates responsibilities! The > password _guessing_ attacks constitutes a private "dispute" between the > defender and the attacker while the mediator, the service provider, has > its own huge pile of problems: how to deflect all the rest types of > attacks -- and those must not be confused with the former. Almost all articles in the media about password cracking and password weakness assumes that passwords hashes, if not also usernames, user info, even unique per user salt values have already been stolen, and an attacker has "unlimited" resources at his disposal. But yes, you have a good point that the online or offline guessing attacks are just part of the pile of problems. >> We discuss anything related to passwords, including biometrics, 2SV, >> 2FA, linguistics, statistics, psychology, math, crypto, voodoo, magical >> unicorns and MASSIVE gpu clusters. And more! > > I do not call you to limit the scope of your discussion, I want to avoid > confusion between "password choosing strategy" and "password creation > policy" -- let's not substitute one discussion with another; they are > not the same and the "policy problems" are apparently derivative to the > "password problems". :-) .per
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.