Date: Wed, 24 Aug 2016 23:10:01 +0300 From: Anton Dedov <adedov@...il.com> To: passwords@...ts.openwall.com Subject: Re: GMOs And Passwords Hi! Finally interesting idea for me! It looks like good advice for friends and relatives. I remember Per's password advice for his mother... But how we as service developers can automate checks for such kind of advices? Should we? Or may be it is totally about starting new wave of better password propaganda? Thanks. On Wed, Aug 24, 2016 at 10:56 PM, e@...tmx.net <e@...tmx.net> wrote: > > it is true that people can not produce anything random at all, > but introducing an external RNG is not necessarily the only solution, and > not necessarily the best solution. > > it is also clear from your "coin-flipping" example that introduction of > mandatory capital letters in the password generation procedure do not > solve the stated problem -- mandatory capital letters are equivalent to > flipping more than one coin, which obviously suffer from the same > non-randomness as flipping a single coin. > therefore "password policies" do not improve the quality in question. > > But! > > A password does not have to be random!!! > A password have to be UNKNOWN and UNOBTAINABLE for the attacker. > (it is not equivalent to randomness) > > Look, since we know that humans are destined to fail in creating a random > password, it should be obvious that asking them to fail is a stupid move. > Whether you want it or not you must encourage humans > to create non-random passwords (unless they rely completely on a machine > RNG) > > I suggest making DEEPLY PERSONAL passwords. > You can ask your users to use a bit of memories that they know they never > shared with anyone; write a sentence about it, add some flavour; > Job's done. -- Anton Dedov Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.