[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 24 Aug 2016 22:46:48 +0200
From: "e@...tmx.net" <e@...tmx.net>
To: passwords@...ts.openwall.com
Subject: Re: GMOs And Passwords
On 08/24/2016 10:36 PM, Per Thorsheim wrote:
> Den 24.08.2016 22.28, skrev e@...tmx.net:
>> On 08/24/2016 10:22 PM, Scott Arciszewski wrote:
>>> On Wed, Aug 24, 2016 at 4:18 PM, e@...tmx.net <mailto:e@...tmx.net>
>>> <e@...tmx.net <mailto:e@...tmx.net>>wrote:
>
>>> On one side, I can see how "don't
>>> reject any values" could lead to more work for attackers.
>>>
>>> On the other, if they're certainly going to guess 123456 and password,
>>> maybe we shouldn't allow users to use those strings in the first place?
>>
>> it is that almost all policies that reject 123456 also reject very
>> sophisticated very personal and enormously strong passwords.
>>
>> this rejection is uncontrollable you can not guarantee that your policy
>> does not reject: "on the second day of waning moon my granma baked
>> seventeen cup cakes with swastika frosting"
>
> I'm sorry, I didn't see your definition of "policy" here. Are you
> talking about a written policy, a technically implemented policy, or a
> password strength meter?
a written policy, a technically implemented policy
that impose strict requirement to a password (i.e. disallow some passwords)
(not a definition, though, just a clarification of the context)
> A written policy, just like a technical policy implementation, can be
> written and configured so that it specifically rejects 123456, and
> nothing else.
yes.
i would like this policy.
hopefully you understand that i referred to less strictly defined
policies such as listing properties instead of individual "banned"
passwords.
> Personally I prefer thinking of a policy as a description of a desired
> state, and NOT as law or rules that you MUST at all times be 100%
> compliant with.
if i understand you correctly, i support this!
shall we call it "ADVISORY policies"?
you should give valuable advice to the users,
you may "meter" the user's password (as long as you make it clear for
the user that the meter gives merely a rough estimate)
also, i think that a strict policy:
"no passwords shorter than N are allowed"
is never detrimental.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
