Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 7 Apr 2016 22:25:55 +0200
From: Per Thorsheim <>
Subject: Re: Password creation policies

Den 07.04.2016 20.00, skrev
> Hello, all.

Hello anonymous!

> We must abandon the entire notion of a "policy", if we want a serious
> discussion about passwords.

We are lots of people who have been seriously discussing passwords for
quite some time. I do appreciate good arguments, I'm not too happy about
blazing guns in a debate.

> The "password creation policy" concept is deeply MISLEADING. It confuses
> all our objectives and analytical tools with marketing and coercion.

Blazing guns! Better arguments please.

> We were talking (if only we can call it "talking") on twitter about
> defining and measuring password strength. Soon the discussion slipped
> into the "policy" discourse. Words fail me! -- how irrelevant your
> futile attempts to influence people are to the problem of password
> creation STRATEGY.

Ok, I assume @it_hipster, right? Eugene P., with the paper "A password
strengh measure"?

> the attacker's and defender's strategies should be the subject.

We discuss anything related to passwords, including biometrics, 2SV,
2FA, linguistics, statistics, psychology, math, crypto, voodoo, magical
unicorns and MASSIVE gpu clusters. And more!

> [two paragraphs of swearing are skipped]

Good. It doesn't help much with the serious discussion.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.