[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5717F766.90004@thorsheim.net>
Date: Wed, 20 Apr 2016 23:40:54 +0200
From: Per Thorsheim <per@...rsheim.net>
To: passwords@...ts.openwall.com
Subject: Re: Mandatory password changes - DIEDIEDIE!
Den 20.04.2016 22.57, skrev e@...tmx.net:
>> The statement will simply be something like "stop changing passwords
>> frequently".
>
> +1
>
>> We can no longer require users to have long & complex passwords, unique
>> to every service & site, and additionally ask them to change them every
>> 30-60-90 days.
>
> it is important to separate all these 4 points.
Agree.
> 1. WE CAN AND SHOULD REQUIRE users to have LONG passwords,
Disagree. Risk analysis should be applied. Having a long password won't
help shit if all data is stored in plain on physically available disk.
(No matter what rule you make, there will always be exceptions.)
> 2. we can not say anything about "complex" because we do not know what
> is complex and if it is relevant to our problem.
I will try to only focus on the stupidity of frequent & mandatory
password change in connection with the Las Vegas event. All other
applicable stuff goes into the FAQ.
> 3. uniqueness is a delicate issue, it is sufficient for a very small
> portion of your passwords to be unique. moreover it is good to have a
> single shitty passwords for forums and similar cesspools
https://scholar.google.no/citations?view_op=view_citation&continue=/scholar%3Fq%3Dthorsheim%26hl%3Dno%26as_sdt%3D0,5%26scilib%3D1&citilm=1&citation_for_view=tP9nguAAAAAJ:d1gkVwhDpl0C&hl=no&oi=p
In which we argue for classifying sites & services into risk levels, and
allowing pwd reuse within same level, but mixing of passwords across
different levels. Rude, but at least something to ease the burden on
normal users.
> 4. compulsory expiration is a separate issue,
> which is bad, but can be mitigated by writing passwords on paper.
I prefer good passwords on paper over bad passwords online.
.per
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
