[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALnMstXnBfdKabvwT+8F=8iCUwqrZQB_0WWGRVFGzqaVsTpWfg@mail.gmail.com>
Date: Wed, 24 Aug 2016 23:10:01 +0300
From: Anton Dedov <adedov@...il.com>
To: passwords@...ts.openwall.com
Subject: Re: GMOs And Passwords
Hi!
Finally interesting idea for me!
It looks like good advice for friends and relatives. I remember Per's
password advice for his mother...
But how we as service developers can automate checks for such kind of
advices? Should we? Or may be it is totally about starting new wave of
better password propaganda?
Thanks.
On Wed, Aug 24, 2016 at 10:56 PM, e@...tmx.net <e@...tmx.net> wrote:
>
> it is true that people can not produce anything random at all,
> but introducing an external RNG is not necessarily the only solution, and
> not necessarily the best solution.
>
> it is also clear from your "coin-flipping" example that introduction of
> mandatory capital letters in the password generation procedure do not
> solve the stated problem -- mandatory capital letters are equivalent to
> flipping more than one coin, which obviously suffer from the same
> non-randomness as flipping a single coin.
> therefore "password policies" do not improve the quality in question.
>
> But!
>
> A password does not have to be random!!!
> A password have to be UNKNOWN and UNOBTAINABLE for the attacker.
> (it is not equivalent to randomness)
>
> Look, since we know that humans are destined to fail in creating a random
> password, it should be obvious that asking them to fail is a stupid move.
> Whether you want it or not you must encourage humans
> to create non-random passwords (unless they rely completely on a machine
> RNG)
>
> I suggest making DEEPLY PERSONAL passwords.
> You can ask your users to use a bit of memories that they know they never
> shared with anyone; write a sentence about it, add some flavour;
> Job's done.
--
Anton Dedov
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
