[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAKws9z3BZ36en59vNjNemwhLTgx5xMstFGp5g5bk3mx6V9530g@mail.gmail.com>
Date: Wed, 24 Aug 2016 16:32:24 -0400
From: Scott Arciszewski <scott@...agonie.com>
To: passwords@...ts.openwall.com
Subject: Re: GMOs And Passwords
http://www.passwordmeter.com/ says:
Score:
100%
Complexity:
Very Strong
I
'm not sure what your point is?
Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com>
On Wed, Aug 24, 2016 at 4:28 PM, e@...tmx.net <e@...tmx.net> wrote:
> On 08/24/2016 10:22 PM, Scott Arciszewski wrote:
>
>> On Wed, Aug 24, 2016 at 4:18 PM, e@...tmx.net <mailto:e@...tmx.net>
>> <e@...tmx.net <mailto:e@...tmx.net>>wrote:
>>
>> [insult skipped]
>>
>> But how we as service developers can automate checks for such
>> kind of
>> advices? Should we?
>>
>>
>> we should NOT!
>>
>> (1) it is completely different area of responsibility.
>> do not mess with the users' free will.
>> expending of your "care" beyond the boundaries of your responsibility
>> always cases more trouble than good.
>>
>> (2) an ideal password should FAIL all checks.
>> checks are LIMITATIONS.
>> a password that complies to a policy is worse than a password that
>> does not.
>>
>>
>> On one side, I can see how "don't
>> reject any values" could lead to more work for attackers.
>>
>> On the other, if they're certainly going to guess 123456 and password,
>> maybe we shouldn't allow users to use those strings in the first place?
>>
>
> it is that almost all policies that reject 123456 also reject very
> sophisticated very personal and enormously strong passwords.
>
> this rejection is uncontrollable you can not guarantee that your policy
> does not reject: "on the second day of waning moon my granma baked
> seventeen cup cakes with swastika frosting"
>
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
