[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <8d97d1b9-b20b-c229-6bdc-ca1e39b3ec58@bestmx.net>
Date: Mon, 30 Oct 2017 22:24:55 +0100
From: "e@...tmx.net" <e@...tmx.net>
To: passwords@...ts.openwall.com
Subject: Re: Real world password policies
> There is definitely a tradeoff between blacklist size and user
> frustration--a blacklist that is too long is even worse than a complex
> set of composition rules, because you can't predict what will be
> acceptable and what won't.
the most frustrating part is that those policies (all competing which is
stupider) ARE MANDATORY.
if i am stupid enough to have a bad password JUST TELL ME THAT.
whether i want to remain stupid is not your business.
also there is an interesting possibility for an unforeseen social
consequences:
when every worthless facebook or forum enforce "strong" (or at least
what they perceive as strong) password policies, they encourage the
users to reveal their PASSWORD CHOOSING STRATEGIES which could be
inappropriately strong for such petty usecases, thus weakening the
users' choice in other serious usecase that are indeed requiring better
passwords.
are you following me? i am sorry for not being very eloquent...
it is already difficult for the users to maintain the loads of
paswords... and every password policy is trying to place more burden
onto the user. to the point where the user will eventually use one of
his serious passwords for some stupid facebook.
do you see this danger?
please encourage your users to maintain A SEPARATE PASSWORD CREATING
STRATEGY for all non-critical password beggars and feed them with
passwords as similar as possible.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
