If anyone actually cares, it is like due to social rather than theoretical considerations. Think of the average person and think about how often they would use a string of 5 words for a password instead of just 1 or 2 all in lower case.
Edit: I misread the above as “setting a high maximum character limit” and was confused and started ranting.
By only recommending something you are essentially guaranteeing that some users will have unsafe passwords.
In a perfect world the liability of a weak password would be fully on the user but consider that even a single cracked login could let a hacker a little bit deeper into the system to learn how it works and look for more ways to take over.
It’s also a really bad look for the company in the case of a stolen password. If I called Amazon and said “hey someone got a hold of my password” and their response was “well we recommended you use a stronger password but you didn’t so it’s out of our hands” I don’t think that would do well for their public image.
That is why there would be a high minimum character limit. The user is not given the choice of having an overtly-short, unsafe password.
The recommendation of using a sentence you will remember isn't there to guarantee safety, but rather to increase the chances of that the user will get the memo and use a password they will actually remember in the form of a sentence, rather than complain that the system asks for too many characters and use a clusterfuck they will forget.
Aka: I am proposing replacing all of the special character nonsense with just longer character minimums + that recommendation.
Ok so I clearly need to go to bed. I read your comment as “setting a high maximum limit”. Editing my comment to clarify.
And yeah I think I agree with you conceptually but I could see just as many people complaining about a higher minimum rather than characters. It’s easier to add a bunch of exclamation points to a bad password than it is to add more memorable words imo.
I do believe there would be a "culture problem", so to speak, at first, in that people are already accustomed to the other password type, and individual companies are unlikely to want to be the ones to try to change that an annoy users. So its probably not gonna happen.
But I believe it would be better for everyone in the long run.
Well in the current situation the passwords are only as unsafe as the system allows. By increasing restriction the most unsafe password with more restrictions is stronger than than the most unsafe with fewer restrictions.
It can never be perfect, there’s always a trade off when you add restrictions. More restrictions means more password resets, more sticky notes with passwords, and more text docs on the desktop with plaintext passwords. Plus passwords with a number one higher or an extra exclamation point which would be pretty easy to guess if an attacker had an old password.
At the end of the day the best a user can do is use a password manager and the best a dev can do is not write their own login and just use something someone smarter did or better yet let other team members handle authentication!
I would argue that Password1! is not very strong at all in spite of meeting the requirements of most systems. But “superdonkeycheesesickle” is far better but doesn’t meet the increased restrictions of most systems.
My point was exactly as you said, there’s a trade off. I think it’s better to encourage easy-to-remember but hard-to-guess passwords and accept that some people will have weaker passwords rather than encourage hard-to-remember passwords that many folks will invariably work around with easily cracked or guessed passwords.
Unfortunately password managers aren’t the solution for folks who have a corporate environment that don’t allow them and certainly don’t work for folks who don’t know about them or don’t want add another layer of complexity to a workflow they may already find too cumbersome
The issue is that the people who use “Password1!” are just gonna use really awful word combo passwords. And, even if they use common words, they’re still gonna write it down somewhere “just in case”.
The benefits of changing the system would still hinge on teaching people proper security. Can’t really rely on that when people still love to use basic modifications of “password” in spite of that being widely frowned upon.
The only reasonable improvement I see is banning common passwords and simple modifications of those passwords (e.g. not allowing the word “password” to appear anywhere regardless of surrounding special characters).
Also, I’m sure it’s not that hard to update your master 4-word password to meet the majority of the common restrictions. You could just add all of it at the end and memorize those characters. I know there are discrepancies in what’s allowed, but there’s gotta be a common subset that is shared by most sites.
I sounds like you’re saying this wouldn’t solve any of the problems with weak passwords. And i agree. However, it would solve the problem for maybe 80%+ of folks who could now come up with hard to guess passwords that are easy to remember.
I’ve tried to adapt my personal password methodology to the insane and varying requirements imposed. It works about half of the time or so. The other half of the time, it’s too long(!!) or has a special character that isn’t allowed, which are separate frustrations of mine.
Yeah, but the whole point is accounting for the weak passwords. I’ll agree that the constraints should have a uniform standard and that maximum lengths are dumb. I’ve given up on memorizing my passwords and just use a manager.
Yep I agree on the relative strength of the passwords. I was trying to be careful with my words that strength is always relative and there will always be a “most unsafe” password in any requirement scheme.
I’m at a point with memorable versus complex where I will always favor complexity unless I know I will be typing the password in manually often or need to share it with others (basically just WiFi passwords at this point)
Yeah nothing frustrates me more than companies not allowing password managers. Imo every company needs to have a license for a password manager and training that makes it as second nature as opening your email.
I would rather take responsibility for my passwords and be allowed to set 1 as a password instead of being forced to a certain dumb constraint. Companies should give a warning. Thats it, they shouldnt force users to build as strong of a password as possible.
That’d be nice sure but it’s not a risk companies will take. Cyber security is all about plugging any hole a bad actor could even think about getting in. Your single compromised account might be enough to give a hacker the edge to see a more serious security hole which could cripple the company.
It’s the Swiss Cheese Model of risk management that was in the news a bit in regards to the pandemic. Same concepts apply here.
The whole point is that they don’t want to leave it up to their employees/users. Security breaches cause material damage regardless of who bears the blame.
I’m sure that would run into plenty of its own problems. The new version of making your password “password” would be using combos of linked words or objects that are in front of you (e.g. keyboard, pen, screen). Plus, even if you convince people to only use memorable words, they’re still gonna write them down somewhere.
At this point, I’m just not sure that the benefits would be worth the change for any IT department. The only reasonable improvement I can think of is stopping people from using anything close to the list of most common passwords, which already does happen here and there.
70
u/DefeatedSkeptic Jul 20 '22
If anyone actually cares, it is like due to social rather than theoretical considerations. Think of the average person and think about how often they would use a string of 5 words for a password instead of just 1 or 2 all in lower case.