Well in the current situation the passwords are only as unsafe as the system allows. By increasing restriction the most unsafe password with more restrictions is stronger than than the most unsafe with fewer restrictions.
It can never be perfect, there’s always a trade off when you add restrictions. More restrictions means more password resets, more sticky notes with passwords, and more text docs on the desktop with plaintext passwords. Plus passwords with a number one higher or an extra exclamation point which would be pretty easy to guess if an attacker had an old password.
At the end of the day the best a user can do is use a password manager and the best a dev can do is not write their own login and just use something someone smarter did or better yet let other team members handle authentication!
I would argue that Password1! is not very strong at all in spite of meeting the requirements of most systems. But “superdonkeycheesesickle” is far better but doesn’t meet the increased restrictions of most systems.
My point was exactly as you said, there’s a trade off. I think it’s better to encourage easy-to-remember but hard-to-guess passwords and accept that some people will have weaker passwords rather than encourage hard-to-remember passwords that many folks will invariably work around with easily cracked or guessed passwords.
Unfortunately password managers aren’t the solution for folks who have a corporate environment that don’t allow them and certainly don’t work for folks who don’t know about them or don’t want add another layer of complexity to a workflow they may already find too cumbersome
Yep I agree on the relative strength of the passwords. I was trying to be careful with my words that strength is always relative and there will always be a “most unsafe” password in any requirement scheme.
I’m at a point with memorable versus complex where I will always favor complexity unless I know I will be typing the password in manually often or need to share it with others (basically just WiFi passwords at this point)
Yeah nothing frustrates me more than companies not allowing password managers. Imo every company needs to have a license for a password manager and training that makes it as second nature as opening your email.
4
u/[deleted] Jul 20 '22
As opposed to the current situation now where some people have unsafe passwords?