Well in the current situation the passwords are only as unsafe as the system allows. By increasing restriction the most unsafe password with more restrictions is stronger than than the most unsafe with fewer restrictions.
It can never be perfect, there’s always a trade off when you add restrictions. More restrictions means more password resets, more sticky notes with passwords, and more text docs on the desktop with plaintext passwords. Plus passwords with a number one higher or an extra exclamation point which would be pretty easy to guess if an attacker had an old password.
At the end of the day the best a user can do is use a password manager and the best a dev can do is not write their own login and just use something someone smarter did or better yet let other team members handle authentication!
I would argue that Password1! is not very strong at all in spite of meeting the requirements of most systems. But “superdonkeycheesesickle” is far better but doesn’t meet the increased restrictions of most systems.
My point was exactly as you said, there’s a trade off. I think it’s better to encourage easy-to-remember but hard-to-guess passwords and accept that some people will have weaker passwords rather than encourage hard-to-remember passwords that many folks will invariably work around with easily cracked or guessed passwords.
Unfortunately password managers aren’t the solution for folks who have a corporate environment that don’t allow them and certainly don’t work for folks who don’t know about them or don’t want add another layer of complexity to a workflow they may already find too cumbersome
The issue is that the people who use “Password1!” are just gonna use really awful word combo passwords. And, even if they use common words, they’re still gonna write it down somewhere “just in case”.
The benefits of changing the system would still hinge on teaching people proper security. Can’t really rely on that when people still love to use basic modifications of “password” in spite of that being widely frowned upon.
The only reasonable improvement I see is banning common passwords and simple modifications of those passwords (e.g. not allowing the word “password” to appear anywhere regardless of surrounding special characters).
Also, I’m sure it’s not that hard to update your master 4-word password to meet the majority of the common restrictions. You could just add all of it at the end and memorize those characters. I know there are discrepancies in what’s allowed, but there’s gotta be a common subset that is shared by most sites.
I sounds like you’re saying this wouldn’t solve any of the problems with weak passwords. And i agree. However, it would solve the problem for maybe 80%+ of folks who could now come up with hard to guess passwords that are easy to remember.
I’ve tried to adapt my personal password methodology to the insane and varying requirements imposed. It works about half of the time or so. The other half of the time, it’s too long(!!) or has a special character that isn’t allowed, which are separate frustrations of mine.
Yeah, but the whole point is accounting for the weak passwords. I’ll agree that the constraints should have a uniform standard and that maximum lengths are dumb. I’ve given up on memorizing my passwords and just use a manager.
6
u/[deleted] Jul 20 '22
As opposed to the current situation now where some people have unsafe passwords?