Paul CantrellNov 3
IN THIS HOUSE, WE BELIEVE
- passwords should be random
- data should be backed up
- anonymity should be the default
- dishwashers don’t need wifi
- the drivetrain should be airgapped from the Internet
Show threadCassandrichNov 3
@inthehands Passwords to most things honestly should be "cypherpunks".
Show threadPaul Cantrell
@dalias
Sounds pretty random to me!
Nov 3 at 10:37pmWeb
Show threadEsther #antifaNov 3
@inthehands @dalias
I have always taught all my interns to use passphrases. Once, an intern asked me what I meant, and I said, "Not a word, but a sentence, for example: 'I am crazy!'"... That became his first passphrase...
Show threadPaul CantrellNov 3
@src_esther @dalias
It’s an improvement over a single word! Really, though, most passwords should be machine-generated and stored in a password manager unless it’s essential that you be able to type it from memory.
Show threadFlexi Bell Nov 6

@inthehands @src_esther @dalias

Nope.

Password manager - single point of failure. When compromised renders all other sensible measures useless. Just don't.

A pasword neeeds to be:
- looooong
- memorable

That's really all.

(Btw: agreement with all you other points, of course!)

Show threadCassandrichNov 6
@flexi @inthehands @src_esther That doesn't scale. Passwords to a few key things that actually matter to you need to be long and memorable, but the hundreds of junk passwords for junk accounts you were forced to create and never wanted belong in password managers. Whether that's software on your device or a little notebook.
Show threadFlexi Bell Nov 6

@dalias @inthehands @src_esther

That's indeed a point.
But it's just not a good guideline for average users.

And yes, I think a notebook ist a way better place than a software in that case.

Show threadFlexi Bell Nov 6

@src_esther @inthehands @dalias

That's the spirit.

A "random" password is a (very common) mistake, because you could never memorize it and have to immediately create a security breach.

Show threadPaul CantrellNov 6

@flexi @src_esther @dalias
If only someone had invented some kind of…bear with me…“password manager” to solve this problem.

(In general, a passphase that is memorizable by a human does not have sufficient entropy to handle many forms of brute force attack; memorizable passwords should be kept to a minimum.)

Show threadFlexi Bell Nov 6

@inthehands @src_esther @dalias Just no.

Anything that will bruteforce your pwd does not care about "random". But will thank you for your single point of hack-one-get-all-free.

But don'f forget "long". My passwords are really long and I simply keep them in my mind.
And neither you nor any algorithm will bruteforce them in years. 🙂

Show threadFlexi Bell Nov 6

@inthehands @src_esther @dalias In simpler words.
A password manager is the big security breach I was talking about.

Unfortunately, that's an already very common misconception.
It does not become more difficult to crack just because *you* can no longer remember it.

Instead you create the biggest risk, a place where the password (or even *all* passwords) is stored - for not only yourself.