How long should a password be? - eviltoast
  • Toes♀@ani.social
    link
    fedilink
    English
    arrow-up
    10
    arrow-down
    3
    ·
    5 days ago

    People gotta stop doing QkFEcEEkJFcwUkQ=

    aQuickBrownFoxJumpedOverALazyDog$nuggle9 is far easier to remember and secure.

    • Deebster@infosec.pub
      link
      fedilink
      English
      arrow-up
      11
      ·
      5 days ago

      The article is from Bitwarden, which is a password manager - using them you don’t need to remember individual passwords (or type them, normally).

      Bitwarden does have an option to use passphrases, I just tried it and it gave me washtub-moocher-dominoes.

      • cynar@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        5 days ago

        I use auto generated passphrases. It’s mostly for the occasions where I need to give the password to someone, without logging into my bitwarden account, on the device. It’s a lot easier, for comparable levels of security.

    • fxomt@lemm.ee
      link
      fedilink
      English
      arrow-up
      6
      ·
      edit-2
      5 days ago

      aQuickBrownFoxJumpedOverALazyDog$nuggle9 is far easier to remember and secure.

      Not really, you have a better chance if you use a completely random set of words. I remember hearing of someone getting their bitcoin stolen from their wallet despite their password being from an obscure Afrikaans poem.

      Diceware’s a really good tool for this. https://www.eff.org/dice. There are also websites to generate one for you instead of rolling actual dice.

      But it’s only good for passphrases. You’re better off generating a complex password since you can store it in bitwarden.

      • Toes♀@ani.social
        link
        fedilink
        English
        arrow-up
        4
        ·
        5 days ago

        Not really, you have a better chance if you use a completely random set of words. I remember hearing of someone getting their bitcoin stolen from their wallet despite their password being from an obscure Afrikaans poem.

        Precisely why I salted it.

        • fxomt@lemm.ee
          link
          fedilink
          English
          arrow-up
          1
          ·
          5 days ago

          I have to look into password salting. I don’t use it but it’s interesting. Do you use a unique salt for each password or the same one for all?

          • Toes♀@ani.social
            link
            fedilink
            English
            arrow-up
            2
            ·
            5 days ago

            Always something a bit unique, can’t make it predictable if someone managed to dump a list of em. This also isn’t the formula I used just an example. Random words is also better if your memory is decent, they can even be your salt.

    • criitz@reddthat.com
      link
      fedilink
      English
      arrow-up
      2
      ·
      edit-2
      5 days ago

      I switched to using word phrases after having to type in these Qjdu37hYdu4sjdh&) |] >[vry monstrosities or communicate them to someone else one too many times.

  • fxomt@lemm.ee
    link
    fedilink
    English
    arrow-up
    6
    ·
    5 days ago

    For passwords i have to remember i use passphrases.

    But for stored passwords? i like 35 characters. Most services accept it and doesn’t seem to have a con.

  • Tempo [he/him]@hexbear.net
    link
    fedilink
    English
    arrow-up
    5
    ·
    5 days ago

    if you have to ask, not enough. i once had a bank whose system didn’t accept any password longer than 10 characters, and that was only after i called them up and asked why i couldn’t log in