this post was submitted on 03 Nov 2023
293 points (86.7% liked)
Technology
68567 readers
4379 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Just use longer passwords?
What's do you think is a good length? I think it has to be at least 10 but over 15 is much better.
Idk exactly how accurate this is but seems valid
The colors on that are kinda confusing. 6tn years is yellow, but 2k years is green?
It seems like the designer didn't notice the error
So those annoying as hell "6 character, lowercase and uppercase letters, special character" passwords give a full 6 minutes of protection. Good to know.
For 6 characters is 5 seconds. I like the idea of using passphrases that mix casing with symbols but still they look like like real words, it make easier to write them down when you need them and they can be very long, so they are quite secure, of course using a password manager to be able to manage them.
Damn, even worse than I thought. I wish someone would show this to the people who set those ridiculous password requirements.
I was glad when my work did away with monthly password changes and went with 15 characters minimum as the only requirement.
I wonder if this assumes the cracker knows how long etc the password is when they start cracking.
I always make my passwords "a" because I figure they'll start cracking attempts at 5 characters 😁
In EVE Online that's called 'getting underneath the guns'. 🎓
It depends on how the password is stored / KDF used (what type of hash, salting, bcrypt, etc).
Judge for yourself if it's an old website or old piece of software that might use (god forbid) MD5. Since one would not normally know that, I'd go with 20 (good, cryptographically) randomly generated upper/lower/digits if using a password manager, or 40ish characters passphrase if you need to remember and/or easily type it. Add some punctuation / special chars (spaces, commas, dots, paranthesis, etc) if it's an important masterkey (ie password manager key, encrypted container, etc) and you have decent typing skills.
Some shitty sites / routers don't accept certain special characters hence go with upper/lower/digits as standard but use longer lengths (if the shitty site allows you and doesn't limit that too). Limits to what a password should contain and/or length limits would be a sign of lazy programming and poor password management, so treat them as unsecure from the get-go (yes, even big names like Oracle have piss-poor security or lazy implementation). Good programming nowdays shouldn't have those limits, as user input sanitization / injection protection exists, and hash functions have a fixed length no matter what the input length is.
Also very important, don't reuse passwords for online accounts. Hence a password manager remembering them for you. There are still websites storing passwords in plain text. You wouldn't want your local pizza hut know or leak your email password by being hacked.
Rookie numbers. Max out the character limit.
Seriously tho: go for at least 80 bit randomized characters. If it's something you have to type, use a couple of random words. Longer passwords are exponentially more secure.
All I can picture in my head is Matthew mcconaughey telling Leonardo DiCaprio he needs to masturbate more