The primary password rule we used was also the simplest one: length. … is a spectacular failure of imagination in a world of Unicode and Emoji.Īs we built Discourse, I discovered that the login dialog was a remarkably complex piece of software, despite its surface simplicity.
But expressing your love of entropy as terrible, idiosyncratic password rules … über-geek, know all about the concept of entropy. They consistently ruin every piece of software I've ever written.
Of course not, because have you met any users lately? Particularly if we stop thinking like Ugly ASCII Americans.Īnd what of those nice, long passwords? Are they always secure? aaaaaaaaaaaaaaaaaaa You may also be surprised, if you paste the above four Unicode emojis into your favorite login dialog (go ahead – try it), to discover that it … isn't in fact four characters.Īs it turns out, even the simple rule that "your password must be of reasonable length" … ain't necessarily so. Or this (hypothetical, but all too real) seven character password? ش导พิ한 I'm sorry but your password must contain 1 char each from: Arabic, Chinese, Thai, Korean, Klingon, Wingdings and an emoji- Finley Creative March 3, 2016 What about this eight character password? 正确马电池订书钉 What about this four character password? ✅🐎🔋🖇️ A long password is much more likely to be secure than a short one … right? So then perhaps we have one rule, that passwords must not be short. These days, given the state of cloud computing and GPU password hash cracking, any password of 8 characters or less is perilously close to no password at all. I'll go so far as to say your password is too damn short. We can certainly debate whether "correct horse battery staple" is a viable password strategy or not, but the argument here is mostly that length matters. Have you seen the classic XKCD about passwords?
The more likely you are to use a truly random password generation tool, like us über-geeks are supposed to, the more likely you have suffered mightily – and daily – under this regime. The world is absolutely awash in terrible password rules:īut I don't need to tell you this. I don't know if there's an afterlife, but I'll be finding out soon enough, and I plan to go out mad as hell. Let this pledge be duly noted on the permanent record of the Internet. If we don't solve the password problem for users in my lifetime I am gonna haunt you from beyond the grave as a ghost /Tf9EnwgoZv- Jeff Atwood August 11, 2015 Of the many, many, many bad things about passwords, you know what the worst is? Password rules.
0 kommentar(er)
