On 1/21/24 06:22, Jeffrey Walton wrote:
On Sun, Jan 21, 2024 at 6:31 AM Tim via users users@lists.fedoraproject.org wrote:
On Sun, 2024-01-21 at 02:56 -0800, ToddAndMargo via users wrote:
This all goes back to using easy passwords. And the same passwords on different sites:
https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-auth...
"In fact, databases of known breached account information reveal the actual passwords in use around the world, and we can see that people typically fail to choose sufficiently long, complex, and unique passcodes. A study of the most common passwords used globally has “123456”, “qwerty” (six consecutive keys on a keyboard) and “password” among the top 5."
Password construction rules were always a crock of crap. Must have one capital, symbol, number, etc just gave a series of clues to crackers. While making it harder for you to come up with a code you can remember and type (and just watch dyslexic people try to get these things right, illiterate people who can't spell, or anybody on a mobile phone touch screen). Then have to go through it again and again on forced periodic changes.
Password complexity requirements are still a load of crap. No one knows where the crap came from. Searching for the history of complexity requirements seems to point to Microsoft NT 3.5. And we know complex passwords result in weaker passwords from Security Usability studies.
I thought so.
Another load of crap is password rotation policies. You never throw away a good secret unless there's evidence of misuse or breach. And forcing users to gratuitously change their password results in users choosing weaker and weaker passwords over time as they are constantly grinded on to change good passwords. We know this from Security Usability studies.
I can personally attest to this from my travels as a computer consultant
Anyone designing an authentication system would be well served to read Peter Gutmann's Engineering Security, https://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf. Chapter 7 covers Passwords.
Jeff
I needed a password eight characters long I picked "Snow White and the Seven Dwarfs".
Okay, that was a "Dad Joke" but it probably is a really strong password and easy to remember. I recommend run on phrases to my customers. When I make them up for them, I often use a phrase that flatters their business. Those they never forget.