Asklemmy

43791 readers

1627 users here now

A loosely moderated place to ask open-ended questions

Search asklemmy 🔍

If your post meets the following criteria, it's welcome here!

Open-ended question
Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
Not ad nauseam inducing: please make sure it is a question that would be new to most members
An actual topic of discussion

Looking for support?

Looking for a community?

Lemmyverse: community search
sub.rehab: maps old subreddits to fediverse options, marks official as such
!lemmy411@lemmy.ca: a community for finding communities

~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~

founded 5 years ago

MODERATORS

Are you using passphrases? Is it worth it? (discuss.tchncs.de)

submitted 7 months ago by Wistful@discuss.tchncs.de to c/asklemmy@lemmy.ml

80 comments fedilink hide all child comments

Nowadays, most people use password managers (hopefully). However, there are still some passwords that you need to memorize, like master password (for a password manager), phone lock, wifi password, etc.

Security wise, can passphrase reach the strength of a good password without getting so long that it defeats the purpose of even using it?

you are viewing a single comment's thread
view the rest of the comments

[–] deranger@sh.itjust.works 44 points 7 months ago* (last edited 7 months ago) (16 children)

can passphrase reach the strength of a good password

Relevant xkcd: https://xkcd.com/936/

I’d love to hear from someone well versed in security if this is legit or significant weaknesses exist, but the math seems to check out as far as I can tell.

[–] foggy@lemmy.world 15 points 7 months ago* (last edited 7 months ago) (2 children)

For what a civilian target would worry about, using sufficiently long passwords is your best defense. Complexity is barely important.

111111111111111111111111111.1111 is an excellent password.

Everyone should Ctrl+f their password here. But also wait the 10 minutes it'll take to load the whole thing.

If your pw is on this list, change it immediately.

If it's less than 8 chars? Change immediately. If it's less than 10 chars? Change... Now.

If it's less than 14 chars, consider just making your password longer.

This advice will save more people in its simplicity than saying more.

Want a smidge more?

If you're paranoid, take a password that you think is decent, then insert it here, then use the output as your password.

Most times, pws aren't stored in plain text, they're stored using that algorithm. So, if your password is 'password', hackers night easily be able to see that your passwords encrypted value is exactly what that link will output if you put in 'password'. If your password is on that huge list from the beginning of the post, they can easily decrypt the encrypted password, because these passwords's hashes are known.

So, use the hash itself as a password.

Hell, throw a comma at the beginning to throw it off.

[–] luthis@lemmy.nz -1 points 7 months ago (1 children)

using sufficiently long passwords is your best defense

No, using 2FA is your best defense, along with wise recovery questions. It matters nothing if you know someone's password, but can't get the 2FA code.

[–] foggy@lemmy.world 7 points 7 months ago

In terms of security? Sure. We're talking about password entropy here.

load more comments (13 replies)