←back to thread

Apple Passwords’ generated strong password format

(rmondello.com)
430 points tambourine_man | 1 comments | 18 Oct 24 11:12 UTC | HN request time: 0.201s | source
Show context
mr_mitm ◴[18 Oct 24 13:40 UTC] No.41879391[source]▶
I'm glad someone is thinking about UX and ergonomics when it comes to passwords. Most people I interact with have by now realized that generating passwords is a good idea. But if you are already generating the password, please do not include special characters. I regularly use different keyboard layouts (sometimes it is not even clear which layout is active, like in the vSphere web console), and the fact that passwords are often not shown on the screen when typing them makes for terrible UX and causes frustration.

The usual advice about character classes is only for casual users who don't know what makes a secure password. Entropy is the deciding factor: Ten random lower case letters is much more secure than "Summer2024!", which satisfies most password rules and has more characters.

Personally I stick to lower case letters for things like my Netflix password or Wifi key, because typing with a TV remote can be a huge pain. To keep a similar entropy, just increase the length by one or two characters.

replies(10): >>41879469 #>>41879535 #>>41879556 #>>41879734 #>>41879735 #>>41880345 #>>41880499 #>>41881423 #>>41881471 #>>41883418 #
lhamil64 ◴[18 Oct 24 13:58 UTC] No.41879535[source]▶
How often do people actually end up typing these random passwords though? Personally, I almost always can copy/paste or autofill. For devices like TVs, it seems like many of them let you pair via a QR code or other mechanism. And sure, there are times where you need to manually type a password, and for those specific cases you can use a different scheme (like avoiding special characters or using something like Diceware https://diceware.dmuth.org/) but I wouldn't go so far as to never include special characters. IMO if you expect to always be able to autofill, use as many character classes as possible.
replies(7): >>41879546 #>>41879604 #>>41879627 #>>41880507 #>>41880948 #>>41885651 #>>41911174 #
1. tzs ◴[18 Oct 24 16:28 UTC] No.41880948[source]▶
As you note many devices now have mechanisms that let you enter the password from a phone or computer where it should be possible to copy/paste from a password manager.

But that usually requires some sort of two way communication between your computer or phone and the device you are setting up or requires that the device has a network connection to a server that your phone or computer can also connect to.

You may still need to manually enter the password for that network connection.

Many WiFi streaming TV boxes are like that if I recall correctly. Manual setup to give them network access, but then later when setting up apps on them for Disney+, Netflix, and the like the apps can use an authentication protocol that doesn't need manual password entry.

I make my WiFi password easy to type for that reason.