←back to thread

430 points tambourine_man | 1 comments | | HN request time: 0s | source
Show context
calgoo ◴[] No.41879171[source]
I always liked the 1Password word passwords… you select the number of words and it generates each word in upper OR lowercase, and connect them with symbols or numbers. Easy to memorize, and better then keepass or others that use more fixed formats: same characters between words and words are just in title format where the first letter is upper case and rest is lowercase.
replies(5): >>41879306 #>>41879343 #>>41879408 #>>41879433 #>>41879512 #
jorvi ◴[] No.41879408[source]
The problem is that many sites still use archaic password rules.

1Password should by default just always capitalize one word, and add “1” at the end of the memorable password. Since the words are separated by “-“ or “.”, you already hit the “at least one symbol” rule.

replies(3): >>41879566 #>>41880012 #>>41883980 #
extraduder_ire ◴[] No.41880012[source]
I was presently surprised by the password requirements when I created a bugzilla account just the other day.

    - Password must be at least 12 characters long.
    - And the password must also contain either of the following:
        - A phrase containing at least four unique words of three characters or longer
        - or password contains at least 3 of the following qualities:
            - uppercase letters
            - lowercase letters
            - numbers
            - punctuation characters
            - or more than 12 characters

I went with the phrase option.
replies(2): >>41880596 #>>41882212 #
1. jszymborski ◴[] No.41882212{3}[source]
Not sure why people are re-inventing the wheel here. Just use zxcvbn[0] to determine password strength, and reject passwords if it falls below an unacceptable minimum. Because you can compute it client-side, you can give real-time feedback.

[0] https://github.com/dropbox/zxcvbn