Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by ActorNightly | Hacker News Reader

Parent Full thread

ActorNightly·

Or just have a min password length requirement that is at least a 5 word sentence.

Easier to remember, and more secure.

View on HN

Although password security makes no difference to how these devices were hacked, by password leaks.

Method wise, you are correct. However, forcing all the users to adopt a new password creation paradigm will statistically make this a very small issue.

I kind of doubt it. People will use the same password on every website, and if you require it to be 4 words, they'll just make it "my password is password" or something. Password requirements don't improve password security. Reuse and phishing are always going to be the main problem.

(Of course, bad passwords are bad. One time I exposed a mysql database I use for local unit tests to the Internet with the credentials root:test. It was hacked in hours, with a message saying where to send bitcoins to get the database back. Slightly stronger passwords do help with that sort of thing.)

Have forced 2fa through e-mail for new device/ip location more than X miles away. Users rarely login from a new device, or randomly login from a different country. Tagging those as suspicious and making the user get a code from their email is simple and goes a long way in increasing security with minimal annoyance.

If you still use it on multiple sites, and one of those sites is storing it in plaintext, you'll still have the same security issue. Its very rare that someone has broken a password through character-by-character brute force.

Or require email verification if logging on from more than 1 app.

You know, I hadn't thought about that.

Reply on news.ycombinator.com