Annoying Password Rules Actually Make Us Less Secure | WSJ Tech News Briefing

[@KB-lw1lr]

Finally someone discussing about this. Beautiful conversation.

[@sherrijones9777]

Two factor authentication is a mess for seniors who have their landlines listed as their primary phone. My parents have been locked out of accounts because their landline cannot receive text codes to verify their identity.

[@Max-nt7ho]

Yes, my elderly friends still use non-smart flipped phones, no text messaging. I’ve been telling them that whether they want it or not, they need to keep up with some of the technology.

[@NazriB]

Lies again? Fail Security

[@pixelfairy]

Xkcd 936 shows a great way to make passwords and why. Using a few random words is easier for us to remember, but harder to guess than passwords with special characters.

[@NeminemMashups]

Plus side, long as they aren't dumb enough to have a *maximum* password length, or to *limit* what characters you can use too much (I have also seen both of those incredibly stupid things, but very rarely!), you can still use proper passphrases, as long as at least 1 of your words is a number and you properly punctuate it! For instance, here's a password that would satisfy most password rules: "1 of your words is a number and you properly punctuate it!" Forcing us to change our passwords constantly, though, is dumb, annoying, and *extremely* common.

[@luishsteuer1660]

I’m low key sending this to my IT

[@O1OO1O1]

Title the email, " free training"

[@antiquehealbot6543]

I always thought this password rule was really dumb and one more evidence to add up to my confirmation bias.

[@blablup1214]

Yes they are really bad. We have so many rules. I can't just use a password generator that generates a secure password. Have to create so specific password , that it gets hard creating a new password that gets accepted, but adding a number works just fine 🤣

[@carldenney4008]

It bugs me when a special character is required, but my favorite special character is not allowed.

[@jlshoem]

I have been a computer technician for more than 30 years. I agree with this guy 100% -- I don't always have my cell phone. If 2FA is required, I cannot login.

[@bobi6191]

If passwords are here to stay then password managers are basically the only solution. The number of accounts any individual has is easily going into the hundreds at this point. It's literally impossible to remember that many passwords unless you have a photographic memory. So you do things like reuse the same password or devise your own system for creating them, which compromises security. Of course, password managers have their own challenges when it comes to security but on balance, it's better than the methods we currently have to resort to. It's the way to go in both the personal and corporate environment.

[@HellCatLeMaudit]

One of the rules I learned to ignore is to write down your passwords. I write down my passwords in a notebook and keep that notebook in a safe place like my vault. The thing is, unless I am the CEO of a large company, or the head of the CIA, there is no reason someone would break into my house just to get that notebook with my passwords in it.

[@bobi6191]

@@HellCatLeMaudit I do this as well. This way, I have an offline backup in case I lose access to my password manager for whatever reason. As you say, no one is going to break into your house specifically to find that notebook and steal it, unless you're someone really important. As long as it’s kept in a secure and hidden place, I figure it’s pretty safe. Most passwords are stolen though brute force attacks, fishing and institutional hacks. Having a completely unique, 16-character password with lower and uppercase letters, numbers and special characters for every account is pretty secure against those types of attacks. At least, it’s considerably more secure than what I was doing before. As in, reusing a few variations of the same password for almost every account.

[@meejinhuang]

The longer the password, the better. The use of numbers and special characters is pointless.

[@alfredkhew1634]

Yes, using favourite lyrics or poems can be a good start, with little twist that only you know it, append all other characters to complying the rules. E.g. rainbowKeepFalling1980@ Unless you get the error that your password length is too long!

[@Y2B123]

@@alfredkhew1634 It is insane I cannot have a lengthy password. It is hashed anyway (right!?). Why do they care if it is 17 or 16 characters.

[@BariumCobaltNitrog3n]

I use a password manager but for some reason a few months ago it stopped generating strong passwords. I'd click on the enter password (the first of 2) and...crickets. What's worse is many times it won't ask if want it to remember it, so it goes into the BBOP. Fortunately "forgot password" is a thing and I use 2-factor authentication everywhere money is involved. Also, AI will be used to find a new business to start, what are overlooked niche markets, who wants to spend money?

[@MrStandana]

The biggest frustrating, pet peeve of mine is having to update a password, create a password or remember a password. I do all of this and still got hacked!!!

[@SorminaESar]

Annoying, maybe, when login or create the password, it's so annoying

[@Miami7]

I've actually seen people type in their complicated passwords so slowly that a shoulder surfer 10 miles away could see what they are typing.

[@specialk9999]

CEO’s of companies who get breached need to do prison time. Pretty much everyone is just screwed. Thanks a lot computer geeks

Why wasn’t it mentioned that browsers nowadays can autogenerate strong passwords and store them for the user? That’s like the most important development of the past 5 years!

[@O1OO1O1]

But those passwords are only as secure as where you're storing them. There are much better password management options then using the one that comes with your browser

@@O1OO1O1 There are more advanced password managers, but the ones that come with browsers are good enough for most people, IMO. As long as someone uses the same browser across devices and enable syncing, their passwords will be available whenever they need them.

[@Y2B123]

Chrome stores your password locally in plaintext at a set location, meaning any line of code with access to local files and the internet could compromise them entirely. Keep that in mind when you use it. Basically any program can see your password with minimal efforts, and unlikely Google, they use encryption to transmit your file so people can’t easily find out.

[@shmookins]

For a decade, my password for everything was six zeroes...

[@unrealengine4958]

And what is your password now?

[@IAmMzJess]

MULTI-FACTOR AUTHENTICATION and BIOMETRICS HAS ENTERED THE CHAT

[@CutiePi]

My bank has a length limit on passwords lol

[@bundy40962]

Corporal punishment would be a better solution than any HR password solution. Capital punishment on 3rd offense would also garner their attention.

[@K4R3N]

Zoey ❤️ 🥇

[@tonicalloway7227]

All passwords should be sentences..quotes..scripture..poems..song lyrics..I once had "my heart is on fire for elvira"..a favorite saying..

[@eagle13rodgerthatradar]

wow sounds like a van O thing

[@mrmakeshft]

Absolutely My Privacy my problem

[@andy8073]

no eating tidepods here

[@andy8073]

no tide pods please

[@jaydibernardo4320]

Fingerprints & facial ID might help.

[@andy8073]

look for the loopiest

[@andy8073]

I'll have roadkill of the day

[@andy8073]

possibly create it.

[@andy8073]

Is worrisome that tiktik saw that and promoted it

[@andy8073]

Did TikTok promote that?

[@andy8073]

we don't eat soap...

[@auro1986]

if it is security that you want then get a forty year old computer

[@andy8073]

we in U.S. A. tide pod challenge?

[@Username-u5e]

LinusTechTips Channel Hacked 😮

[@K4R3N]

Need biometrics, passwords are silly and outdated

[@andy8073]

Did TikTik promote that? how did that become a thing?

[@thunderking8925]

email logins are better

[@TomNook.]

Obsessed with bananas, eh

[@andy8073]

americans eat soap

[@andy8073]

only one example

[@andy8073]

or

[@arifulislamleeton]

Introduce myself my name is Ariful Islam leeton I'm software engineer and software development and website development

[@andy8073]

we influence

[@andy8073]

try

[@dasalsakid]

Captain Obvious

[@andy8073]

?

[@andy8073]

they eat cat's and dogs

[@andy8073]

chinese eat raccoon

[@Naumkovich]

Voice Zoe similar to artificial intelligence, and the interlocutor is a person Wsj you can at least voice the text without a robot, аllo