The Technology Vent and Rant Thread

[j.p.s]

Originally Posted by Renate

The experts have finally decided that forcing people to change their passwords periodically is counterproductive.

Originally Posted by ratinox

To be fair, security experts have know and advocated this for decades. It's just taken that long for the NIST to catch up.

I hope it is much sooner that corporations start following the NIST recommendations.

[DNSB]

For the moment, I use Firefox and it's random password generator to generate passwords for don't really care sites. For other sites where security is more important to me, I use a pretty simple Python password generator called pw_generator.py. Looking at it I just realized that when I switched to using secrets, I never removed the other imports. It's not something that I use all that often but handy when I need it.

import string
import random
import secrets

# Getting password length
length = int(input("Enter password length: "))

password = ''.join((secrets.choice(string.ascii_letters + string.digits + string.punctuation) for i in range(length)))
print(password)

C:\Users\user\Desktop>python pw_generator.py
Enter password length: 16
QSQMf7,"IrG&:7^3

C:\Users\user\Desktop>python pw_generator.py
Enter password length: 24
Y6rBEU2DH>vj&b0o8!.hr5;A

[ratinox]

Originally Posted by DNSB

For the moment, I use Firefox and it's random password generator to generate passwords for don't really care sites.

I use Theodore Ts'o's pwgen, the one originally written to create pronounceable passwords but has been extended to be random enough. Out of the box it does this:

$ pwgen 8 1
xahS5ohx

but I typically do this:

$ pwgen -nsBy 16 1
F$`|]3hNmm^,VM+m

or with some constraints when sites dislike certain non-alpha characters.

[DNSB]

Originally Posted by ratinox

I use Theodore Ts'o's pwgen, the one originally written to create pronounceable passwords but has been extended to be random enough. Out of the box it does this:

That one works too. Basically, not a task that I do that often since I reserve those passwords for what I consider to be high security sites so I wanted quick and dirty but decent randomness.

[ratinox]

Originally Posted by DNSB

That one works too. Basically, not a task that I do that often since I reserve those passwords for what I consider to be high security sites so I wanted quick and dirty but decent randomness.

Whereas I use this for everything. Which is why I have around 400 unique passwords between my work and personal accounts .

[JSWolf]

Originally Posted by ratinox

Then perhaps your wallet is bad advice for you. That does not make it bad advice for many others.

How many people have room in their wallet for a small notebook? I don't know of anyone.

[JSWolf]

Originally Posted by ratinox

Colloquially "rubber hose cryptanalysis".

Colloquially"rubberhosecryptanalysis"

That would make a good password.

[Quoth]

Too obvious.

[ratinox]

Originally Posted by JSWolf

How many people have room in their wallet for a small notebook? I don't know of anyone.

Yes you do: me. My daily carry is a Fjallraven passport wallet. Though I don't carry my passport all the time, just when traveling, it's very convenient for my daily carry for other items. It's also just large enough to fit my phone if I want.

[JSWolf]

Originally Posted by Quoth

Too obvious.

With the quotes?

[JSWolf]

Originally Posted by ratinox

Yes you do: me. My daily carry is a Fjallraven passport wallet. Though I don't carry my passport all the time, just when traveling, it's very convenient for my daily carry for other items. It's also just large enough to fit my phone if I want.

What we are talking about it the type of wallet used for money and cards.

[ratinox]

Originally Posted by JSWolf

What we are talking about it the type of wallet used for money and cards.

Yes. There are many kinds of wallets and card holders besides the common bifold and trifold pocket bricks. I use this one:

https://www.fjallraven.com/us/en-us/...ssport-wallet/

[ownedbycats]

I use Thunderbird filters to sort emails and such. So of course when an email newsletter changes the from address or subject line or something then the filters stop working.

[DNSB]

Originally Posted by ratinox

Whereas I use this for everything. Which is why I have around 400 unique passwords between my work and personal accounts .

My passwords for low security accounts are unique, just not as complex as my high security account passwords. Do I really care if someone spends the hours needed to crack the password on my account for the local newspaper? Whereas my banking passwords are going to take a bit longer to crack. Yes, I do realize that yesterday's overkill is today's barely adequate and tomorrow's security breach waiting to happen. One site I use now allows a 1023 character password/passphrase but they have dropped all upper/lower/digits/special characters requirements though they do run your password through a quick dictionary words tool (rather unnecessary IMNSHO). The correcthorsebatterystaple password used in XKCD's example would not be accepted since it consists of a string of dictionary words.

[Quoth]

Originally Posted by ownedbycats

I use Thunderbird filters to sort emails and such. So of course when an email newsletter changes the from address or subject line or something then the filters stop working.

That's really annoying. I have that problem too.