Comment on Please create a non-secure password.

• frezik@midwest.social ⁨2⁩ ⁨days⁩ ago

  Yeah, that’s going to be a terrible system. The human brain isn’t capable of keeping track of enough entropy to create a secure password system.

  More generally, it’s a big red flag when anybody thinks they can make a better system than publicly available and verified systems. You’re not capable of that, I’m not capable of that, Bruce Schneier is not capable of that. No matter how smart you are, you missed something. That’s why I didn’t need to know a single detail.

  source

  • Buffalox@lemmy.world ⁨1⁩ ⁨day⁩ ago

    he human brain isn’t capable of keeping track of enough entropy to create a secure password system.

    What an idiotic argument, the level of entropy comes from the rules first and foremost, putting a 1 and an A together is the exact same entropy as using 2 and B.

    More generally, it’s a big red flag when anybody thinks they can make a better system than publicly available and verified systems.

    You completely fail to understand the argument. I’m not arguing my passwords are stronger, I’m arguing they are SAFER! because they are not stored on 3 different systems, one of which could theoretically have a vulnerability.

    source

    • frezik@midwest.social ⁨1⁩ ⁨day⁩ ago

      What an idiotic argument, the level of entropy comes from the rules first and foremost, putting a 1 and an A together is the exact same entropy as using 2 and B.

      Oh dear, no. You cannot match a cryptographic (P)RNG for generating passwords. Not even close.

      source

      • Buffalox@lemmy.world ⁨1⁩ ⁨day⁩ ago

        True, my argument is that in practice it doesn’t matter. How many passwords of REASONABLE strength are brute forced? Opposed to how many are lifted from services with lacking security?

        source

        • -> View More Comments