30 years of failure: the username/password combination

http://arstechnica.com/business/news/2009/10/30-years-of-failure-the-user-namepassword-combination.ars?utm_source=rss&utm_medium=rss&utm_campaign=rss

by soundsop • 17 years ago

13 10 17 years ago

arstechnica.com

pie• 17 years ago

I think we're all well aware that typical users tend toward overly simple password choices. That's why helpful measures such as password strength gauges and password content requirements have become so commonplace. This is nothing new.

vaksel• 17 years ago

the problem is that many sites use different rules, which means every user has to remember 3-4 different passwords.

filosofo• 17 years ago

And, although our long-term memory for images and words that we've assigned meanings to is quite good, we don't do as well with passwords, which (ideally, at least) should look like a near-random string of characters. It's another challenge entirely to remember which password to associate with a specific account.

It seems like this is easy enough to solve with a little instruction: have users make up a phrase that has to do with the account, and use the first letters from each word as the password: it's unique, non-dictionary, yet memorable.

rv77ax• 17 years ago

i use 2 grams of 'salt' on my password plus the site name where i want to login. it's simple an easy to remember.

http://journal.kilabit.org/salt-n-pepper

how do you "create" your password ?

mahmud2• 17 years ago

https://addons.mozilla.org/en-US/firefox/tag/1password

Brain cells should not be wasted on rote password generation and memorization.

Create2• 17 years ago

Brain cells should be used to remember important things. Most important things are conveyed by i.e. poems. Although nobody learns literature citings by heart in the era of wikipedia, a straightforward way to have a strong password is to pick e.g. the first letters of each line of a poem (aka passphrase you should already know), as described in the man:

When choosing a new password, make sure it's unrelated to any previous password. Use long passwords (say 8 characters long). You might use a word pair with punctuation inserted, a passphrase (an understandable sequence of words), or the first letter of each word in a passphrase.

http://linux.die.net/man/1/passwd ...RTFM has also been subject of debate for ages...

ovi256• 17 years ago

Thanks for giving my passwords away.

:-)

Now I have to find a new strategy. Seriously, it's a pity we let such a poor (from an usability viewpoint) design stand.

Plugawy• 17 years ago

Interesting - I've been using the method for a while now and I thought I'm the only one who does it :-)

30 years of failure: the username/password combination

Related Stories