Mailinglist Archive: opensuse-factory (536 mails)

< Previous Next >
Re: [opensuse-factory] Tumbleweed full disk encryption passphrase
On 24/05/18 05:09 AM, Johannes Meixner wrote:

I think for companies/organizations it seems not to matter
to make things actually more secure. It seems what matters
more is that companies/organizations can feel safe because
they had enforced the right (well known/old) rules and then
when things go wrong they can claim it is not their fault.


See also:
https://arstechnica.com/information-technology/2013/06/password-complexity-rules-more-annoying-less-effective-than-length-ones/
<quote>
A pair of studies done in 2011 and 2012 on password length and construction
showed two things: first, customer frustration increases significantly with
complexity, but less so with length. Second, a number of password cracking
algorithms can be more easily thwarted by a long password that is created
without number, symbol, or case requirements than are shorter passwords that are
required to be complex, particularly for a large number of guesses. That is,
shorter, more complex password restrictions beget passwords that can be more
frustrating to everyone except the only entity who shouldn’t have it: the
password cracker.
</quote>

In practical terms, because of the buffer sizes and hashes, a length limit of
512 characters should be considered adequate for most purposes.

I would, however, point out that Leo Marks mentions in his book "between Silk
and Cyanide" that picking a phrase from a poem or nursery rhyme (or movie or
novel) may defeat traditional computational and combinatorial methods, it won't
defeat a human versed in your culture. In modern terms that means a high speed
AI with access to the Net, YouTube, Guttenberg and more can draw on sources and
resources. Eventually there will be AIs that run an emulation of you....
But for now, length beats complexity.

The real pisassnts are the 4 digit PIN codes ...


--
Quality is free, but only for those who are willing to pay heavily for it.
-- Tom Demarco, "Peopleware"
--
To unsubscribe, e-mail: opensuse-factory+unsubscribe@xxxxxxxxxxxx
To contact the owner, e-mail: opensuse-factory+owner@xxxxxxxxxxxx

< Previous Next >
Follow Ups