Passwords. Are. Not. Hard!
summary
Argues that complexity rules weaken security: forcing mixed-case, digits and symbols often reduces entropy from ~10^16 (96^8) to ~10^13 and GPUs (e.g. a GTX 1080) make MD5 on GPUs effectively trivial. Recommends long 5-word passphrases (example entropy ~10^35), allow pasting, and validate by checking against top lists and dictionaries rather than banning length. Notes common implementation mistakes: storing plaintext or reversible encryption, truncating due to bcrypt output length misunderstandings, and follows NIST guidance to prefer length and blacklist checks.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:35Crypto expertise overrated
- 2:57GPUs and hashing limits
- 4:04Passwords are flawed
- 5:32Password rules harm security
- 7:39Length restrictions dangers
- 9:25Password length limits
- 11:33Password mismanagement reasons
- 12:14NIST password guidelines
- 12:56Call them passphrases
related talks
25mEverything You Know About Passwords Is Wrong
01h 05mPasswords are not going away
43mPlease pass the salt: Serve up passwords with a side of entropy
47mYour Password Complexity Requirements are Worthless
04mEvery time you write a password validator...
30mhunter2: A Symphony of Password Horror
16mSecurity by Meme
28mRandom Passwords Aren't Good Enough