A capital letter, a number, a special character, an emotional journey for the character, a subplot
summary
Current recommendation: require at least 14 characters, accept all Unicode (spaces, emojis), and block dictionary, sequential, username‑like, or breached passwords. Use zxcvbn for entropy scoring and helpful feedback, and query Have I Been Pwned’s k‑anonymity Pwned Passwords API (613,584,246 entries) to reject reused leaked secrets — audits show 234,000 WA government passwords with ~25% weak and 1,464 using "password123". NIST updated guidance in 2017; add two‑factor (SMS if needed) as a practical last line.
AI-written summary · about
chapters (8)
- 0:00Introduction and background
- 1:54Personal password stories
- 5:07The failure of guidelines
- 10:13Repetition and data breaches
- 14:26Better security practices
- 17:35Validation with zxcvbn
- 21:39Breached password APIs
- 27:26Conclusion and wrap-up
related talks
40mFantastic Passwords and Where to Find Them
23mFantastic Passwords and Where to Find Them
30mhunter2: A Symphony of Password Horror
25mEverything You Know About Passwords Is Wrong
46mRequiem for the Password
31mBreaking Bad (Passwords)
14mPasswords. Are. Not. Hard!
31mhunter2: A Symphony of Password Horror