Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

14
  • 2
    I'm not sure it's fair to call a known anti-pattern of "short passwords" an "infosec convention". Commented Aug 15, 2018 at 13:07
  • 2
    @Adonalsium What I meant to say is that it's a pattern related to infosec that is not within best practices and one shouldn't mindlessly follow other people's patterns. Commented Aug 15, 2018 at 13:25
  • 32
    Also, and to a lesser degree, password history is exposed. If the password has been changed over time, knowing previous passwords may be useful in guessing future passwords should access be revoked. Commented Aug 15, 2018 at 15:10
  • 6
    "Convention", to me, implies "everyone generally agrees to do it this way, despite it not having any particularly significant advantage, apart from everyone agreeing that it's to be done this way", but you're giving some pretty significant dis/advantages, which leans more towards "this is a bad idea". Removing the parts about convention would improve the answer quite a bit IMO. Commented Aug 15, 2018 at 22:09
  • 5
    @NotThatGuy No, convention just means "everyone generally agrees to do it this way". It's important to note, because following conventions is generally really important and valuable in its own right. Commented Aug 17, 2018 at 19:36