Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

8
  • I don't think that this addresses the question the OP made. Commented Oct 31, 2014 at 17:02
  • It's an alternative answer, but it definitely addresses the question, which was "How to practically deal with the fact that your properly generated password may actually be or become weak?" Practically all passwords are weak, live with it and optimize/mitigate elsewhere. Just because John the Ripper can't crack a 4 word password today doesn't mean it can't be engineered to crack those tomorrow. A 25-GPU array can perform 350 billion guesses per second and you know what? Tomorrow's GPUs will do twice that. Will tomorrow's passwords be twice as long to compensate? Commented Oct 31, 2014 at 17:46
  • As a side note, I try not to give redundant answers that I know someone else has or will provide. I think my answer adds a lot of value to this question. Commented Oct 31, 2014 at 17:51
  • I think your answer is useful, if the question was "How can I mitigate users picking bad passwords/losing their password". However, the OP is infact the user picking the password and not the developer mitigating the issue. Commented Oct 31, 2014 at 17:55
  • xkcd mentions 1000 guesses/sec as a plausible attack on a remote web service. I would hope any user reading this experiences a strange twitch in the eye brow. Why design or use a web service that is open to being massively flooded or brute forced? It's like using a public Wifi at Starbucks - maybe nobody will snoop your traffic on Tuesdays, but maybe that's because Joe bad guy doesn't get coffee on Tuesday. Regardless of how the day pans out, you're constantly at high risk. Users need to know this. Nobody has raised the issue. Commented Oct 31, 2014 at 21:26