Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #268444
| From | Pierre-Elliott Bécue <peb@debian.org> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | Re: Root password strength |
| Date | 2024-03-20 18:00 +0100 |
| Message-ID | <Ik7sd-rhG-1@gated-at.bofh.it> (permalink) |
| References | <IjIWR-b9R-15@gated-at.bofh.it> <Ik5A5-qaq-11@gated-at.bofh.it> <Ik6w9-qIY-3@gated-at.bofh.it> <Ik6FQ-r20-13@gated-at.bofh.it> <Ik6Zb-r8j-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
[Multipart message — attachments visible in raw view] - view raw
Jeffrey Walton <noloader@gmail.com> wrote on 20/03/2024 at 17:19:46+0100: > On Wed, Mar 20, 2024 at 12:09 PM Pierre-Elliott Bécue <peb@debian.org> wrote: >> >> John Hasler <john@sugarbit.com> wrote on 20/03/2024 at 16:58:01+0100: >> >> > Pierre-Elliott Bécue writes: >> >> A phrase you will easily remember but that would be hardcore to guess >> >> through social engineering is perfect. >> > >> > Better is a random string that you write down. When people try to >> > generate phrases that meet those requirements they usually fail. >> >> Writing down a password is a bad idea. > > I don't think that's true anymore. The threat being mitigated is the > network attacker. The network attacker cannot (yet) reach through a > monitor and read a sticky note. Mitigating a specific threat by adding a new one is not a proper way to handle a threat when one can avoid both. > It is also why its Ok for a system to generate a list of recovery > codes, and have the user print them and store them in a safe place. > The other option are those cursed security questions, which have been > insecure for about 20 years now (but developers have their arms > wrapped around). A recovery code is generally designed to troubleshot 2FA issues, not as a replacement for the first layer of security that a password is. And therefore if it were to circuvent this first layer, then no, it's not ok to print them, except if you indeed have a safe. But in general it's a better approach to avoid having to resort to printed password on a paper. >> Managing passwords through a password-store (eg pass, keepassxc, >> whatever tool you prever) is a great idea, but you first need to unlock >> your disk that hopefully you encrypted and then your session. And if >> your laptop is borken, then having a root password you actually can >> remember is better. > > I believe NIST now approves online password managers. But I don't > trust them given the number of data breaches. Yes, but I wouldn't dare use one. -- PEB
Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Root password strength Jan Krapivin <daydreamer199005@gmail.com> - 2024-03-19 15:50 +0100
Re: Root password strength Jan Krapivin <daydreamer199005@gmail.com> - 2024-03-19 16:00 +0100
Re: Root password strength Dan Ritter <dsr@randomstring.org> - 2024-03-19 16:10 +0100
Re: Root password strength debian-user@howorth.org.uk - 2024-03-19 16:50 +0100
Re: Root password strength Greg Wooledge <greg@wooledge.org> - 2024-03-19 21:20 +0100
Re: Root password strength Greg Wooledge <greg@wooledge.org> - 2024-03-19 16:10 +0100
Re: Root password strength jeremy ardley <jeremy.ardley@gmail.com> - 2024-03-19 21:30 +0100
Re: Root password strength <tomas@tuxteam.de> - 2024-03-20 06:40 +0100
Re: Root password strength Jeffrey Walton <noloader@gmail.com> - 2024-03-20 07:10 +0100
Re: Root password strength tomas@tuxteam.de - 2024-03-20 08:40 +0100
Re: Root password strength jeremy ardley <jeremy.ardley@gmail.com> - 2024-03-20 08:50 +0100
Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-20 12:10 +0100
Re: Root password strength <tomas@tuxteam.de> - 2024-03-20 12:20 +0100
Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-20 13:20 +0100
Re: Root password strength jeremy ardley <jeremy.ardley@gmail.com> - 2024-03-20 12:30 +0100
Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-20 13:10 +0100
Re: Root password strength Dan Ritter <dsr@randomstring.org> - 2024-03-20 13:40 +0100
Re: Root password strength Jeffrey Walton <noloader@gmail.com> - 2024-03-20 14:30 +0100
Re: Root password strength <tomas@tuxteam.de> - 2024-03-20 14:50 +0100
Re: Root password strength Marco Moock <mm@dorfdsl.de> - 2024-03-19 16:40 +0100
Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-19 20:40 +0100
Re: Root password strength debian-user@howorth.org.uk - 2024-03-19 22:00 +0100
Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 16:00 +0100
Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-20 16:20 +0100
Re: Root password strength Jan Krapivin <daydreamer199005@gmail.com> - 2024-03-20 16:30 +0100
Re: Root password strength John Hasler <john@sugarbit.com> - 2024-03-20 17:10 +0100
Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 17:20 +0100
Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 18:50 +0100
Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-20 19:10 +0100
Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 19:30 +0100
Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 19:50 +0100
Re: Root password strength Lee <ler762@gmail.com> - 2024-03-20 20:50 +0100
Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 21:00 +0100
Re: Root password strength Lee <ler762@gmail.com> - 2024-03-20 21:30 +0100
Re: Root password strength <tomas@tuxteam.de> - 2024-03-20 18:50 +0100
Re: Root password strength John Hasler <john@sugarbit.com> - 2024-03-20 19:50 +0100
Re: Root password strength "Alexander V. Makartsev" <avbetev@gmail.com> - 2024-03-21 20:40 +0100
Re: Root password strength Jan Krapivin <daydreamer199005@gmail.com> - 2024-03-22 11:00 +0100
Re: Root password strength Joe <joe@jretrading.com> - 2024-03-22 12:00 +0100
Re: Root password strength "Alexander V. Makartsev" <avbetev@gmail.com> - 2024-03-22 13:30 +0100
Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-23 10:50 +0100
Re: Root password strength Lee <ler762@gmail.com> - 2024-03-23 01:10 +0100
Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-23 11:30 +0100
Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 16:50 +0100
Re: Root password strength John Hasler <john@sugarbit.com> - 2024-03-20 17:00 +0100
Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 17:10 +0100
Re: Root password strength Jeffrey Walton <noloader@gmail.com> - 2024-03-20 17:30 +0100
Re: Root password strength Max Nikulin <manikulin@gmail.com> - 2024-03-20 17:50 +0100
Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 18:00 +0100
Re: Root password strength Jeffrey Walton <noloader@gmail.com> - 2024-03-20 18:40 +0100
Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 18:50 +0100
Re: Root password strength Jeffrey Walton <noloader@gmail.com> - 2024-03-20 19:20 +0100
Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 19:40 +0100
Re: Root password strength Jeffrey Walton <noloader@gmail.com> - 2024-03-20 21:20 +0100
Re: Root password strength Curt <curty@free.fr> - 2024-03-21 17:50 +0100
Re: Root password strength John Hasler <john@sugarbit.com> - 2024-03-20 19:40 +0100
Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 19:50 +0100
Re: Root password strength John Hasler <john@sugarbit.com> - 2024-03-20 17:30 +0100
Re: Root password strength Pierre-Elliott Bécue <peb@debian.org> - 2024-03-20 18:00 +0100
Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-20 19:20 +0100
Re: Root password strength Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-20 17:10 +0100
csiph-web