Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1188696

Bug#1064617: Passwords should not be changed frequently

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi,

On Friday, 1 March 2024 20:46:49 CET Holger Wansing wrote:
> Philip Hands <phil@hands.com> wrote (Fri, 01 Mar 2024 06:46:27 +0100):
> > If you want to make a constructive contribution, how about suggesting a
> > wording that reflects the advice that you think would be most useful to
> > the people that actually read the advice?
> 
> I would like to make a proposal, leaving the default setting as is
> (aka: default to an enabled root account, no sudo), with only some wording
> changings.
> 
> Patch attached.
> 
> What do you think?

I think it's an improvement and I have some suggestions, which hopefully makes 
it even better. I don't have a git-diff, but hopefully this works too.

I'm not a native English speaker or particularly good at this, so it's more 
the direction then the exact wording that's important. Others can undoubtedly 
improve upon it.

 _Description: Root password:
"You need to set a password for 'root', the system administrative account. The 
'root' user has full control over the whole system, so it's extra important to 
protect it with a strong password. A strong password is usually a sentence, 
consisting of words not commonly found together in natural language. And not 
easily associated with you."*

*) Not sure if there's room for it, but examples often help:
1) That's a battery staple? Correct!
2) Margaret Thatcher is 110% sexy

ad 1) xkcd 936
ad 2) An example Edward Snowden gave in an interview (with Vice?)

Why?
- We need to get rid of the *word* part; making it long (via a sentence) is 
the easiest way to make it stronger. I don't know if passphrase is 
(technically) correct or easily understood though.
- "A malicious or unqualified user ... can have disastrous results"
I think it doesn't add useful or correct info as a benign qualified 'root' user 
making an error and can also wreak havoc. (A good password doesn't prevent 
that though)
- A memorable password or passphrase can (always?) be guessed; the goal is to 
make it as hard as possible.
- "It should not be a word found in dictionaries"
I know where it comes from, but it's not helpful. And it gives the impression 
it should be a single word. A 'normal' dictionary contains a LOT of words and 
saying you can't use any of them makes it almost impossible for the user to 
make a good password/passphrase. That they can remember.
I haven't verified it, but I'm guessing the words from Diceware Word List are 
all present in the 'normal' dictionary?

"Note that you will not see the password in clear text as you type it, except 
if you explicitly choose to show it."

You *are* able to see the plain text password, just not by default.

HTH,
  Diederik

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1064617: Passwords should not be changed frequently Matthew Wilcox <willy@infradead.org> - 2024-02-25 01:50 +0100
  Bug#1064617: Passwords should not be changed frequently Pascal Hambourg <pascal@plouf.fr.eu.org> - 2024-02-25 23:50 +0100
    Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-02-29 21:10 +0100
      Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-02-29 23:20 +0100
        Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-01 00:40 +0100
          Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-01 07:00 +0100
            Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-01 15:50 +0100
            Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-01 21:00 +0100
              Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-01 22:40 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-02 21:10 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-02 23:00 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-03 00:50 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-04 06:30 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-04 10:50 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-04 16:10 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-04 22:40 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-04 23:00 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-04 22:10 +0100
  Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-05 16:20 +0100
    Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-05 18:00 +0100
      Bug#1064617: Passwords should not be changed frequently Cyril Brulebois <kibi@debian.org> - 2024-03-05 19:40 +0100
        Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-05 20:40 +0100
          Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-05 21:50 +0100
            Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-05 22:30 +0100
              Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-05 23:00 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-06 08:40 +0100
                Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-06 09:20 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-06 11:20 +0100
                Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-06 13:30 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-06 14:00 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-06 16:00 +0100
                Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-07 09:00 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-07 20:30 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-08 20:10 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-08 23:20 +0100
                Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-09 14:00 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-09 16:40 +0100
        Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-05 20:50 +0100
          Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-06 19:50 +0100
  Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-05 19:40 +0100

csiph-web