Passwords are great: easy to implement, compatible with almost everything, they are as simple as symmetric keys in ASCII format. The bad thing with them is that they are called "passwords" (or "passphrases") and people want to remember them... If only we could mandate passwords to be at least 20 char long, so people would stop trying to remember them.

@A.Hersean You can. People will just find 20 char long things they can remember

passwordpasswordpassword

if users can screw things up they will, so you need to prevent them from having the ability to screw things up

aka, some form of completely transparent authentication

rather make it harder to screw things up than doing it the right way

and even if they do everything right, if they have access to a key they will get social engineered so don't let them have it

@JBis If a system prevents me from accessing my keys at all im never using it :D

don't let average users have it* :)

We should use a website "passwordresued.io" with an API where any online service could push the SHA-512 (not hardened) of the passwords of their users, and query the database to find if a password as already been submitted (the push and query can be the same operation). That would force users to not reuse their password and to use passwords with enough entropy they do not need to be hardened.

@A.Hersean variation of that exists iirc

The point is for this service to be shared by lots of different organizations.

blog.cloudflare.com/…

That's only for leaks

@A.Hersean I'm sure people will just add the site name and username to their password to make it uniquee

I suggest doing it for every password. Basically leaking all the hashes. FREE THE HASHES!

@nobody Murphy strikes again

And no need for k-anonymity

@A.Hersean That was the first thing ever tried. /etc/passwd used to be readable by everyone

/etc/passwd used to be unbreakable

^ Sorry I don't understand what you meant

SHA-512 of passwords generated with more than 192 bits of entropy are ensured to be safe (SHA-512 is collapsible, so it cannot be reversed by quantum computers)

"collapsible"?

@nobody what I meant where?

@JBis welcome to crypto.SE

fun

@JBis "collapsable" the spellchecker stroke again

don't worry, i didn't know how to spell it either

I'm glad you found a definition, because it would have been hard for me to explain it.

coincidentally i got a crash course on quantum computing 101 just yesterday

And the 192 bits of security is due to some computation on the amount of energy it would take a classical computer to count up to 2^192.

@A.Hersean what you meant by /etc/passwd being unbreakable

@nobody Back in the day, a password of 8 char was considered very secure because it would take months to try them all.

When mainframe where less powerful than a pocket calculator (the thing that does not exist anymore now that everybody has a smartphone)

thycotic.force.com/support/s/article/…

pretty good article ^

I see, the problem is that computers today are too powerful. We should ban powerful computers. Problem solved!

I agree

Ban quantum computing too

Hey just ban computers outright

That will solve a lot of problems

Dammit Turing

@nobody Or use passwords of more than 128 bits of entropy.

@A.Hersean That doesn't solve zero days. No computers, no zero days

Even Murphy's law is not yet that powerful, and will not be in the foreseeable future (unless you use SHA3 instead of SHA-512)

No calendar, no zero days.

Problem solved.

@A.Hersean Well if you have no calendars you have literally zero days

Damn

On a more serious note, why haven't we been able to train people to use password managers?

Oh funny thing, I don't use one myself

Because inertia

And lazyness

And we would be out of work

:D

absolutely

I think you can make users interested by hacking them and leaking their private photos. Should we start doing that?

J-- +1 == J ?

No

J-- decreased the value of so J adding 1 to it doesn't make it equal to J

@nobody I use and have gotten my family to use it...but my dad stores all his passwords in the secure note section instead of the passwords section facepalm

@J-- Zero width spaces aren't allowed?

Since "J--" equals "I", I though you chose it just to annoy people who would like to call you "I".

Wait that would make you a pain to ping

@nobody Do you use same password for everything?

@JBis Nooo... not exactly

then how do you remember them all

It's the WE, so bye everyone.

@J-- Oh yes I forgot about the autofill

o/

@JBis By having as few accounts (that need a secure password) as possible.

nvm

A couple of super secure ones and the other ones are literally something like uncrackablepassword

ah

lol

alright im out too, cya o/

Bye have a good day/night

Why? Even if you fail, you learn something

Then how about you just take the course but not the exam?

So you learn and cannot fail

Well since you're already doing that I guess it won't matter

Mine is slow everyday.

Depends. Between 2 to 30 Mbps

Yours?

I could get a fibre optic connection, but they are expensive.

I can live with what I have right now most of the time so I don't bother to pay more

@J-- What's that?

What's the difference? :)

Oh. FTTP then

No cap, but more charge

I have fiber home, the endpoint is 2m away from me. 200/100 and it's more than enough.

@AnneBatch Hey

@MechMK1 Hey there!

How're you?

I'm fine master

And you?

Doing fine too ^^

Great. I'm glad for you

What have you been up to?

Just thinking about what to do haha