@MechMK1 I just finished working in the academic sector. I worked closely with a lot of different research departments in a variety of fields. "Get gud" doesn't work. Several studies were performed on the inherent bias in how research funds were apportioned. When the names of the researchers were removed, suddenly there was an equal distribution of funds to people from minority groups and women as well as the "white male"-sounding names.

Several different studies were done with a variety of different ways to obfuscate or swap names. Every study concluded that research departments have an inherent racial and gender bias. And every department acknowledged the studies, promised to "do better", but asked for the full names to be restored on research grant applications.

There is no good solution to that sort of systemic, deeply embedded problem. Programmes that force the situation to be different, even if that force is arbitrary and unequal, can make a positive difference for many.

I'm working with some people who are doing amazing work in the infosec field and are applying for special visas in the UK. The women's CVs are stellar, their work is cutting edge, and their endorsements from industry giants are many. The men, while also mostly good, just don't have the same level of achievement. Every one of the women was denied a visa, every male was granted one.

@schroeder yah, thats rough ... most STEM fields are low female but things in Comp Sci tend to be really really low female. On the one hand I hate teachers that auto-pass females in the field simply to promote having more women in the field ... but on the other alot of the field is very very gender bias. I am hoping that it changes as the older generations start kicking the bucket.

Auto-pass? that's not forcing equal access and opportunity. That's re-writing accomplishment.

I had a female Russian student in my graduating class for BS in Comp Sci ... somehow she made it through the entire program w/ out understanding a For Loop or the diff between and int and a string.

@nobody and like I said, that works fine in a closed system. As soon as the name or face cannot be removed, the problem remains.

Honestly, if they want to promote women in Comp Sci ... they need to abolish Barbie Dolls and Pretty Princess toys and encourage females to play w/ computers from a young age. By the time they hit higher education its already too fucking late.

@schroeder If you solve the problem by giving the discriminated group a significant advantage over the rest, situations like CaffeineAddiction's will arise. And that is just going to increase the discrimination against the discriminated group. Because the discriminated group will have it easy, so they often won't reach the level of excellence as others, and then people will view them as mediocres.

But again, its something that will change over time as the older generations loose their control by shuffling off the mortal coil

Who's willing to bet this guy's password generator was insecure?

@nobody I'm afraid to speculate on what is "insecure" without a well-defined threat model anymore, because James Mickens might come to my house and bludgeon me with a giant diagram of Mossad/Not-Mossad

@FireQuacker That whole "Mossad" meme is silly and over-simplifies threat models.

Mossad is not omniscient nor are they omnipotent, and even if they have tremendous resources and think of themselves as above the law does not mean they have no limitations.

@CaffeineAddiction I don't notice much bias in comp-sci, at least in terms of prejudice against any group. Maybe it's different in big companies with generic old man management, but in FOSS and infosec people tend to be viewed based on how well they solve problems.

(As for whether or not it's "secure" under any given threat model, that's not really relevant. Entropy is.)

@forest Interesting. Is that true for passwords in general?

@FireQuacker By and large, yes.

Entropy describes the keyspace, which is a measure of how many possible passwords of that kind exist (where "kind" refers to the limitations and structure of the password such as length, characters used, etc.).

For example, a random 128-bit password (truly random, so not necessarily representable in ASCII) has a keyspace of 2^128. A random password composed of 10 words from a 7776-word dictionary has a keyspace of 7776^11, which is roughly the same size (within an order of magnitude).