Azxdreuwa

Fan.

GitHub's max character limit is 72

@forest and we're closer to the 3rd millennium than we are to the 1st.

No unicode characters, only checks that a password is at least 8 characters long and they have a approx. 100 character limit (possibly in the range 100-120).

I'm quite appalled by Google's password acceptance

@AndresF. Which is thankfully something good that can come from this question. I can't believe though how it has, at the time of writing, 10 votes and 3 stars. This stack is called 'software engineering', how can so many people have this assumption?

This question completely goes against software engineering design principles...

I'm definitely not trusting of any company, but in the case of Microsoft, they are truly certifiable, their cryptography and authentication libraries speaks for itself, they definitely know what they are doing.

Oh no I've know for a while that reusing passwords is very bad, I've been hit by a fair amount of data breaches across multiple websites, including a large trading one. I was more interested in the risk posed through password re-use of a very strong password, but in that case if you can generate a very good password, might as well use a password manager

@MartinBonner Whatever the NSA have, the GCHQ have also, they do work extremely closely to each other, but then again they are government agencies not a malicious group, they're not going to do anything with that data except for analysis etc., unless your a target of sorts.

@iheanyi Such an attack vector affects everyone, and it would affect Microsoft in such a case true, but even then I am sure Microsoft has mitigation procedures in such a situation to minimise any damage that may be caused by such as soon as possible.

@Charles Duffy I can agree in before times that Microsoft wasn't security-minded as they are now. NIST and Microsoft are second best friends at this point, and you can always count on Microsoft being the most innovating company when it comes to adopting good security measures.

@marcelm thanks a lot for all of the analysis you've done on the entropy of the password, it's been quite an eye opener, and has made me realise that I was way off with my 100k coins. Funnily enough, Reddit does support Unicode characters as a password, including spaces etc., and a very long password length.

@PlasmaHH Oh I definitely agree with you, always best to create new passwords and, in some cases, aliases for each service used, to at least ensure some level of security.

@PlasmaHH I do see what you mean, you are right, but again, using Microsoft's main services I honestly have reasonable doubt that their servers would be the one's to get compromised, they are pretty much the most up-to-date company in terms of security practices, same can be said for Google also to a lesser extent.

@PlasmaHH I was more so originally thinking that this password would only be used on websites that have a clear layout of their security practices, not really just those run of a mill websites which will store it in cleartext, since, at least in the case of large companies such as Google and Microsoft, there is simply no way they would store passwords in plaintext, Microsoft especially, they work directly with NIST!

The caveat being that whichever website one uses supports the set of unicode characters of course...

@marcelm The list of unicode characters is greater than 136,000. Added with all symbols from the sets [a-z],[A,Z],[0,9],[ASCII - ([a-z][A-Z][0-9])], I truly feel the entropy is much much greater than what you are making it out to be. There are simply too many combinations of symbols, which is why I likened it to throwing 100,000 coins and expecting heads from each one, this is simply verging in the realm of impossibility unless by some infinitesimally small chance that you somehow manage to.

@iheanyi I never called it good though lol, I just wanted to understand the risks behind using such a scheme to log into websites through secure tunnels, but it's led me to understand much more about the risks of password reuse in any situation.

@marcelm I'm not in your sense, the password I had in mind has an a much much greater entropy, and consists of many more symbols than the character and number alphabet you worked with.

@JCRM The probability of that though is probably worse than throwing 100,000 coins in the air and having all of them land on heads, if it is a 100 character password which is made randomly and has a crazy amount of entropy.

@RoyceWilliams I agree, it is out of human range, but if it is feasible for someone to use there's no harm right? We don't know whatg kind of technology can me realised in our time, nice to be completely safe, like over-packing, within reason.

2) I agree yeah it is overkill, but it was more in the frame of choosing a password which would pretty much never be cracked in one's lifetime to reuse.

1) Oh yeah that's quite true actually, they have enough raw power to calculate billions of hashes every second so I guess rainbow tables is moot for them

This truly is the best answer. People that have answered and OP do need to realise that this is a situation with a board member, not just a regular member of staff. If they don't have their way that's OP's job potentially on the line, just the truth of it really.

Was going to but I now feel that it may just be too broad

True true

Or are there ground rules?

Just life lol

It's alright for me to ask general questions here right?