Re: Passphrases v Password

[Michael Sinatra <michael () RANCID BERKELEY EDU>]

On 07/05/13 11:57, randy wrote:
> How do you enforce "passphrases"? :-)
>
> Our current password rules are at
> http://www.awareness.security.vt.edu/passwords/strong_passwords.html.
> It will be interesting to see the user reaction to the 16 character
> minimum requirement.

xkcd has in interesting discussion of password/passphrase strength:

https://xkcd.com/936/

(Moral of the story: We've successfully trained users to create
passwords that are hard for them to remember but easy for computers to
guess.)

The only catch with using long passphrases is that it's better that they
NOT be grammatically correct:

http://www.cs.cmu.edu/~agrao/paper/Effect_of_Grammar_on_Security_of_Long_Passwords.pdf

michael