Fantastic Passwords and Where to Find Them
summary
Passwords are failing and practical fixes exist: require at least 14 characters and accept spaces and emoji, run a dictionary and context check, and block known breaches via the Pwned Passwords API using the SHA‑1 prefix k‑anonymity method. Use client+server scoring with zxcvbn for real time strength feedback. Examples: a Western Australia audit of 234,000 passwords finds many weak entries, Have I Been Pwned holds ~572,611,621 exposed passwords, and common strings like "password" appear hundreds of thousands of times, so add these checks and a pwned lookup (gems and Devise plugins exist) to reduce account compromise.
AI-written summary · about
chapters (12)
- 0:00Intro
- 3:06I got hacked
- 3:32Password guidelines
- 6:07Password patterns
- 7:47Western Australia password audit
- 9:51Phils best password
- 12:04What happened to Phils password
- 14:29How to fix this
- 17:28Authentication frameworks
- 21:10Password checker
- 24:52Hacked passwords
- 30:28Twofactor authentication
related talks
23mFantastic Passwords and Where to Find Them
46mRequiem for the Password
30mA capital letter, a number, a special character, an emotional journey for the character, a subplot
30mhunter2: A Symphony of Password Horror
25mEverything You Know About Passwords Is Wrong
01h 02mI’m Pwned. You’re Pwned. We’re All Pwned
50mHave I Been Pwned?
27mThe Wide Diversity of Password Requirements – And how to cope with it