Post by @pheonix@hachyderm.io

2026-01-29 16:51 UTC

I&#39;ve personally grown to hate the security theatre of rotating my bank passwords every six months, especially because of requirements like &quot;must contain one uppercase, one symbol, one lowercase, one special case and the blood of a unicorn.&quot; When mathematically, a simple, grammatically incorrect sentence of 25 characters is much harder for a machine to crack than a gibberish 8-character password with symbols. Entropy loves length. I love the idea that the most secure key to your digital life could just be a weird little poem or an inside joke that only you know. Security doesn&#39;t have to be painful. #infosec #passwords #cybersecurity #UX #security #sysadmin #programming #foss #linux #privacy #enshittification #reading #finance

Replies (4)

@cursedsql@hachyderm.io 2026-01-29 16:56

@pheonix@hachyderm.io entropy has always been a size queen

Open ##5295443
@mossyfoot@pdx.social 2026-01-29 17:05

@pheonix@hachyderm.io every security person has this link memorized by now: https://m.xkcd.com/936/

Open ##5295444
@DejahEntendu@dice.camp 2026-01-29 17:05

@pheonix@hachyderm.io sometimes, when I'm driving, my kiddo logs into my work phone to see what an alert was about. They always complain that my password is misspelled. I just smile and shrug. Long and simple, but just a little weird.

Open ##5295445
@admin@mastodon.slightlycyberpunk.com 2026-01-29 17:08

@pheonix@hachyderm.io Password expiration has not been considered best practice in many years. If they're still doing that I've gotta wonder what other wildly obsolete security measures they might be relying on. Consider a new bank, I have four and none of them do that shit lol https://www.ncsc.gov.uk/pdfs/blog-post/problems-forcing-regular-password-expiry.pdf https://community.isc2.org/t5/Industry-News/Microsoft-and-NIST-Say-Password-Expiration-Policies-Are-No/td-p/39893

Open ##5295448