Ask Lemmy
A Fediverse community for open-ended, thought provoking questions
Rules: (interactive)
1) Be nice and; have fun
Doxxing, trolling, sealioning, racism, and toxicity are not welcomed in AskLemmy. Remember what your mother said: if you can't say something nice, don't say anything at all. In addition, the site-wide Lemmy.world terms of service also apply here. Please familiarize yourself with them
2) All posts must end with a '?'
This is sort of like Jeopardy. Please phrase all post titles in the form of a proper question ending with ?
3) No spam
Please do not flood the community with nonsense. Actual suspected spammers will be banned on site. No astroturfing.
4) NSFW is okay, within reason
Just remember to tag posts with either a content warning or a [NSFW] tag. Overtly sexual posts are not allowed, please direct them to either !asklemmyafterdark@lemmy.world or !asklemmynsfw@lemmynsfw.com.
NSFW comments should be restricted to posts tagged [NSFW].
5) This is not a support community.
It is not a place for 'how do I?', type questions.
If you have any questions regarding the site itself or would like to report a community, please direct them to Lemmy.world Support or email info@lemmy.world. For other questions check our partnered communities list, or use the search function.
6) No US Politics.
Please don't post about current US Politics. If you need to do this, try !politicaldiscussion@lemmy.world or !askusa@discuss.online
Reminder: The terms of service apply here too.
Partnered Communities:
Logo design credit goes to: tubbadu
view the rest of the comments
I'm going to be real. I was part way through an explanation before I deleted it. What you are dealing with sounds like a situation where you simply won't win by using logic. To continue to labor under the presumption that a good and logical reasoning will have an effect is just going to stress you out and achieve nothing.
IT nerds help me out here, but I've been under the impression that the best defense against brute force attacks is a very long password, and the idea of sprinkling in special characters or numbers is outdated. Something like "iwenttothestoreandboughtabirthdaycake" is a more secure password than "$6jds_*WghP6".
edit: Also the mantra to never write down any passwords is more of a workplace piece of advice. I personally think, and this would probably be helpful for older people, that writing down passwords in a notebook which is kept secure in their home is pretty safe. Short of a home invasion, that notebook is safe, and having it can encourage them to diversify their passwords on different accounts. So, if you are going to keep at the issue, taking an angle of using something they are more comfortable with like a paper notebook is going to be accepted more easily than trying to sell them on a password manager or something.
Word based passwords are (typically) not more secure, but they're easier to remember than random text, which makes them more secure than the lesser alternative, but not more than the better alternative: just as long, but fully random text stored and generated by a password manager. You're right that substituting text with numbers or symbols is bad, those are easily cracked. But fully random text with symbols and numbers is the best.
Why? Badly remembered passwords are often reused and written down, sometimes even on the computer itself, in emails, chat software, text files. And any password created by a person inherently will fall victim to shortcuts, as humans are often just not as creative as you might hope, there's patterns. Common words might be used, too little words might be used. With a dictionary attack that checks common words, the entropy of such passwords can become drastically smaller to the point they can be cracked very quickly, and you have to be aware of that constantly when using words. Using uncommon words or more difficult words can prevent that, but that's typically not what people do, when "password123" is the best they come up with otherwise.
A notebook at home would suffice, but it's not great for the same reason as word based passwords. A password manager can create passwords that are guaranteed to be entropically complex passwords that can't be cracked basically ever. There's no guessing, no shortcuts to take, no human laziness to slip in and curse the password to easy cracking. And it does so uniquely for every login you have. That's essentially unbeatable.
I'm aware. I've explained it elsewhere, but having dealt with irrationally tech adverse older people myself, I've learned sometimes decent solutions they'll actually use are better than great ones they'll resist. I've found that any new software, like a password manager, no matter how user friendly and logical is treated with suspicion and disdain.
I gotcha, yeah then it's probably better for them. As other people in the thread explained, it should save them from most crackers that just give up if the password isn't cracked easily.