Why not let the administrator decide? [LWN.net]

Why not let the administrator decide?

Posted Aug 12, 2026 14:31 UTC (Wed) by ebiederm (subscriber, #35028)
In reply to: Why not let the administrator decide? by rgmoore
Parent article: Changes in shadow-utils password-expiration features

I don't think it is this simple. Memory hard hash algorithms limit what kind of computers can even try to guess your password, and limit how fast guesses can be made.

My experiments with random passphrases tell me that 6 random words are doable. With a word list of rougly 65536 words this is enough for 16 bits of entropy per word and 96 bits of entropy total.

That said you don't want to use a password like that for anything except local access to a device right in front of you because a high entropy password is difficult to hard to memorize.

to post comments

Why not let the administrator decide?

Posted Aug 12, 2026 15:01 UTC (Wed) by farnz (subscriber, #17727) [Link] (3 responses)

Note for context that it's trivially easy to get more than 128 bits of entropy with key-based authentication methods.

That's why it's probably time to retire passwords - something very hard to memorise is weaker than a low quality key; so for network use, the key is more useful, and for local access, you're fine with better physical security and a weaker (⇒ easier to memorize) password.

Why not let the administrator decide?

Posted Aug 12, 2026 16:07 UTC (Wed) by dskoll (subscriber, #1630) [Link] (2 responses)

Maybe this is a controversial opinion, but for local access, I think it's fine to pick a very strong password that you then write down and keep on a card in your wallet.

We are all very familiar with physically securing our wallet, so I don't see much danger in doing this. Of course, if you lose your wallet, it's a problem, so make sure you have written it down somewhere else safe so you can go in and change it if necessary.

But even if someone finds your wallet and password, they still have to know which system the password is for and gain physical access to that system.

Why not let the administrator decide?

Posted Aug 12, 2026 16:46 UTC (Wed) by farnz (subscriber, #17727) [Link]

I would agree with you - I think the opposition to writing down passwords stems, very fundamentally, from "one size fits all" security thinking, with a sprinkling of "I am immune to the $10 wrench attack".

In the end, your authentication method only has to be good enough to force attackers to either give up, or escalate to an attack where you will give them your authentication credentials in the hope of avoiding whatever consequence you're threatened with for not giving them up. If you're going to be quick enough to notice that the written-down password has left your wallet and trigger a password change when that happens, then writing it down is fine unless what we're talking about is something like the password needed to trigger global thermonuclear war (a strange game).

After all, if someone is in a position to get away with murdering me, I'd rather give them my credentials (including hardware tokens, not just passwords) than die, and I don't think I'm that unusual in feeling that way.

Why not let the administrator decide?

Posted Aug 12, 2026 23:17 UTC (Wed) by mathstuf (subscriber, #69389) [Link]

Also note that what you write down doesn't need to be the password. It can be rot13'd, embedded as every Nth (or f(n)th where f is something like the prime counting function or the like) character of a larger string.

Why not let the administrator decide?

Posted Aug 12, 2026 17:27 UTC (Wed) by rgmoore (✭ supporter ✭, #75) [Link]

I'm exaggerating for sake of emphasis. Yes, for critical applications we can probably create and memorize passwords that are sufficiently difficult for a machine to crack that they are secure in practice, but that still depends on everyone who uses the system being willing and able to make and memorize that kind of password. One of the lessons we should have learned from password expiration is that making the system harder just gives people an incentive to try to cheat, undermining the supposed benefits. If passwords are too hard to create and memorize, and people will cheat the system by repeating the same word 6 times or something similar.

Another important point is that depending on a harder password still leaves that password as a single point of failure. It's still vulnerable to phishing, mistakes that leave it unencrypted somewhere, and all the other non-cracking ways we've seen passwords fail over the years. 2FA gives you some redundancy against those kinds of failure.