Why not let the administrator decide? [LWN.net]

Why not let the administrator decide?

Posted Aug 12, 2026 15:01 UTC (Wed) by farnz (subscriber, #17727)
In reply to: Why not let the administrator decide? by ebiederm
Parent article: Changes in shadow-utils password-expiration features

Note for context that it's trivially easy to get more than 128 bits of entropy with key-based authentication methods.

That's why it's probably time to retire passwords - something very hard to memorise is weaker than a low quality key; so for network use, the key is more useful, and for local access, you're fine with better physical security and a weaker (⇒ easier to memorize) password.

to post comments

Why not let the administrator decide?

Posted Aug 12, 2026 16:07 UTC (Wed) by dskoll (subscriber, #1630) [Link] (2 responses)

Maybe this is a controversial opinion, but for local access, I think it's fine to pick a very strong password that you then write down and keep on a card in your wallet.

We are all very familiar with physically securing our wallet, so I don't see much danger in doing this. Of course, if you lose your wallet, it's a problem, so make sure you have written it down somewhere else safe so you can go in and change it if necessary.

But even if someone finds your wallet and password, they still have to know which system the password is for and gain physical access to that system.

Why not let the administrator decide?

Posted Aug 12, 2026 16:46 UTC (Wed) by farnz (subscriber, #17727) [Link]

I would agree with you - I think the opposition to writing down passwords stems, very fundamentally, from "one size fits all" security thinking, with a sprinkling of "I am immune to the $10 wrench attack".

In the end, your authentication method only has to be good enough to force attackers to either give up, or escalate to an attack where you will give them your authentication credentials in the hope of avoiding whatever consequence you're threatened with for not giving them up. If you're going to be quick enough to notice that the written-down password has left your wallet and trigger a password change when that happens, then writing it down is fine unless what we're talking about is something like the password needed to trigger global thermonuclear war (a strange game).

After all, if someone is in a position to get away with murdering me, I'd rather give them my credentials (including hardware tokens, not just passwords) than die, and I don't think I'm that unusual in feeling that way.

Why not let the administrator decide?

Posted Aug 12, 2026 23:17 UTC (Wed) by mathstuf (subscriber, #69389) [Link]

Also note that what you write down doesn't need to be the password. It can be rot13'd, embedded as every Nth (or f(n)th where f is something like the prime counting function or the like) character of a larger string.