The goal of demonizing passwords over the last 10 years has been about promoting biometrics but sure, tell me how suddenly we went from be forced in to 12+ characters, one special, one capital.. to nah, its fine. Yes brute force does not exist and yes 95% of all hacking is social engineering, but prevention of brute force IS BCZ TOUGH PASSWORDS. It shd not be birthdates, names, password123, hometown, pets... bcz brute comes in degrees
There are a couple of issues because password protected services are not the same.
Your gmail password doesn't need to be crazy complicated because you can't try to brute force it. Web based services are rate limited so it takes too long to brute force it.
The RockYou2024 password list contains 9,948,575,739 different passwords. Do you think yours are in there?
My Instagram / Github / others are 2FA using an authenticator app.
It is relatively simple to add something like Duo authentication to your web service.
Whereas your hard drive / other file encryption passwords can be brute forced. And you can spin up 100 instances on AWS to do it.
The goal of demonizing passwords over the last 10 years has been about promoting biometrics but sure, tell me how suddenly we went from be forced in to 12+ characters, one special, one capital.. to nah, its fine. Yes brute force does not exist and yes 95% of all hacking is social engineering, but prevention of brute force IS BCZ TOUGH PASSWORDS. It shd not be birthdates, names, password123, hometown, pets... bcz brute comes in degrees
There are a couple of issues because password protected services are not the same.
Your gmail password doesn't need to be crazy complicated because you can't try to brute force it. Web based services are rate limited so it takes too long to brute force it.
The RockYou2024 password list contains 9,948,575,739 different passwords. Do you think yours are in there?
My Instagram / Github / others are 2FA using an authenticator app.
It is relatively simple to add something like Duo authentication to your web service.
Whereas your hard drive / other file encryption passwords can be brute forced. And you can spin up 100 instances on AWS to do it.