After studying 19 billion passwords, one big problem: Over 90% are terrible

[Au Contraire]

I remember news stories like this from the early 2000's. Not word-for-word the same, but close. What the stories never report is that no matter how complex your password - or key - and no matter how diligent you are in your security habits, there is always a backdoor in the O/S, the application, the servers your data, passwords, credit card numbers, keys are stored on.

Anyone remember encrypted USB keys? Now the push is to use passkeys. Which presents multiple points of vulnerability, if not outright failure. And of course the answer is "let us store your keys on our servers; they are guaranteed to be secure. Disregard that we hand all our data to numerous federal, regional, state, and local agencies at the drop of the badge".

 

[Au Contraire]

Upvoted. The point of that cartoon is often misunderstood. If the words are randomly chosen the method is strong against dictionary attacks. But random is not something human brains do well - you have to use a random password generator.

There have been repeated studies and reports that show random password generators are not actually random.