XKCD-password-generator VS comment-castles

Either use a password manager or a tool like xkcdpass.

Kinda like this, but personally we using in production /usr/share/dict/american-english-insane that create even more secure phrases that can be less than 6 words.

I use https://github.com/redacted/XKCD-password-generator.

Relevant XKCDs (There's always one) 1 2. For passwords, we're switching to a passphrase in the future, ditching complexity requirements, and setting a 25-character minimum. This may break things if you have legacy applications. Password are really rated using a metric called entropy, which is calculated using [char set]^[length]. Increasing the length has a greater effect on entropy, and therefore the security of a password. XKCD style passwords can be generated using a site like this, or implemented in a local application by implementing this Github repo. Even knowing how passphrases are generated a 5-word passphrase generated from a list of ~16k words is equivalent to a 14-character password with upper, lower, numbers, and 6 symbols as a character set.

you could generate a password with xkcdpass

If this C level is going to be stubborn about good password policy suggest a 6 word passphrase to him. They are easier to remember and type with around the same security as a full random large char set password. There are free web-based apps that do this, but if you're paranoid implement something like this github project in a local win app.

My word list contains 7227 words apparently, so 12.82 bits per word

https://github.com/redacted/XKCD-password-generator

Not sure how many bits a "good" password should be nowadays.

This for example - and you can see a working example here.

Slightly off topic:

I am trying to innovate on moderation systems and I run/code a whitelist moderated forum [0]. You can only see posts and comments from users that you follow. It's a very simple system and there really aren't any gaming vectors. One implication is that if a new user signs up and posts, no one will see it unless they follow. I've actually never used any typical censorship moderation.

[0] https://www.commentcastles.org

Reddit clone:

https://github.com/ferg1e/comment-castles

https://www.commentcastles.org

For moderation, a user whitelist sits in front of the typical content blacklist, which introduces some interesting properties.

I think my forum should work:

https://www.commentcastles.org

I can't think of anything that would be broken except for maybe the logo which is an emoji character.

You may want to check out Comment Castles [0] (disclaimer, I'm the creator). There are 50k comments, but I have never moderated anything. Actually, there are no moderation or admin tools built into the project.

[0] https://www.commentcastles.org

Comment Castles + Reddit thread