Thread by @ErrataRob

Ah, memories! I was giving a talk at PasswordCon on "Password Misconceptions" or something similar. A previous speaker was "caught" unlocking their screen before their presentation with a short password. Everyone knows short passwords are weak.

https://twitter.com/thorsheim/status/1401653496168988673

So when it was my turn, I did the same, because I'm a jerk (I quickly edited my talk to add a slide).

The audience saw me connect my laptop to the projector, saw the lock screen appear, and saw me type a short password [******] to unlock my computer to start the presentation.

They laughed at me for my weak, insecure password. How could somebody be talking about password security and have such a weak password on their laptop??

Then I started my presentation on "Password Misconceptions". The first slide was a photograph of my computer lock screen with a short password [******] typed into the field -- exactly what the audience had just seen.

I proceeded to explain why this wasn't, actually, insecure. It's because I do things with my laptop differently than most people, by having a separate 'unlock' password than a 'boot' password and a 'remote network' password.

The point is that there's tradeoffs. A long, complex password every time you unlock the screen encourages bad behavior, such as no locking the screen. So just split things: a long complex password for administrative things and a short password for unlocking the sleep screen.

Now with a fingerprint reader on the keyboard, this whole thing is moot. You can have the best of both worlds, a long complex password and the simplicity of unlocking the sleep screen.

One of the things new speakers at conferences worry about are questions like "Will the audience like me?" and "Will the audience respect me?".

I started this particular talk by making the audience disrespect me, then transitioned to them not liking me (for turning the tables).