admin wrote:
You're ignoring my previous point: People do not use sufficiently long/complex passwords, in which case a different username extends it.
I'm not ignoring it. I'm stating it's wrong.
My original point that 5+10 characters is just as secure as 15 characters stands
Not when you know what those 5 characters are.
and is relevant in the context where someone wants a different username to 'aid security' - the solution is to add that username or any other characters to the password
which is then equally secure.
You
seem to be of the opinion, that changing the username has no value at all. All I can say, is that DEC disagreed with you, Microsoft disagrees with you and I disagree with you.
To give a practical scenario:
You just returned from
https://shodan.io
, with your list of Draytek Routers - and you type the IP address of the first one in the list, into your Web Browser. It responds and says "Username" and "Password" please. What are you going to type into that "Username" box? If "Admin" is not valid, we've 'removed the low-hanging fruit'.
Re: 'long' passwords: I
wouldn't recommend them (especially on Draytek kit) - a) for the reasons Microsoft give and b) because Draytek Routers mishandle them with monotonous regularity. (There have been several recent forum posts, where the cause of the problem turned out to be a (silently) truncated password).
