How big of a problem is this?
I had trouble finding a large number of examples of dumb tricks to generate passwords. Could you provide more examples? Perhaps the problem here is that it's subjective. I think adding foreign words to diceware or an unprintable character at the end of your password is an interesting proposition to add a small amount of extra security, while other users may say "just use a password manager to generate a 16-character alphanumeric string".
"Dumb" isn't a closure reason
As far as I was aware, just because a question is dumb, low-effort, or trivial doesn't mean it should be closed. Realistically, low-effort questions clog up the site with low-quality content, so there is some merit in closing or deleting them. However, none of the closure reasons are directly related to how dumb you think the question is. That's what a downvote is for, and a vote to close is not a super-downvote.
Deciding which password schemes are dumb tricks isn't simple
You seem to assume that line between naïve passwords and smart passwords is clear, but in many cases there's a big grey area. Password schemes falling into this grey area will create controversy when you try to close them as a dupe of a "don't use dumb tricks" question.
Some examples of questions that fall into the grey area include:
The mythical canonical answer
Every website about passwords tries to develop good explanations of do's and don'ts of password use. What makes us different is that we have thousands of specific questions and answers, which in a world dominated by Google searches is a very good strategy. While processes like clearing up duplicates can make it seem like the goal is to have just one canonical question and answer for every topic, in reality we aim to have a variety of similar questions and answers so that users can find the answer easily to their specific question (source). Closing lots of low-effort questions about basic tricks is a valid goal, but it comes with the caveat that many questions won't be so easy to mark as a duplicate and that's ok. We're allowed to have several variations of the same question.
We're not trying to tell people to just go RTFM. I've seen too many cases on this site of overzealous users who tried to close questions as duplicates of questions that are only tangentially related. Using vote-to-close as a way to say "Answering individual questions like yours is too much work, but here's a link to an indirectly-related generic answer that might answer your question" isn't helpful, it's OCD.
An intermediate solution to this is having a canonical answer for common variations, like adding foreign words, adding part of the website name, using the current year in your password, etc. We already have this, although many of the answers aren't very good.
Duplicate closures are a tricky subject. For more see this meta question .
Current questions are not a good candidate for a single canonical answer (these are the only ones I found, please comment any other ideas you have):
Closing new questions like "is wwwwwwwwwwwwwwww a secure password?" to any of these questions would be confusing and even potentially rude.
Picking a recommended password generation scheme is controversial
Password managers are one of the best solutions, but are a pain for many people. I have family members that don't lock their phones. You think you can force them to roll some dice and use a third-party app just to protect their Disqus account? There are also many places they don't work like websites that block copy and paste, hardware like smart TV or videogame systems, public computers, phones under some circumstances, etc.
I've tried to start a question about how long passwords should be, only for the idea to be "too subjective" under its most general application, and already covered under more narrow formulations thanks to similar questions like this. A user in the comments told me a 32-character alphanumeric password would be sufficient for some people but not for others (even though over 90 bits of entropy your password becomes ridiculously hard to crack).
Various widely accepted systems like diceware and xkcd have been their own source of controversy (see Bruce Scheier's criticism). These widely accepted systems have also seen several extensions, from different separators between words, casing changes, using online generators vs dice, and using foreign words.
Given all these points of personal opinion, are you really going to tell a user that their idea is dumb and your idea is unequivocally better?
Standard points that would have to be made in the one-size-fits-all question
- Explanation of threat models like brute force, shoulder surfing, plaintext leak, or offline cracking
- Advantages and disadvantages of a password manager
- Explanation of how entropy is computed as a result of password generation, not just apparent complexity
- Discussion of memorability vs guessability tradeoffs.
- Ideally, if I have two passwords of yours, it should still be very difficult to guess another password.
- Either explain the most common tricks individually like repetition and changing characters, or walk through how to calculate Kerchoff's principle and, discuss where each should be used.
Pros and Cons of redirecting all dumb trick questions to one new canonical one
Pros:
- Less redundant information and effort explaining things like why a password manager is good, what entropy is, what the threat scenarios are, how cracking works, why it's hard to outsmart password crackers.
- More focus on one good answer to this question rather than hundreds of answers
- Leaner site with less clutter
- Fewer dumb questions that annoy experts
Cons:
- Reduces unique information for each password question asked, making our answers less useful.
- Less Google-friendly design. Asking "Does repeating words make my password more secure?" directs you to a page which redirects you to a lengthy general explanation of password strategies instead of going straight to a targeted answer "No, password crackers can predict that, you don't really gain anything by repeating words."
- Would probably result in overzealous behavior, causing good, legitimate questions to be misunderstood and closed.
- Can be offensive to the asker who didn't realize their closed question was dumb and now is told their question doesn't belong here and they should have already found the answer.
Some unique information can be generated for each password scheme:
- Is the scheme recommended by any researchers or websites?
- How usable is this password scheme?
- Is the scheme already covered by common rules in software like hashcat?
- Does the scheme seem like nation-state actors might be able to compromise it?
- Does the scheme seem likely to be misused, compromising it's security?
Even though there are problems with the way it's currently set up, I'd say we keep doing what we're doing. Creating one canonical answer would probably help these dumb trick questions, but creating a canonical answer would be difficult, deciding which questions to close as dupes of it is controversial, and the askers might still find the redirection to a canonical answer unfriendly and unclear.
