3 ms·

I'd say to just treat any of the common passwords as a single character when validating. If "password" was treated as a single character, then password123 woul

by bloaf 10y ago

I'd say to just treat any of the common passwords as a single character when validating. If "password" was treated as a single character, then password123 would only count for 4 characters. It might be tough to explain to users, but it would solve the problem.

AstralStorm 10y ago
Don't worry, we will find a way around that stupidly draconian rule by making it not look like a word. For reference, common English dictionary words have about 24-bit entropy, a character has some 6 bits.
- mrob 10y ago
  That sounds much too high. What common dictionary has 16 million words?
  - Nitramp 10y ago
    And which user actively uses more than a couple of thousand words in something like a password? I'd expect actual entropy to be way less.