I don't see much sense in claiming that a mere 2 digit increase would be the crux of the problem. Sure, nowadays since most websites enforce a 8-digit limit, mo

I don't see much sense in claiming that a mere 2 digit increase would be the crux of the problem. Sure, nowadays since most websites enforce a 8-digit limit, most cracked passwords are 8-digit long. So what? If everybody goes to 10-digit passwords, then aren't we back to the status quo and most cracked passwords are going to be 10-digit long as well? Also, how much does a 2-digit increase make the brute-force computation much harder anyways? By dropping those requirements the cracker's job can literally get much easier instead of harder even with the length increase. I don't think the point about random password generation is much valid either. Since most websites just have such password requirements in place, why wouldn't those generators just remember to put the upper case and special characters into the final result? They might try to generate them separately and insert them at a random position. That shouldn't compromise the password's security right? As a side note, I also don't get why for Chinese websites a limit of 6 characters would be a good idea, as he spends the whole article talking about length... Surely many Chinese don't use English words (though many still do actually), but they use pinyin, which is a way to write Chinese characters with Latin alphabet. Literally nobody uses real Chinese characters as passwords, and most websites just downright don't support them. Clearly he doesn't know much about Chinese websites anyways... In all, I think most of his articles are excellent but this one is really a bit off the mark IMO.