3 ms·
Minimum password length is really only a protection against brute force attacks. And if the site in question has good protections against that (i.e rate limitin
by snowwolf 9y ago
Minimum password length is really only a protection against brute force attacks. And if the site in question has good protections against that (i.e rate limiting login attempts) or requires 2FA then password length could be relatively short.
Of course if the database is breached, then those protections go out the window and it comes down to the hashing algorithm used and its resistance to brute force attacks.
I think generally it will depend on the threat model of the site in question and what protections are in place.
- e12e 9y agoThis is the reasoning behind 4 digit pins for cards: after three wrong attempts the atm will swallow the card (which gives an average (1/10000)+(1/9999)+(1/9998) = 0.03% chance of guessing a random pin for a single card. But chances are obviously much higher if you want to guess the pin on a single card out of a batch of 10 000, or if users can pick their own pins).