3 ms·
That would be true if the password were 16 random ascii characters. But of course it's not. It's almost certainly only using printable characters, and probably
by gweinberg 9y ago
That would be true if the password were 16 random ascii characters. But of course it's not. It's almost certainly only using printable characters, and probably has something a lot like words in it.
- kzrdude 9y agoJust to chip another little piece off, ascii is a 7-bit encoding, and the 8th bit is clear, so that makes 16 × 7 = 112 bits if we use any ascii byte (0..=128). I'd count 6 bits per letter (64 different characters) as a rough estimate for realistic passwords.
- kuschku 9y agoThat’s why I, in the EDIT, then chose to assume 2^5 different characters, which is roughly lowercase ascii plus some special characters. That’d still be 80 bits, and still secure enough.
- palant 9y agoAn 80 bit password would be secure. In fact, now that I am aware of this issue I generate the master password for Thunderbird with PfP: Pain-free Passwords and it's in fact around 80 bits strong (too bad that I cannot use PfP in Thunderbird directly). But if you as a human choose a 16 characters password you will get far less than 80 bits. Passwords chosen by humans follow known patterns, use dictionary words etc. Which is why password cracking applications won't stupidly test the entire password space - they will go for passwords that humans are more likely to choose. Fact is, for a human getting significantly higher than 40 bits while still being able to remember the password is very hard.