3 ms·
That’s why I, in the EDIT, then chose to assume 2^5 different characters, which is roughly lowercase ascii plus some special characters. That’d still be 80 bit
by kuschku 9y ago
That’s why I, in the EDIT, then chose to assume 2^5 different characters, which is roughly lowercase ascii plus some special characters.
That’d still be 80 bits, and still secure enough.
- palant 9y agoAn 80 bit password would be secure. In fact, now that I am aware of this issue I generate the master password for Thunderbird with PfP: Pain-free Passwords and it's in fact around 80 bits strong (too bad that I cannot use PfP in Thunderbird directly). But if you as a human choose a 16 characters password you will get far less than 80 bits. Passwords chosen by humans follow known patterns, use dictionary words etc. Which is why password cracking applications won't stupidly test the entire password space - they will go for passwords that humans are more likely to choose. Fact is, for a human getting significantly higher than 40 bits while still being able to remember the password is very hard.