I did, but that assumes the average person. This is HN, not Facebook, so we can make different assumptions. E.g., we can assume that everyone has read the famo

I did, but that assumes the average person. This is HN, not Facebook, so we can make different assumptions. E.g., we can assume that everyone has read the famous XKCD on passwords, and is using passwords that are a bunch of words after another, in lowercase ascii, which would get us somewhere around 80 bits of security, and still keep it memorable.