> but I hope you'll agree that even 4*rand(10k) is a pretty gracious assumption for password quality I do. However, for it to be "worse" than plaintext you st

> but I hope you'll agree that even 4*rand(10k) is a pretty gracious assumption for password quality I do. However, for it to be "worse" than plaintext you still need to be using it somewhere else, and (previously unmentioned) for the attacker to have a feasible way of attacking the other use. For instance if it's your desktop password, an attacker may have no way of leveraging that (not that I'm saying this overlap is a good thing security-wise). Whereas if they have your unencrypted ssh key then they 100% have your ssh key, no work required, no AWS instance, no cost. I don't want to get too bogged down in this. I was using the old format, and I've now changed, so thank you!