7 ms·
>People aren't good at memorizing long lists of things It's much easier to remember a 40 character passphrase of real words than a 12 character password of ran
by TremendousJudge 8y ago
>People aren't good at memorizing long lists of things
It's much easier to remember a 40 character passphrase of real words than a 12 character password of random symbols including punctuation
- ryan-c 8y agoA 40 character password of real words is usually easier to crack than a random 12 character string, though.
- guitarbill 8y agoCitation needed (that sounds wrong without seeing the maths). But also missing the point. It just has to be better than the usual 8 + some punctuation at the end that most people resort to when faced with these shitty, asinine password rules.
- ryan-c 8y agoEnglish words are ~1.5 bits per character, random ascii garbage is ~6.5 bits per character.
- jrockway 8y agoIt really starts to depend on the details. If there are 10,000 words and you use 5 of them, that is 1.1x more than 12 characters where you only use lowercase letters, numbers, and shifted numbers. Tweak the allowed symbols, length, and your dictionary and you can make either one look better than the other. I think there are probably less than 10,000 words that people would choose for their password, and that people use capital letters... maybe, but don't use 12 character passwords (8 more reasonable) so it could really go either way.
- WorldMaker 8y agoYes, but it doesn't solve the problem of memorizing a list of 40 character passphrases for every single website/app that you use. Length alone as a password strength requirement is not sufficient. Length alone only further encourages password reuse, because people won't memorize more than one or two passwords, especially as they get longer.