Here's a philosophical question. Is choosing a strong password "security by obscurity"? A 20-character mixed-case random string is only more secure than the pas

Here's a philosophical question. Is choosing a strong password "security by obscurity"? A 20-character mixed-case random string is only more secure than the password "password" because so many users default to the latter, and to short words and dictionary words in general. But it's no easier to generate a rainbow table for an English dictionary than it is to generate one for an equally-sized subset of 20-character strings.