Upvoted for recognition of the difference between academia and reality, and lack of spherical cow assumptions. It's entirely possible that someone might stop a

Upvoted for recognition of the difference between academia and reality, and lack of spherical cow assumptions. It's entirely possible that someone might stop at 14 (for example with NTLM based on an incorrect assumption that as LM stops at 14 characters, so must LM for example). I guess the point is that security's more probabilistic than deterministic, which means that you can take some measures on a given topic up to a point, then beyond that the payoff decreases to the point where you're wearing a tin foil hat and worrying about the RF conductiveness of tin foil versus the alien ray beams it's supposed to be blocking. Still, thanks for the interesting conversation, it's one of those things that for me makes HN really worthwhile participating in.