4 ms·

The same is true of passwords now since the invention of rainbow tables. The best way, aside from voluntary disclosure, to compromise any password is brute for

The same is true of passwords now since the invention of rainbow tables. The best way, aside from voluntary disclosure, to compromise any password is brute force. The best way to eliminate brute force is to require a long minimum character count and to hash passwords using a 512bit hash algorithm. Imagine the size of a rainbow table of SHA512 or SHA3-512 hashes for a 60 character password. A 60 character password could be as simple as: * I enjoy driving my tiny white car with a standard transmission. * My big cat, Ace, really sleeps a lot during the day while I work! * Growing up my favorite song was Time by Pink Floyd about regret :(

GordonS 6y ago
For most passwords, you should be using a password manager, which means long, high entropy passwords (which will not be memorable as a result). For the few that you need to manually enter, something long is good, but it should ideally use characters or different classes, and ideally not be comprised solely of dictionary words (which your first example is), otherwise the search space is greatly reduced. Also, manually entering a 60 character password is not going to be fun :) I think the longest "manual enter" password I have is 25 characters, and it's a PITA to enter in a password field!
- austincheney 6y ago
  > high entropy passwords You only need that to impose a greater character width against brute force attacks. That is the only value in high entropy. The actual reason people think they need this is because it was written into a NIST publication a very long time ago and it just became common practice. As a proof of concept what is the published standard that imposes that practice? I bet you think you need this but cannot find the written standard guidance suggesting it. The guy who originally wrote that standard later came out and said it was a mistake. Bad advise that he wishes he could take back, but it’s too late everybody thinks they need it and they don’t know why or where that guidance even comes from. > and it's a PITA to enter in a password field! Only on a touch screen. My first example also contains uppercase and punctuation. Think of it like IPv6. When the key space is large enough you don’t need a bunch of bullshit and gimmicks to ensure uniqueness.
  - GordonS 6y ago
    > You only need that to impose a greater character width against brute force attacks. That is the only value in high entropy. That's exactly the reason I meant - to make brute forcing take much longer. > Only on a touch screen Yep, certainly worse on a touch screen, but I hate entering long passwords even on a keyboard - it's OK if it's a field that let's you see what you type, but if it's just asterisks, then I find it hard not seeing that visual feedback.

GordonS 6y ago

For most passwords, you should be using a password manager, which means long, high entropy passwords (which will not be memorable as a result). For the few that you need to manually enter, something long is good, but it should ideally use characters or different classes, and ideally not be comprised solely of dictionary words (which your first example is), otherwise the search space is greatly reduced. Also, manually entering a 60 character password is not going to be fun :) I think the longest "manual enter" password I have is 25 characters, and it's a PITA to enter in a password field!

austincheney 6y ago
> high entropy passwords You only need that to impose a greater character width against brute force attacks. That is the only value in high entropy. The actual reason people think they need this is because it was written into a NIST publication a very long time ago and it just became common practice. As a proof of concept what is the published standard that imposes that practice? I bet you think you need this but cannot find the written standard guidance suggesting it. The guy who originally wrote that standard later came out and said it was a mistake. Bad advise that he wishes he could take back, but it’s too late everybody thinks they need it and they don’t know why or where that guidance even comes from. > and it's a PITA to enter in a password field! Only on a touch screen. My first example also contains uppercase and punctuation. Think of it like IPv6. When the key space is large enough you don’t need a bunch of bullshit and gimmicks to ensure uniqueness.
- GordonS 6y ago
  > You only need that to impose a greater character width against brute force attacks. That is the only value in high entropy. That's exactly the reason I meant - to make brute forcing take much longer. > Only on a touch screen Yep, certainly worse on a touch screen, but I hate entering long passwords even on a keyboard - it's OK if it's a field that let's you see what you type, but if it's just asterisks, then I find it hard not seeing that visual feedback.