1 - the article linked here on hn gives 9 characters as the current practical limit for brute force hacking with a 100 values per character (upper + lower + sym

1 - the article linked here on hn gives 9 characters as the current practical limit for brute force hacking with a 100 values per character (upper + lower + symbol). the link you gave calls 6 characters "safe for life" when using alphanumeric + symbols. while exactly what symbols are included is significant, there's clearly a major discrepancy (i guess that the problem is two-fold: your link is woefully out of date and the link here is over-estimating rates on gpus). 2 - also, using more words is, in the context of the article you linked to, related to dictionary attacks. and again your article is pretty poor since it's giving an example with very common words which implies that a very small dictionary would be needed. i would not call "this is fun" a safe password. 3 - the article you link to is again misleading in that it completely ignores password helpers and puts too much emphasis on local restrictions like reducing login rates. it seems like it was written before both the web (we are seeing lists of passwords being stolen - that makes "restricting retries" completely irrelevant) and gpus were common. i would not use it as a reliable source of advice.