3 ms·
I am also a layman, but I think the answer to your first question is "it depends". Specifically, it depends on the length of our mixed meta password and the len
by AgentConundrum 15y ago
I am also a layman, but I think the answer to your first question is "it depends". Specifically, it depends on the length of our mixed meta password and the length of your passphrase.
I ran the numbers for passwords up to 30 characters long and made a chart in Excel showing the total possible passwords, one to thirty characters long, given a variety of character spaces, using the form s^l (character space to the power of password length). [1] The weakest space I used was lowercase characters only (26), the most complex was "all keyboard characters" (96). (In between are various combinations of lowercase, uppercase, numerics, common punctuation, and all punctuation. It's not entirely relevant to my point though.)
One interesting point I found was that a purely lowercase password only needs to be 30 characters long to beat an "everything on the keyboard" password of 22 characters, and is a lot easier to remember.
One serious point to consider is that passphrases aren't the same thing as "lowercase-only" passwords. If you consider each word as a "character" you could use a dictionary to brute force it, meaning that rather than brute forcing the series as ["a", "b", ... "z", "aa", etc.] you could brute force it as ["an", "as", ... "an account", "an acorn", etc.].
Personally, all of my passwords but one are ridiculous mixed passwords that I don't even know. The last password is the password to my KeePass database, which is a longish passphrase (also the phrase I use doesn't make any damn sense, which is sort of the point). The idea is that long mixed passwords are hard to remember but are more secure than an identically long phrase, so I want to use those as much as possible, but because it's essential that I remember the KeePass password (because forgetting it would lock me out of everything), a passphrase works as a memorable but still complex password.
I'm not entirely sure I've done any of my work correctly, so I'll just sit here and wait for Thomas or Colin to come in and take me to school.
[1] http://i.imgur.com/4tMEX.png http://i.imgur.com/4tMEX.png
- janzer 15y agoHere is some recent research on the strength of a multi word passphrase. http://www.lightbluetouchpaper.org/2012/03/07/some-evidence-on-multi-word-passphrases/ http://www.lightbluetouchpaper.org/2012/03/07/some-evidence-...