3 ms·
Entropy of [a-z0-9] per character : 5,1 bits Entropy of [A-Za-z0-9] per character : 5,95 bits Entropy lost by case insensitivity
by loup-vaillant 14y ago
Entropy of [a-z0-9] per character : 5,1 bits
Entropy of [A-Za-z0-9] per character : 5,95 bits
Entropy lost by case insensitivity
(per character): 0,85 bits (15%)
Bottom line: add 2 characters, and your password stays strong. Still, it would cool to warn users, or at least explicitly advise them to use longer passwords.
- Retric 14y agoOr if you care just use an authenticator which adds significant entropy without forcing you to remember anything. http://us.blizzard.com/store/search.xml?q=authenticator http://us.blizzard.com/store/search.xml?q=authenticator they all have free android / iOS apps.
- speleding 14y agoNot only is the entropy difference small, there is also an added benefit in less users having to reset their password. Forgetting how their password was capitalized is a big problem for people. Letting improved user experience trump a tiny bit of extra security is a good tradeoff for Blizzard. They're not a bank.
- JackC 14y agoFWIW, I think I read at one point that WoW accounts were worth more on the black market than credit card numbers. So security isn't totally unimportant.
- stordoff 14y agoI wonder if this (to some extent) offsets the loss of security by converting to uppercase. I know that I have reduced the complexity of passwords I forget (often by limiting them to lowercase), so I suspect other users do the same when they reset.
- loup-vaillant 14y ago> They're not a bank. Definitely not. My bank forces me to use only numbers, and only six of them. Strooonng security. The only way out of key loggers I suppose (they make me click on numbered boxes).