3 ms·
> "Summer2024!" is perfectly fine, if you use it for exactly one service. Frankly, "1235" is probably fine. No one is out there brute-forcing passwords. Respec
by mr_mitm 2y ago
> "Summer2024!" is perfectly fine, if you use it for exactly one service. Frankly, "1235" is probably fine. No one is out there brute-forcing passwords.
Respectfully, I disagree. "Summer2024!" is probably the second password I'd try after the username itself if I have to guess a password. Use it in a password spraying attack on a company with 500 users and you will get a few hits, I promise.
- coldpie 2y agoIt's a fair point, but I think my argument still stands. Guessability is a different property from entropy, yeah? "Summer1975!" has the same entropy, but you probably wouldn't have put that into your password sprayer.
- joshka 2y agoSummer1975! would be equally likely to be checked by a password sprayer. It has the same number of hits on HIBP, and falls into a category where heuristic password guess algorithms would generally group them as being the same thing.
- nemo8551 2y agoMy old work used to give a default month-year-org name and an exclamation mark. The majority of people who still used it was insane. LinkedIn was a treasure trove for logging into accounts.