3 ms·
> I'm fairly sure a double-digit-level alphanumeric jumble is sufficient to be a password This isn't required either. Of course there's an xlcd for that: https
by troupo 3mo ago
> I'm fairly sure a double-digit-level alphanumeric jumble is sufficient to be a password
This isn't required either. Of course there's an xlcd for that: https://xkcd.com/936/ https://xkcd.com/936/
Besides,
--- start quote ---
Using complexity requirements (that is, where staff can only use passwords that are suitably complex) is a poor defence against guessing attacks. It places an extra burden on users, many of whom will use predictable patterns (such as replacing the letter ‘o’ with a zero) to meet the required 'complexity' criteria.
https://www.ncsc.gov.uk/collection/passwords/updating-your-approach https://www.ncsc.gov.uk/collection/passwords/updating-your-a...
--- end quote ---
- RugnirViking 3mo agoThis. The siren song of "oh but increasing the number of characters makes brute forcing harder exponentially" is defeated in practice by the fact that everybody's password is following a few predictable patterns. You know what else increases the complexity exponentially? Longer passwords
- bitexploder 3mo agoYou know what else increases the odds you can’t brute force it? Not having one :) Seriously though, the best password boxes are one that have an entropy meter and check that your password has never been in a breach.
- jorisw 3mo agoSeconded https://blog.codinghorror.com/password-rules-are-bullshit/ https://blog.codinghorror.com/password-rules-are-bullshit/
- user_7832 3mo ago> This isn't required either. Of course there's an xlcd for that: https://xkcd.com/936/ https://xkcd.com/936/ Oh, I'm well aware (with the concept and comic both). My passwords that I set for myself almost always are like that. It's just that I wasn't sure if OP was aware of it, due to what their site was asking.