I guess I don't really disagree with you on that, especially if you're specifically targeting nontechnical users. However, the thought of someone reading this a

I guess I don't really disagree with you on that, especially if you're specifically targeting nontechnical users. However, the thought of someone reading this and choosing something like an all numeric password does freak me out because.... >Not really sure what you mean by this or what issue you think I have dismissed by mentioning brute force. Let me explain through analogy. I've often heard the story that a company will request a penetration tests and then restrict what can be done: "you can attack using method X, but not Y. A hacker wouldn't use Y." That's a silly perspective, right? A black hat hacker is going to use any means available. When you say brute force, you seem to be specifying the method by which attackers will come at your password (and it's certainly not just you, many other people are repeating the meme). I think that's the wrong way to look at it. Perhaps the confusion arises because you're making the assumption that someone will use some off the shelf, automated cracking software. That's reasonable. But automated != brute force. Again, if I were to write a cracker, it would first grab low hanging fruit. I've already given examples. Having a long password doesn't save you in that situation. That's why we think in terms of entropy. >Nevertheless, if an attacker has to assume that you will be using all character sets, the effort to crack your password grows exponentially with the length of your password. Agreed, but my point is they don't have to make that assumption. We don't get to decide what assumptions they start with.