"reduce your cracking time greatly" More characters is always numerically better... but better, as they say, is the enemy of good enough. And "more ornerous"

"reduce your cracking time greatly" More characters is always numerically better... but better, as they say, is the enemy of good enough. And "more ornerous" is the enemy of a paying casual userbase and doesn't help you at all vs the most common attack vectors (keyloggers and social). Because of blizzard server limits you're not going to brute force login to my battlenet account even if I tell you my username and half of my password. If you steal the hashes you're probably not going to be able to do anything with it because of work factor key lengthening and the fact that you have to attack each account one at a time. Even then let's say you've managed to steal blizzards user/salt/hash databases and put a small country's GDP worth of GPU resources into breaking all the passwords. Now you come up against the fact that the vast majority of the accounts, including prohibitively all of the best ones, have 2 factor authentication. Get past those 3 mission impossibles and you run into even more server side limits on IP logins. And logging in and doing anything on accounts takes time and blizzard's going to quickly figure out something is going on and put the whole thing on lockdown. So yeah, not a huge deal imho. ... "bits of entropy" is just the binary log of the character space, 81 bits -> 2^81.