4 ms·
What prevents me from using this type of strategy is the inconsistent adoption of password requirements. For example, some of the websites I use require passwo
by stevewilhelm 12y ago
What prevents me from using this type of strategy is the inconsistent adoption of password requirements.
For example, some of the websites I use require passwords to contain at least one capital letter, or a digit, or a punctuation mark (e.g. ! ? #, etc.). But other Website do not allow punctuation marks or digits.
Some require a password of a minimum length, but a dwindling few can only accept fairly short maximum length password.
- bro-kaizen 12y agoWait really? It feels like almost every time I make a new account somewhere and drop in the 200 character high-entropy password that LastPass generated, I get a silent failure or misleading error message about "your username was not recognized." Then I try guessing which feature of my candidate password is pissing off the site: Is it the whitespaces? Special characters? Length? This is particularly maddening because there are plenty of ways to accept arbitrary passphrases from users.
- jrockway 12y agoYou use 200 character passwords? I'm happy with 12.
- Springtime 12y agoObviously the longer the maximum available length the better but it does assume the host computer always has the password manager installed. I'd shudder to think how such a long password would be entered otherwise.
- Dylan16807 12y agoOnce you get up to a threshold like 128 bits there's no real benefit in going further. So 22 alphanumeric characters is 'good enough for anyone'.