> the length of a password is approximately proportional to the time taken to perform a naive brute force attack against it This is incorrect. The time (or re

> the length of a password is approximately proportional to the time taken to perform a naive brute force attack against it This is incorrect. The time (or resources, in general) required to perform a brute force attack grows exponentially as the length of a password increases. For example, let's say you use lower-case letters only, but choose them uniformly at random. If it takes an attacker one day to crack your password now, then adding a single letter means that it takes the same attacker 26 days, and adding 4 letters makes it so the same attack would take over 1,000 years.